37ad6de28128fc37628ba6dc74f4b75814a0e3540a83899c4681e251cae28631

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260808-tg4bgsec76
SHA256 37ad6de28128fc37628ba6dc74f4b75814a0e3540a83899c4681e251cae28631
MD5 5cc75a57f7a63e1833f240e19bf47055
SHA1 892d181568b7166e5781e9bdc88ad4f5c8c490d6
SHA512 3cf9f1b88446388e6c797767b8aa5eda76d6520e404268c42a2028e3575e8665c8c2830a3b377d649c13b1daf1a83c7d13cb7fdddeb28f8130bf772cb4697e6d
SSDEEP 49152:K+D9r1XxKxQUIFFdMm9np4gaJ6Ag1BXVo/cRAdaCQ5+CTXsLyVDmg27RnWGj:vzP3aaFo8F88D527BWG
TLSH
T153167C17E2B941E5C0BBD13D8A979657FEB2784A873197CB4390861A5F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2960	elevation_service.exe
5736	elevation_service.exe
1548	maintenanceservice.exe
2708	OSE.EXE
4636	PerceptionSimulationService.exe
4892	perfhost.exe
5180	ReFsDedupSvc.exe
5436	SensorDataService.exe
4940	ssh-agent.exe
3252	AgentService.exe
2848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4dc8b8b0e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000040e932644f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de5360a54f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014def1634f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce8c57644f27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f748f8624f27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055acd0634f27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000d097a54f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe
5736	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2496	2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2960	elevation_service.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3252	AgentService.exe
Token: 33	2848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2848	SearchIndexer.exe
Token: SeDebugPrivilege	2960	elevation_service.exe
Token: SeDebugPrivilege	5736	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 852	2848	SearchIndexer.exe	100
PID 2848 wrote to memory of 5672	2848	SearchIndexer.exe	101
PID 2848 wrote to memory of 4400	2848	SearchIndexer.exe	102
PID 2848 wrote to memory of 4596	2848	SearchIndexer.exe	103
PID 2848 wrote to memory of 2136	2848	SearchIndexer.exe	105
PID 2848 wrote to memory of 1788	2848	SearchIndexer.exe	106
PID 2848 wrote to memory of 4328	2848	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5cc75a57f7a63e1833f240e19bf47055_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5436

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 662abf15022a800c2f1ca16256b759f5d65bb2451eb1ea115a12bdccae4729c6
MD5 4ecd438ce872b8f5730267c1a20bff98
SHA1 e9b2a98dd3969f472a6106653b26049388bea9e1
SHA512 efb8beb67e3639cf4921d7ba25124deb1575792008f48c4f728b11f05b4cff9674eb379b1f11357d9b679749cb18af9b083d368b9465c9dd0858f8e04fdbb173
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUDmg27RnWGj:23q6sjBrD527BWG
TLSH
T162D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f1cfba4fb79c45d90a94c4132896ab93d38a229a4f210496cb3c9ab77d4db51b
MD5 d1718d6f03af2a70b1b2d3b9d8023c39
SHA1 aac4a17947e0a00b89826044e17c6e3f9e984ffe
SHA512 aee8fb12e3e6f5cab7944f03fe6898cbee91fa1df7df3c352c1bc33f5bba2f8b1c9a7cb59213db750b96c209b8dc0c494fbbaf0a41ea003ed254b5eac91da321
SSDEEP 24576:7XYfDtczAIsqjnhMgeiCl7G0nehbGZpbD:etcxDmg27RnWGj
TLSH
T116650129B3E408F9EC67817CC9A2C515EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 834d5d35e349a611709e4c5502ab7dd3e1861cd50f82e5778070e869e550e7b0
MD5 88d9270e09c4b2055e22bfe4fda688aa
SHA1 aee52c5ae7471738ad8a4518178b98b4cea8e3c7
SHA512 d53bd9933622ce121dfc28e556c96442a26d318047d090cc568fdced3f9057ee66e359cf68f9f4f447c1a200fde2217d57a15c548a430daf0c722c0952499018
SSDEEP 24576:E0Le5ji0hmxxrMnsqjnhMgeiCl7G0nehbGZpbD:EPji0AjeDmg27RnWGj
TLSH
T111859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a58dccf8821936ba6d5f404848a5164cbaa7c7fb764f1e5b5c339127107ea4ba
MD5 7cd640625407addc51dfdc158f7bd383
SHA1 5707cc29c13ac6ddebb59e03dedc735210f9fd21
SHA512 bd903a685f88026616aeeff77d8641b51421de86f6f8a4fa629ed446286e0a1bf2ab4dde341a350215be170e5528a4d6a917a4581edddb7ec6e5d6433d967fdd
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyudsqjnhMgeiCl7G0nehbGZpbD:w/ezSC6vUzPveHjy6Dmg27RnWGj
TLSH
T1FC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 509a259fb61d65167a99b639604ef311f276e5fe5d2e38e263db02a35d2e777a
MD5 8f63c1b891eb6dda2968058a16de4bb6
SHA1 3f311930176a3ac4398856180e7b2279ec925f30
SHA512 9e5a4c0bb3bd1f14a5973efa06e7e05fb75e28fe6f847d10235251c917b3d9a79ce5922a4228bcfcc6285a31c302317d470d795d286f7c3d867cd0dc52fae05d
SSDEEP 24576:IVbqPb88hv/l+YMsqjnhMgeiCl7G0nehbGZpbD:IVO88hXl+ZDmg27RnWGj
TLSH
T101559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e6fcfb22c64e25a9d20f7daff0bd4dc4f47cd82865585ed50db2ea0ee6959eef
MD5 4df242bdc4288b936b21b5f0ce882847
SHA1 96bf9e1e7e2956c317243b528261202880051614
SHA512 72812164c50942558def008975c41f90f9b866b457310452ee27fdfa3cc3e00e7a6d2380816afd8a1b5222add6b64e510a49b1cf089631e33943a8d3a6e31699
SSDEEP 12288:NLbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NLbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2689a5fd63c615aba9cd8edc85f69bcabebf4a3fe006450f21b737c1c7058ef9
MD5 8f2258b87ce1d4a0e29963ef6179a8d3
SHA1 a8aa56aa810d55a476d99a63fc8534a12a06c904
SHA512 182dc027f2e823687728462f79a42065316ed3400510e0057bd657335eef2a181bc2dd2dbc6c5726595807cfb35d2482d836e9a296d5891cc4ac83feac50a996
SSDEEP 12288:5eBNUbTVO86UkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:5JIUksqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8806efb01e837c1a3cf94d64e18a988ba478d2c80ab235f878022a37b1d61b6c
MD5 ebc71b20389e02ec13883e36d7479842
SHA1 c3ae1f6367806b00963034a9f1d6436dfc0f8ba1
SHA512 9db7249b687ab87bc3f28a3abb7c63eb6acefb2fdca53d095ed8e9f81bcf4661da6c71173e3ecc12dee396cf6ba173a5f84fd89cfcd5fa0da2ef673f2360ac80
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THb:gQvGAdlCEL8c/DRNw5CRD527BWG
TLSH
T1C0266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b8e4bfc5d15937998e620696ccf1b59c63f15c8272b1b81a7e7a4b94aabeee02
MD5 702cc2453713bdd5aa16f7078cae0532
SHA1 f50de38cad3597228adf40b35270962d9a1d9b8e
SHA512 9de969a768842643b38c7b42be3103d6c264c53e5809d49af51690ecb07807ffb0fcb33766c665955155549e8b0868e8c68e70b7c47ce61584d569ceec219edd
SSDEEP 12288:lAwSfxL/2Dc3RDLLmt0LDQewsAjaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:G0ewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 33e715ad5e7cdabe326d645d9f11984e8992d9200e6bbeb67a1a0328a2b14f4d
MD5 e67586aedffecd17e0ce83c789cc5fe0
SHA1 13cc511309d9ee897e7b7a8ce4f8cfcf2e3aaa99
SHA512 ecfa712bda8911828ed790f0fc9b12a1d3e8f112df17361c2dff2ebb904a6108d1adafb8cbe1e299288586a42b7a843f4e001e3c6d776bfd82fe648a29b184f2
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGVQBWG:lUEtQevvqc2W1cpV2tI32ZB
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6e5fdb271c486eaa1acd082f0e836b167ca4852ef392f9d8cf28a76f7097fbc2
MD5 2553f3b46187abb971daf3fced4a52ad
SHA1 33220ce2c92bfcba60a8e4e511d26f49d5df5f3d
SHA512 310cee2079c77f2d4a79c69cd2c1196cfdc20ab38540b2f18e6c1f62de1d8f18ebb28c13420eb30d78c96ad40621a79e3d8ffbefa1edcdeb85842f35809677be
SSDEEP 49152:mCbRquA/m2yL5zTfFiV+XenmE3/zODmg27RnWGj:LoquVjnmdD527BWG
TLSH
T165D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b3d88d43c6ee3ac8b7305f35057c15623e3ef3a8d3cbc7e0c331b1599cbf7e61
MD5 d7008e1649e32624b52f87755258d301
SHA1 50553c8e4c55eb64f0bfba3886dc0b18e6b9ba3e
SHA512 6344034e35fc91834f7e877a2a4c3b850761682185907fe5b7e9e9442a77194fa95ba2bb95b1c6f6c19e8349a36b55c38b64247681ec46f0ecf10322457d8344
SSDEEP 24576:wAhGL3IFoiwtA5l7S535sqjnhMgeiCl7G0nehbGZpbD:wAMUFoiq5tDmg27RnWGj
TLSH
T1E2359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 26dd17f2ac2a5cd9e8feafb7e19402b53ca00f3f99e63e2787e8cbb59e8d04f3
MD5 1092b6369c0ae06c407ade0d53feb456
SHA1 c60728bbfec0162cdbbdfa88b12e2d02ef528e31
SHA512 def9031affc9d05764a61d947cee2330958d4b7c589cb163b813c787b304379939ca8983e3506580177d907b2748a60b24aa4857e67fb730889fcfb58f645e94
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+C9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:twu4OWWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF65F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 187c320f750e4d9b9d8063ae8f15c83096359eac54938d99c58d577d3a7db22f
MD5 46d16ae9e0577ec5344ee04ae8376713
SHA1 2befa7ae7a8d700249a217b5cbedebf84932f384
SHA512 764b1ed2e19028f06c052e6a8413edde0b2fd9c0f16bde260840d7fbc7f03e973c56dc3387b09b31e600f013aab6c5725b55922cc7c6f61b897412fd60e91d7c
SSDEEP 12288:OeZ1IyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TZufsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B5512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7668d5395ba22a62a6fec42121ebb9ba67e55e2b1f85edac0dcea191017ee963
MD5 797abccf5fa82fee98d830bb42e4ad5e
SHA1 bafb116fe3268cc8819f3fe84fb7dea4bc95e686
SHA512 ee7df6bd169c5ba2b57f6ac9b1fe55f1e1a05f258377c3f52a77e1f2d4f914f626ea43f46ee62656e26aefa56bd0aaa1e741ba911c24f0166d54ccbb79f98393
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN38D527BWG:nQyiKa/X+PNsVQBWG
TLSH
T11A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 05f858158e55cf5e742509dd90982263b9865e386b76838adba45db5b073efc6
MD5 9d0a3be5cc76a6545517c3bf90d57395
SHA1 00aade1578921772e58ebacb383d54db3830f228
SHA512 6bddfcbcf4e4ccec86a38c6edd744d100282aaad77ebe6e139e6a8c5e77de684e9c7a7efd70753e1a3b04c2e0b3ca1922eec47b108539d836ea9f558c4cac0cb
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN38D527BWG:nQyiKa/X+PNsVQBWG
TLSH
T1F8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4f4cddbc6252eeae30aab1177431282954204969fb974ce74efacdffc58f7d2c
MD5 94d4abce16949f68f7c4c2fcb4df2820
SHA1 6fe7cb2ef0cdddadb73670f61560258ac17aeec7
SHA512 669a52e99c2ac743b7a98003ce82d29c6d7d86893196f635f7781cc771ae943934df8f74d5ad7834113907e2d59779666cf20bc3c76751cdf41c8e82d26913c0
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0PsqjnhMgeiCl7Ge:t68Qg55nhceWu7PNU3/eDmg27RnWGj
TLSH
T1BDB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cc5ea30a9c611348721a99df2f6735f1b7dbcf7fa2d98ed513d854ed9c3d0f2e
MD5 05ef2761124f804595fe4ac775302de9
SHA1 c31d0fa32c392f7a7049079005c8b8f295e6bc69
SHA512 db46e055551d695caab5a1c2d6885f8e33fc93350f619d84bd10aa65b3376f224456952bf07ef91ee930bfc6f66dc906b4f4f7398ddd4a8846709d5928372ddf
SSDEEP 98304:Zy5112gYy5azzVvt69nLKnhZPD527BWG:0LIHEWh1VQBWG
TLSH
T18B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c99d168d231d6a25b02e1523f4bff61c4dc3ad1b000519426d815717ce9512dd
MD5 390e0f21fb19d8de6829f0582d9505a8
SHA1 4667be15d3876e5e741cf13d6e6e639138df90ed
SHA512 8e2f93a110d258e95160eb51c95c1e95a936ba7794c7c7bb1d10ed9439c989d636bfabe0151595bf784779a7aa76f36358a0ab134998da861186a1b3fe0430f9
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glPDmg27RnWGj:Du6Jmdxd2dPD527BWG
TLSH
T1EDD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dee9abcde7b4607ee11b8a66a8bcb57cb2aec0a9263c3f65c9f638ee6bf452b0
MD5 dbd3f663939d89449ca8038bcbe4766e
SHA1 748ffc4e0336e73e6085537c107c428f59d7c6c5
SHA512 5e2ab79351982991557c3b1acd6477e7fa600296437882cdf2152bde733d8d79683e67fcf7e7319eeefd387c17fc4de26427205b4608f69da0bcc5f53f5633cf
SSDEEP 49152:r1hpsNoJpF1A63U44CwH7R4xgDmg27RnWGj:rmifPWRdD527BWG
TLSH
T148B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7fe8cd74231bdc54dd62a66ec9a5af918354650c87d3e240c204c823c3f81dac
MD5 f7b644c0fae7d5bfec01f4006d3a8dbe
SHA1 ce401587b1273305ecb683ec6e772b3d378cfd75
SHA512 0abf0e7a01b4282fa4cc13b5ff1f25a3dd1d2d48c202388111b6daa8fa4e1122ccadbb258e1ef0f3443483ae6e649de5c4a523fbf248833c5642f5c9acd486d7
SSDEEP 49152:mSuZQIY0Be2KcRVtOnks6NMHqDDmg27RnWGj:o5dKii61DD527BWG
TLSH
T116C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9cbc14d0505dce9954354f603c969983647fcf1844f94c627aa26db3112ecf7a
MD5 7a9f50e28711d588048a9d939c947317
SHA1 33c2967a629f65661d951a905d433832c88c30c2
SHA512 9d8609fb6125ea3948e64338658ee7d8e53922ca143e484de13218cf6f71591ce4d0cf3b01ae2332f0e83d97ff2f6aabc8f226a4b957d23d9c552153b353d8a7
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5w0Dmg27RnWGj:GX2imphpD527BWG
TLSH
T1FE95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 901359d8827fc2179371e955950fc5004d13c2105cf1de128d5a9a62842fbe41
MD5 aa5b6e4aa89007fff8d4375c8a18adbd
SHA1 09acebaac4e4ebed5abc0bab60ac589da88648e3
SHA512 b5a0795e297e67675690e645f214bdaf56f2d653999712599502f6e25d022bb7d2c843e65b43b434194e26d4000528bcaf6f5f1ef1d8612b51e655a812b349f6
SSDEEP 12288:bzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A577CBAFBB24984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f1d56351d099515dbacda1f8d1407d016bcf2ee46ef5244535f84162e36b8d21
MD5 0c5a1b10fe58adc6673bab226c71b48f
SHA1 1d4879d0f55f891b5f73919ee64c83c9b5041df3
SHA512 b3d73267d2a49219381c957027c718b6306d1f1fdd5513aa1e00037d6fc77d9ac0ba648c063cf048da2b1e5e77bb64d54a7eebc269841cb762d16b2f22edae9f
SSDEEP 12288:P+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1264523BF955C41CAE52648B5C3E5F10DAC073E5BE92004937AA77CBAF7B14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 44d1d0a8913bd0d2988a22771a9819349a7752e2132868030d01707ef079c9fe
MD5 114aa98489537dd778d8a12d19802765
SHA1 9d14a67b0585ced8d27aa162a48e032670923257
SHA512 e25b9a8b23dc4bc2e56e18d2b40c3ed44e4f9237ab32129a64053f1e7a3052fe9b2b5b9823b0aa62b3dd527cc100f3842441ff89350ea0bd1e8b627e8ffdab56
SSDEEP 12288:Y8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE965C41CAE52648B5C3E5F10DAC073E5BE9200493BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fb1bf3937fd310ee8441c9a0ff5ce16b1d0af64b93e8e3b94e68fbb022240b6a
MD5 b7f76a61087b4938f6148fe45cbca7da
SHA1 455e4d99d3e6540e907217548e3470306a2d44af
SHA512 e36d96a26db4e132add7d881ec135b3578feb528d921fb6c2571eaf87e8e6cc9ad5d91482f5595f306a2dd622269b6dc13608e548ba8a1808a6836e314329d1c
SSDEEP 12288:uVZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:asqjnhMgeiCl7G0nehbGZpbD
TLSH
T14545237B675C01C6D83285B4C2F5E11DE8237D96EB30059B6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 13feac1ab8bc3f6dfdc60d33458e683c525d72995bd9f0d7aa9b8fe83c8d117d
MD5 404087ec542fb62a72d896966891c53c
SHA1 09302d21ff6d9ceda7f7d0e2b0ff376a9cf97f5b
SHA512 33e8d6c580a5dfbc96ff7d59b5d4d779e04cd8dd56aa69cce90b0e0586d21ee9992907725acedbd2e82ea6feb288637075933a60fcdf1903296074c7bf6351f8
SSDEEP 12288:IBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1894523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8c8174aa0e728f02982163494b69c6c39f01acd6cab10ecd59f7864380c3f51a
MD5 04d46496f9a2012062cdaa0201a4babc
SHA1 85045e16270e4eeb103a9e5928b36383549f0f30
SHA512 e5888e424a8bea5fbd3c2811f4da9c5fd0ab6fbeba8c264b78552fc05df3d7b6fcf3e37247dfe338bca31e10f0cfb0844f785789b6feb2d3071eaa32b54cd357
SSDEEP 12288:9SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BF965C41CAE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 aeabc2f62d8f887f76655432f1126b4009f2a2a4fb0b13261b6cf4960a2c11d2
MD5 ba036c60307f01f65a60cf3be3925c98
SHA1 5f95d35bf6e16eaa730eecbb9c6591bb2203f8f7
SHA512 91bb08f9ea011aedb783bf85cfc3e06738c66834c231856291ddd593dbe11bc6251b298c7f8b2227f4ba4a3ecb1741be43a008c5ed9c52d87c0ae6ded0f91b9c
SSDEEP 12288:UGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF955C41CAE52604B5C3E5F11DAC073E6BE9200493BA67BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6d13bef076fe2cab55f90eb7f6d406f82a65f5f237af3c1b0cfa1cbfd9849b80
MD5 32591869a99bf3fb8af0b2226b86304a
SHA1 e384fd30bc4ec6159bd4ffcd5a34c153083a787d
SHA512 fc6907f823ab291e8ffcf09efdc68ccca9a00e50b06c1fd3cc101b9a7b5d86f46cc39bbf268b9616cbb07d70ec13b56eb6c1797a7d0f9334ba5f26862f3250f7
SSDEEP 24576:UZMRzFVSOesqjnhMgeiCl7G0nehbGZpbD:UZMRzfmDmg27RnWGj
TLSH
T1AB6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5b2d0152abb5e8a32eebf732d848d99395c20dd7de82149cd8a872225beec679
MD5 f470f7261f9a5aa53ed5c463edc85b86
SHA1 e3db31f02c099bf81d00ff05f0826e570c58ca72
SHA512 f453c1e1d53e4d5f4963325eb43c2404f397e99772822f3488a79a43c3a59748400347f63a3ef2f3faee2be3acb123c8c49250bbb79fc27153ab85e71904f6ff
SSDEEP 12288:hvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1584523BF965C51CAE52608B5C3E5F10DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d74752e68972bf7d1f84f301a14d9850faad4665e123fcf6d66eec4ea8e2012e
MD5 88222103cbc9e85956bdba4bafcda316
SHA1 544d4bfaabcc209033c9e5690516f37a63a37acd
SHA512 84d1f5af82761be09c5349e5e57291ac69facde31ba3db9da828a2d4520fba5ed543e8f3de40590c8967dc1418c3f3eac363d30192b95936ee607dd2c33b6a61
SSDEEP 12288:KrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BFA65C41CAE52608B5C3E5F10DAC073E5BE92004937A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 658bb62a300844d185363919d48810437ce361115e25e1f08951c16635514612
MD5 9c85b25c3c0025339c4a79a369e207c5
SHA1 61e8a9431c2f5fa88d66f176e287b1649c7ff40f
SHA512 9536acd1254b29501472c20f2a771b262483ab6c065259765db2e1e4112653bef0e47969396470d0a406030fe3bcd7cca9a8f48968a4be74dd15c12b2f594aeb
SSDEEP 12288:AyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12955125B73A530F9D1368138C5A29A06F7327C3647204AAF17A516BA6F736D04E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 54d2c2d6e363e1c5f179e54d969f6d7ecc16d4d504f5e7674ac358d300c0a325
MD5 92aedd6a945a52cf23e69a6ae3858ce0
SHA1 22ea9d1b5faf44aa34132977cc5d36ac4fed4e9c
SHA512 adbbeb9e93913ed7ff89cea050beb6834136c93ba0347699bbd9b2ffb993898d1d001aca5685812b7b01ecf3e121f50bb021c5a5f17478527b256451631ace30
SSDEEP 12288:uvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ce531af8532325db587d09604c90348de886b21b195f5107e8d03cc74cc7652f
MD5 fcf21908c61a8a63864671c0af207b78
SHA1 71f67338292a65fe958c158c8b1af6e8902be043
SHA512 9d77d0203a7aa71d017808233535fedd8225a5e451142c349a42e76255b490a62f7f8b0561ac1b83ba08fde109ba079fc6c7d23ae8dc385980c50f83a32f18c6
SSDEEP 12288:5vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BFA55C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ebf08682b1175c4e928500a834f585e209a566b8647023045eb25125349fda58
MD5 280052b949171bac92a850e871dd2118
SHA1 ab9192ba02ea9f93deaea8e224e843d52c831f38
SHA512 1b90145a3bc54d518dad773b8621f2602de094933583b5a9743a09504404e4ca04c831b98fab2d55cdeb21238be1548fb7987fbb1492dfa4ba7f2eb98d6dd110
SSDEEP 12288:jyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18055125B73A530F9D1368138C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fe225a65b98996158dd2a1ecbb03fdf27fb75ee3eb6c3266463ebc756a4afa48
MD5 aefde69fae91271348d1719681184529
SHA1 970b4685cdd342d59fb6f4a80070a5401cac6f5c
SHA512 9ab491cb41847b98ea4aa01203480d9d7b69dd17a2af62ce2a6582679a08351f6e996f33dc316e22c03c2f76a9aa75b341f762650dd3c4e848ca587f5166f6f5
SSDEEP 24576:oTDaLl3z0zDssqjnhMgeiCl7G0nehbGZpbD:oTuLljBDmg27RnWGj
TLSH
T1BA6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f2e84b4cf6ff4a9d1ee42ec66dfae94f327a2d0d7db2966c7ac28783359782cf
MD5 98ddbfde238c3008da0fd63617f1dc2f
SHA1 0d90c07c67ec1af2d746b12e52652e5b2e6e4ed8
SHA512 90330b2a48d7ec1501eebcf7f1f2823bbebfd2e235c2e82b8b1555470e34670c660aa83ba9513a44da583efb028ed292c32d1d12b0902129fe2416f914c7d853
SSDEEP 24576:P3vd9CHKy7GZgsqjnhMgeiCl7G0nehbGZpbD:fvd9CHKyamDmg27RnWGj
TLSH
T17675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 83d2c38f78764eecf4294f045d96822746dbb5d765303e113a2f9c6341b0baa1
MD5 7b7536d13c68b9df60fc17a4845f0258
SHA1 d7bfdd897275f59735e6186756d6c36a2dd5c866
SHA512 01e76acf8fcfdd72aaaa9bbb86e80436805c9a1dd3d42829b91bbc0fa7ef49057a5737ac9b58da9e3ea09453acec51882b1445042a80147bad2e0951939e8936
SSDEEP 12288:wcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BE955C41CBE52608B5C3E5F14DAC073E6BE92004937A977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 740c34183098a02ef907bc23ddc05e92395d32375c26501c41aea62ac2426c1f
MD5 a53350e143398f34cce2f94885f4d78e
SHA1 77e33c12356bcd8fcdc491afee7d07e445a9ab3e
SHA512 80a195b33e862fc92ed1ffb6ca3b4b0abe5eb56698f8d04d7f90350f7218d65aa0dcc4585cb5fa2b2f39cd7cf061ae7b0f5b5a7efa746afe22f817e47ae5d486
SSDEEP 12288:GKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BE965C41CAE52644F5C3E9F10DAC073E5BE92004937B977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fc3a76188ac226ab2fda587aec2a18364f72c090e2e76cc2ffae5053a3fb64f4
MD5 286f3db558508ab1fb46273c0225cc6d
SHA1 3e228ec8f36f3e95b19ef695010deb312c27564e
SHA512 16935cb59122c32261ae1ad8e4580f72989c7f5deb5d6763e88ec58f64071d8cada1a78c2e0cfbc013a58b1d612b940ea050b20a46cecaed698fe67d0229674d
SSDEEP 12288:kFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BFA55C41CAE52648B5C3E5F11DAC073E5BA9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e8bf29007fa83d955e4cf10fcee469de0bd53fffdcec43f44aa832169a0ec73b
MD5 0690c8ad17f72e574a05fedbf33f5b62
SHA1 20a35309f858ca92fd799310b9dd0b84e103a0ac
SHA512 0503ecd23343c57dfe90bf58f1062e19bba4052c798c575e9f90ad7d0784f46d99358987c881be0fc98772fa9244f8dd9d49d16f7135b2dfc782e744703b98a4
SSDEEP 12288:yvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BFA55C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2ea445938cd712e2ceadc3c4180c8b2c441db7bda14092e83a0adfcd8881736c
MD5 d54fbf6aaa0e662e6ad9045dfc2f3433
SHA1 528354650831cab154a23de109492b031b54cc98
SHA512 7f8b14c8fa13d895648bc8cfe5b705d004921eaa69a0487d3df3a3d362f703c7ddf09750ed3415aa7af3390a3c516420b2c226a93684d2500248155713727f08
SSDEEP 12288:VcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BF955C41CAE52608B5C3E5F14DAC073E6BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4e99c6ef1a2bf284ea70a186bb89ed68a6ac1c46f2d65323e04b91fc4493b328
MD5 bdc97f6bb8623f458e02aa7763da93d8
SHA1 c6673e2361d624567bc708d8378df48ff2cd6a8a
SHA512 b931e5a5269cea9237a819795871fe4fc21274e11c3bc2d42399378162f137a2d2db00d92a48a823a2a44d4948d78859fd4906b3adbf16b08075a8adfb0ec222
SSDEEP 12288:RXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BE955C41CAE52648F5C3E5E11DAC073E5BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3a3fb3f1273f6e78030e05f52ebb6f49c808c8a2b82dbe159732213f54ac7bd9
MD5 d46a63ea98f294e0d3d45b760f61f915
SHA1 5082554f44a8b5b06d5c02d70a79402c17ef86cc
SHA512 c59cfdb1dc87776f77e5575bd357c84c164dccfa895d174da701244f584f215c804f46b18662ddd0e89cb571d0e47f10390df84b5a01d0e2adcfa5783a0e09b5
SSDEEP 12288:YBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BFA55C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 598beb9565519f8399470efd00cc70709d92c70d2128ee1754c8e39f9cc5f652
MD5 7aca3e49130272686ceb58b5243801dc
SHA1 9746c0331fc88d12d563929d87d4c772c8efca22
SHA512 9ded7ae4ebcac9923b6343072c903a1b835d09c6fbaa78ebea782390a6f6a6f076076befdaead7bf6f34efd4814ac3f0d1c17ed19145f058cec9a8485ca6fda0
SSDEEP 24576:5fwvUk9RX6wkyAI7sqjnhMgeiCl7G0nehbGZpbD:TMnYIvDmg27RnWGj
TLSH
T1CB85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 324eb4040084d1f453be17d6d4e8d92e5bb99ae5a25256a12eb92936a7b9feda
MD5 fc2b693e4fa4b5a3038f96ae84fa5b74
SHA1 ac628cb94e9f068cf96994d356c5a5192479a361
SHA512 7efc42f69cc28cecf41a25b56adf68617de3c759fb3635927b12b5af09625b42bac4fd0b67ae0c62198075a37899d3fc4903ef1384a4525a87b220bb3b7955e3
SSDEEP 49152:PYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0UDmg27RnWGj:aySzPcD527BWG
TLSH
T1A9066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1455e014db212318879088366e0d8d24fb376eed99cdadf0e12e7fbe58818c79
MD5 5b9a27411984854671a38764f2428a16
SHA1 00ae029c5d8e032ee0d6d3cbf407d20cb66b4c04
SHA512 1e1bf6b661346bfa2cfef127b44828fbc110e151c91fa1b78087afefcb563e65a598322b0633e5ff0faf2b02209bc1b37498cb7e92aab03566bc15e18c6357b6
SSDEEP 24576:Q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYusqjnhMgeiCl7G0nehbGZpbD:Q47JUQjTirIhCnDHUPfF/kDmg27RnWGj
TLSH
T18165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4fc22fbe67edb81423a0c3e178033963114e65ed16999d0e0a5f920166e7ffe7
MD5 2ca0c1929c0c88996130c3e7ee34c09e
SHA1 a3d7861c54a9834a87dc17d347e6bf4919d351d8
SHA512 8dfa8df91999cde8d2a203be3091450acfe72650691843c070f76a2d67586febb50f96d31855fb75ff1364069898d69dc001f0b50b9082284374e596d5049bbf
SSDEEP 12288:WbsffXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B255015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 18c43ab8076053655e42da9d08904475a591454f6e444071b8b27992c3b67d99
MD5 78762ad06177241a9de317664c88c6fa
SHA1 edea00f8d757318a5324ae9c6cd1a7b0def72394
SHA512 ffa4fe2a8a16583ae8a82d1c730ea8a6f07c2ecf23409e7a8ab1574d4f2e22a67ebec8ff9cc9a1c7029e1df02585ad31418260be8e6f109a18c7edadc2a97b4f
SSDEEP 12288:bG2s+QU3fwcj0BjfPkU535FvzvibqW+F:bGRTUPkBsU5JFvTWqv
TLSH
T13B351740766AC75FC6A940321E73D1CCA7707D41EE05AB0373C88B3FD576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 5d4395e955e66ecc7cc777024a4bc0de5f83030245b074cbed1bd991ff2c9729
MD5 c62859571b4aa81f6f940594ca19351f
SHA1 d11bade7c8cf2c1eed78138e73d40fd209e7da2d
SHA512 1ddab3781bb110dfa93494d44c37f15db5eaa130387d27ca1719e7c2936459f0ba9313fbac7b9a063c1be3c868da20e17f6b996f65ae22ad23b3bf322d56fd06
SSDEEP 12288:gNOSMkSJtcxh4WFApSw5wdmY4L4l4Tg1sxoDd:kIhx8
TLSH
T15355B8815437A2DFD1FB6031076A5B4CB764EC06B7096F26B3C8453AD82AB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 574626778801d5b9fc53f35b19c991d65ee849836968d566cfe83195e109d838
MD5 6defeed6d3ed374b505d9ebce50a1a59
SHA1 10ac671f1442c68e7284946ec4297ed8b13b5a68
SHA512 a81d68d7ac10c2978b1f9dd9cfdf7fddfd81b77993e422174d5b607e25ad501d710fa05ce8c184a4d526f98421cd75a06e379306ba74111a7531f9f143ae445f
SSDEEP 12288:a07HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A645237B935C518AF93605B482EAE12D681B7E669F1044C3BA0778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7fd820ec95a801b969e02816a7c7d03a2d4ceb928bc4511d15497ae0692a2716
MD5 4b272fb63446446bed6113dd51faffe2
SHA1 41ba55d0ac9b64a83d9eaf3534dd86a9c7ea44fa
SHA512 c8a2e2b0e2f9132925b7a3cadad7491ab13e31ae8e7995f9defc15b01314f1d72ff862b5f1f931877d2249bb4a2615ce06eb1d2de447148a7a6f9e0650027a80
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYdsqjnhMgeiCl7G0nehbGZpbD:3gb4mBIBhGFCDmg27RnWGj
TLSH
T1EA659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 12d4cca3bbfc5469fbca463316598ade1bbaaa9a05d6764ddcafa5d9d2200fae
MD5 2cf6d00d8cc8408254f73a28a4b5a446
SHA1 caf5660df8c8be38e88865471d62064c4fc4c053
SHA512 00852bc988696a5b4a4316106ffe9956851abaa5cc3633731424b876075cc43a50ac357e676890900f633d8fd85b859d2743a122655defd6759d797572e0c05d
SSDEEP 24576:JG88u8FpJqH1bzria7/mesqjnhMgeiCl7G0nehbGZpbD:c7ZFPqVea7/ZDmg27RnWGj
TLSH
T12C85016577E401F1D47BD138CA868667F5B2B8250360EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 56138df49529cc8fcd2f093f756f6710f294f43d13b7224ff422222ccf5c0a31
MD5 0c43682bf80ee375c14dfdb30e7267af
SHA1 ec6f9ee3dbfb870ba2c885228c7356b7684d912d
SHA512 9ada324943c8dc722be7b2b9e99cbcc1dac75beb93609974e3bdfd8a0e6c196815b7b8e893aaaa01018e2e16fe22c8f06834ef0db9a6e2d0d8417ad7267230c2
SSDEEP 12288:pHvUrBFrEjwaQiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:pPUr+NQisqjnhMgeiCl7G0nehbGZpbD
TLSH
T17865F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 43440d40aca1052f22fc3a2cf8d30ae3815cdd84c2d5f1d31bf3a134a7e710b9
MD5 0fa6a7f863a0d431765719212d27fbc0
SHA1 997275b97fb08eb64593f05266fe18308865c5b2
SHA512 7de12e308eecaaa4697a78447d6f7755b421f8931578237e0280d9438ebac669a04803562f7862b9e409e63a78f65bf6786cdc91d97f784f11ff707d149a10a6
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWDmg27RnWGj:WG05lO43bHD527BWG
TLSH
T10FD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 29d5044870c157b4891409abfdfb97b2e4e6ccb1161f51fbeac71180e30d7a7d
MD5 31f11b8f9a579c3bae6485f3d21eb3d4
SHA1 ffcdfb3cc9bd432e282840b226660689480a9bcf
SHA512 cf8ae77103902c4d17223ced1195e764eb4f2076ff0f91ebd2b2bd58f2b4f4aca6a718be3eeef3983c241c80ab7f5434f706bbeaedc068e2689088bc3e89c637
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnosqjnhMgeiCl7G0nehbGZpbD:ia5POZ3BJt2pasx2+meDmg27RnWGj
TLSH
T14C65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cbe8662f8d470d765d19e30b78328b9acce0ffad7178bbf56c765be5fbef8372
MD5 2ea258b8a630298b7bf808526c83a2c1
SHA1 891dcb54176698103704da744c4cc52f7913c1d6
SHA512 48368f92f6dd4a6b14d21fb766c47afc3eb28aec1429477c2fa59e9c360989d268170b600149f015228db8a675e1331c91d4b5d513b182626e95ff955bdceebe
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fk2sqjnhMgeiCl7G0nehbGZpbD:iNc/zEOVHF5Dmg27RnWGj
TLSH
T156857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2e3fbde375f3ecaff80b3646168badd6dbe0281bb3c72177fc536c1df865ed84
MD5 217a7c215c606d38cfdf34b59034237a
SHA1 adf2ae1ab50bf97a37ed946c56a740d3e86cf2ba
SHA512 4c0255b0443fb302ac05a563b61b3c98bd395d07a96e5f1dbceb1df7d30826f92be49aaabce552ca3b63adb9c89e28e9467ce3ea2f44757d005200f76a88f508
SSDEEP 24576:CTkNvNnaFeYhJNtmZBmPsqjnhMgeiCl7G0nehbGZpbD:CTMwBtOmzDmg27RnWGj
TLSH
T18055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 afe3fbd3bfd025cad83ecd0cb5bb289452a98c15213b5394a14a656301a4f862
MD5 7b99e0657713ac21833ce9dde6b97592
SHA1 c791a84fcffc5b5d9c26d6680d45a4fa3de1a420
SHA512 1a13575054acd486b6bf986701ae491965e5e33465d571ac558467588c7cb27781365f14a309bc9536ab79e550ea157cb78ec27c6a31501bd4982d311be9b920
SSDEEP 24576:pD3FHshBIYQgATsqjnhMgeiCl7G0nehbGZpbD:pDVHeBIAAXDmg27RnWGj
TLSH
T10975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1548-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1548-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1548-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1548-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2496-46-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/2496-39-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2496-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2496-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2496-0-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/2708-251-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2708-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2708-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2708-71-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2848-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2848-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2848-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2848-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2960-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2960-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2960-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2960-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3252-130-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3252-136-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3252-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3252-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3252-138-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4636-77-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4636-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4636-83-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4636-282-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4892-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4892-298-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4940-124-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4940-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4940-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4940-118-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5180-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5180-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5180-329-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5180-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5180-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5180-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5436-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5436-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5436-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5436-315-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5436-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5436-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5736-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5736-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5736-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5736-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5736-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download