95b49193b17d8cb2e581ccbd1a436d9e92a61fc6c96afc188cdea46b57bc3d56

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260808-wpjyxsbm6w
SHA256 95b49193b17d8cb2e581ccbd1a436d9e92a61fc6c96afc188cdea46b57bc3d56
MD5 2bece896ad674a8943d9075fe528f5e1
SHA1 97fc00bd2f97ffe8058f5d8da7054941e2ad34e4
SHA512 5f1d073360ff2a9e7d75431e6ac6bdbbfe93affc7a03d6a0ea7068340b02442b3b64637a47ba4a9de438d675b04b4f85e65b906b55a76a703f7d75a7515b3201
SSDEEP 49152:5474cNEpbt0rjQsM13HbDUKbFZNi4vbkfcdC5r5p3mATY00ZQ/lFTjN4:xznQQh00OLm
TLSH
T176267B17E6B940F5C0BAE1798A579517FAB2781A873297CB4791470A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5700	elevation_service.exe
2208	elevation_service.exe
4320	maintenanceservice.exe
3340	OSE.EXE
3972	PerceptionSimulationService.exe
244	perfhost.exe
1856	ReFsDedupSvc.exe
1428	SensorDataService.exe
960	ssh-agent.exe
976	AgentService.exe
3984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8579f4d383806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-08_180552_1516-5908.log	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-08-08.1805.1516.1.aodl	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000876fa2d86027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003e02d986027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb50a0986027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b20168d86027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1075b986027dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbc78d976027dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
5700	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1516	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5700	elevation_service.exe
Token: SeBackupPrivilege	1856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1856	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	976	AgentService.exe
Token: 33	3984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3984	SearchIndexer.exe
Token: SeDebugPrivilege	5700	elevation_service.exe
Token: SeDebugPrivilege	2208	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4820	1516	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 3984 wrote to memory of 3412	3984	SearchIndexer.exe	102
PID 3984 wrote to memory of 2756	3984	SearchIndexer.exe	103
PID 3984 wrote to memory of 5932	3984	SearchIndexer.exe	104
PID 3984 wrote to memory of 3308	3984	SearchIndexer.exe	105
PID 3984 wrote to memory of 3300	3984	SearchIndexer.exe	107
PID 3984 wrote to memory of 2248	3984	SearchIndexer.exe	108
PID 3984 wrote to memory of 5752	3984	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2bece896ad674a8943d9075fe528f5e1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1516
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1516" "1460" "1348" "1468" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:244

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 1596 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1688 1668 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1688 1668 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 1596 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f37bab22b4ab7959d819208f459de156dfa6ad2671a72ff1a81eec767162ec13
MD5 395c50c7f7437c3ad6988d832ef43398
SHA1 94c9d1b5f56586176fbd708f984d64d07ab4aacc
SHA512 72f7a8e4bbae6de04722cfdb1d8ebf34ea8df1e7870631762504a5cf764352956728cd3eeb1a31cfc714e7a2df4ce9913f44ba06fedf35aaecd58ff75c346deb
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4Q/lFTjN4:c3q6HjBALm
TLSH
T101D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2d5290db760b566825569b0056dc0f99207054e9b2f015fd5db5e32004cc4bb9
MD5 95f92e7b9616d778a058270ff373bebf
SHA1 2a8d1f25b6c11b0ae1b2a342991ab152582440d7
SHA512 e317f5c66b683bd966de6a83bd8ced5bfbc7c7dc8fa2df98f06a6da79be037ff709668b2e9267481f17577651d2b2feac7688502e8e7339b4a33e2630ac9082c
SSDEEP 12288:E1XLsswWkxy2lRq2czAHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:CXYfDtczAnnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T13565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d29eb3b50feb0ef8a50fa59b812a4b163f58a65ebce4c056d1afb70ac855b9d7
MD5 005fb3f8b7420d20d270d2eff96b4873
SHA1 132bce02b1f8f863199e4abe9cc6f16a782ea07c
SHA512 ee0a4996a3c7ffd04db104f969af3a9af7e6ddedd1c7ec652f3cdc78f0e51f5d8f72fa5583ef9a3d950b4d46af914d9a9a6da038eed6b444be2b52c9a2d8b7c1
SSDEEP 24576:10Le5ji0hmxLrM7nQ/tbw/2Mkjy6Fr7g0oU:1Pji0AlSQ/lFTjN4
TLSH
T1B5859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 35ccba333c53a31a8cbc0e8bae77881c2d42b1626d0167180ce609323e8d2301
MD5 22bf5d2b036d10a968ea9cc365633400
SHA1 e281b8a9d0a9aed03e5985adc5a78b13bc1af59c
SHA512 71a8326026f52823158bba2c16a8c25dca467c8d797471048c13338460a361e6345b61735b7fada833de2631b12eda908dd8d0b841464dbad36f5b015d7a121d
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyutnQ/tbw/2Mkjy6Fr7g0o8:r/ezSC6vUzPvxHjyGQ/lFTjN4
TLSH
T18F755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 af24fb1a48f05b91a1c8feb772fd1be055cb2b54da2675aa4f3c9ee85d70362c
MD5 5f7d3c71c1f3e9f5d9374a8afbb469c7
SHA1 0791df4dabcf0a2a21305fd457f84060c66faee7
SHA512 52852f9e668d9085892c4a8b233a83770178df950ec75003efe51429d5cbd6709f3e3986796eea84e7bc7deaf2da469800418923b0a1b294ede398a51833f363
SSDEEP 24576:mVbqPb88hv/l+6onQ/tbw/2Mkjy6Fr7g0oH:mVO88hXl+/Q/lFTjN4
TLSH
T15F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8f38c3722bd0e1e903b701389b7647e8c1763f32caabd2dfe6714bccc2c95491
MD5 9061967258e8867b2ecf1654e89c0c88
SHA1 315933d340f849c083060ddd7424ab04f73a8a51
SHA512 8373e9959734d3344d13e42db9c1fa075a0294ff43bec4d6ed5b9aeffad4f8473bf44e042928d26c81fb7fe74dee7a93571127711516758b48abf72cfade55df
SSDEEP 12288:jznGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:jzHnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1C05523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 21f25546f57bd41069050955d187c8c69e5124174212e9a2914f5cbec03606f8
MD5 d4e0bf9cc8b70271549a54ae32cc9291
SHA1 d1983f80a438130a486502307bf7a611662450d5
SHA512 d2fcfb8ae1aa749b913b97ebccc4c6efd18fb8d5263c8c36e28649c658619e62e1a81d2e594ebae491cb12e6636c627d1dda65cae8af8a0e5a03e95d2c19be55
SSDEEP 12288:ReBNUbTVO86UAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:RJIUgnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T11775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 97850de5663fa4f6edae5988ce94f4e355687b2a2f538d9c375652073d55a0c0
MD5 964eeabc91cf340fb4248a06297fea39
SHA1 7b9c33fd634ba8b75d41127cb96e4a5ff3958dc5
SHA512 d33ddd9b5bd1146e51ae2469d5813ab61ce02a9700fe5a1822b40b2b29217dd4120aabc3a2ea4dc08633f5bc5693eb31df7b0c1a031e3bee748b77a505f77b7f
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:RQvGAdlCEL8c/yRNw5CyLm
TLSH
T154267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2698eb3075403e165333b9c953ea520b31c02369ac3395a24db4163a93d964b2
MD5 fb3060dab7754b09789ab15d9db544aa
SHA1 417afa9f7a1b88ebecec716662e9da51eb4e5fbc
SHA512 c67a9de18ee6b0a8a7269edf4cf4ce82dda734333e5eddb8be72dc321decaa67075d92f97f4af1edcf9e581682d5fab14076a5eebf7f825bee868493020c6367
SSDEEP 12288:DAwSfxL/2Dc39DLLmt0LDQewsAjiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgk:8QewsAjinQ/tbw/2Mkjy6Fr7g0o2
TLSH
T14575E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a01bf751c449b5198de2b5e03d14e860b10a833a2d834dfa2e16e32a0a32dba9
MD5 98655e5e365145b8f8dc1ccec432396b
SHA1 693b64a45e1ff6cc67cf18ddfeff4117dc1322fb
SHA512 cd9203e972721c17e30d516e6d63911f1ddbd7bdbb94d4fd18965fbc7e63651c7d21bf035973a152109c0dc64f12ca277b4c2cb4a11146cdfcd8571ad8148ee9
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlL:DUEtQevvqc2W1cpV2EI32
TLSH
T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5f2aa03e41b38724b0a21c21917c312e88b475521fa372640d2cd27aff8ff4f9
MD5 3cfde897b6932e4a79c166652cef4be1
SHA1 3862365be6d62b79ace3b96e3bc978da5dbf198b
SHA512 a828a66e55c7f704f30b20270e1b459cbc2053b094e0fe685566a46ad29d3fbcb72718af74c8b25319fe79ecfdb32c2dc686658bf05875befc8d775ac7ff3439
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zCQ/lFTjN4:foqtVjnm2Lm
TLSH
T1B2D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d609855166667b4ec209c5a33c63b83d535b8d5d3e9b2fafcf9177a4d870e4d
MD5 6ff4c07988dbb2d210807682475534a8
SHA1 9d64a0b7dafc1126f5defd3b972e320e41f00945
SHA512 c8c7a081cf7ac3e176f5e6d5ba51011414eecc07ca4a19a210fa3736eab37901daae0d53a81592a2ad1837a4ccd31d6cec04a84ebf3ea32fd92003701e9779e3
SSDEEP 24576:eAhGLJIFoiwtA5l7S53xnQ/tbw/2Mkjy6Fr7g0om:eAMyFoiq5hQ/lFTjN4
TLSH
T1E535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 06cc0e2364891a8c49a48647fe850c11d59155fb0545615eb6583d2593edee97
MD5 5fb22c20cde4615f3d14a5eba291bae5
SHA1 fa76f01af68f00369cebdda729d521fe21786c00
SHA512 ca23c423913ae5a070388976b8e55daa21f0d9eac1a2feadec18daaa788fb680db3f3f2cab7a245bd99b5503af7777cf2c387d9351f891cec8a81dee1f10ecfb
SSDEEP 12288:emw5HEjsChN2BFgl0WDm+CtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMl:3wuHOWmnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T14065F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 614faf0b1ffd46a3bac35d565dae0c56b566fb7d85be08a6aae7d40277e9eb56
MD5 ecc57e42ba6f9e7a08303e6ddfcb9534
SHA1 27d2acb6c30b4e8e5842da1eb872b53e85252681
SHA512 949076ceed2325fb00268d8be3864a6265b119396ad3ad92792e0764091c8d43fca2779314e34292ec467028f066a18fd53c29ad4958fc3803c6a26f5607bcc5
SSDEEP 12288:4XZ1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:AZuTnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T12755126937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b975679c1a586b846399a42dbd3fad35d6cce9dd508f0086fe6990e8a06a9817
MD5 6374d3d8938ffbde092248c83be30503
SHA1 cd26a478107ad01cb5b5fcbc69ed1270995dcfa7
SHA512 44eab407cba8c7d45fc583800e4c7ac5d3c57b8e458f02601db8db772f0a5629e81652eb3345ca3bcd05f7ccd38b859f41ed98c391b2f21058ce6c8fba9cd133
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:WQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T161667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ce7efecde8815b675778e7025c67f6334181d1f265b90e5e48c2224a318461d
MD5 ef70af41c64da5d53482baddfaaf4f9d
SHA1 5e6a61692888dd0c9a42dc01f86113348a1bf093
SHA512 5838499c90b16faa2c98c509cc0e7630925103ffc94ae62fb4e60074fc2ab607771e63c716012b3ce32b33fce34cc625962712bc32739b933319e56a4eb5f648
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:kQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T142667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c5cb791fd0792bc017840e745e2843ca8c1b0d74cd2e5efacafb06fd8ef6150
MD5 979be3790de2797e63520c1ddd3730fc
SHA1 fbcc45c15ccc8707dd280492d6582617f2dd5113
SHA512 3801370d69c1c31865ab373da11ac15c669d60f8266a514af5ddd0d4d7404c7d869e26b83d0e7937b726b6568aeae0890f70c77dd9d550c9eb93c560985ca32a
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DnQ/tbw/2Mkjy6I:b68Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T188B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 28e6c151a3b8003cee967372b2fea69d1cc9102de4b0f2d33c13c9b4c6a93ec2
MD5 35bdccff3c111b79bc37bb8df0985e0d
SHA1 1c54b1247db38304985fa7f80ada3766591bf403
SHA512 48601faa04884e0a6b3a4c10397236fb6ccb0adcbb468029dcaa685c41d817ea9c98a596ec222367687bd102a4dcbc2e4c7c6129311105d5e54aaa756537b426
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:1y5112gYy5azzVvL69nLKnhZsLm
TLSH
T161167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 20575a76a22699e693dd6474b53b77b8676566cca45e2234f8b8562bed0713fd
MD5 f6f78328cf30f32cd283d8dffd2e729b
SHA1 a95927cab6606ac5da28dbc8019f0fa0603007e1
SHA512 e61c82098ea6a245de405f2e5aee1dfd3f46f84e6a31ae1efbe17c01f3dbd91eb485df499f3c6c0a50b852e35a08ad21bba747de4a8790613fbea62f58a613e8
SSDEEP 49152:3B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3Q/lFTjN4:Zu6JmVxd2dcLm
TLSH
T14AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ccca52708835c22479ab4e5a15891b8235e62edf5e89781271da0eba93fb0821
MD5 e727197adfd1a5a259ccf9a9e7b1b7f7
SHA1 27c3224b6f6e519eb17825675e6fdb4d8ad6b8f1
SHA512 255cb31809e2c158352b12b6a2285b521082ef1946a300627fcbaf8a166493155f493a0dd36a8edd3088858f19d55010d2117490bb040030410382a6ac12ee3e
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xAQ/lFTjN4:pmifPbR2Lm
TLSH
T176B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3d9b9959c9b4797adf1ec7c06efb3ef3f3c95e60fd8e1ad6106556f85f907c1a
MD5 0e39101e7ea312d350e53d6d361c0720
SHA1 601cf8624fe67e475ce6d3ab14e01657add8ea3f
SHA512 95c1d6998c03365c74016b6adfab9ae66c462169afc3d3f185a750770ba551b4ff89d70a77153a2883e120d6065b89e42b8d0a230ad48daaea83eb809b2a5a16
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHqTQ/lFTjN4:t5dKTi614Lm
TLSH
T1A1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ad6c28cb45c63e53d2d6e5877b284ac847afc96503bef13ced322cea8f69a4aa
MD5 a46f2bb0fc993d393b30a632cddd01bc
SHA1 a5a08426fcc61b1f92f1fcd0c4c5661f99a8d6ac
SHA512 5669cb14225544c37f4fbebafa16ca09a60017a1e6db91b9b51adc7e3b27fd80f43e539d8724973377f4393225162a4c274b4fd78778f709b50123014d043aae
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wMQ/lFTjN4:IX2iyphKLm
TLSH
T1CE95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9f97493635e4e2412073987f7299b51b89cd2fe7b116556c579d9d3302f7092a
MD5 e80597ecba849792780e6fb9e40be2fb
SHA1 a587410d2ef96499109b953a9dad208214035269
SHA512 0c46fdef443e503b83820b0ab9bb0a64744258f4aea0e2c5d16337429e35963c2e2ef1b0f49ec6854b6c411523a00a5bbe2a2082ddb9894abd9f030f96868183
SSDEEP 12288:BfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:B/nQ/tbw/2Mkjy6Fr7g0os
TLSH
T14E5523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 979363a548be4a8c486742dd847bee79b78b213e9799466a790cb620415bbe01
MD5 61b27ded0d9b182ad1cdc4bf4607709d
SHA1 de011a1a93eb1e22c8d78fe36d711b6a87c90a3f
SHA512 c3afd8f9e7956d4c9be2a974caf26c66aacba5192695256202a3243826f00327affc190eeb05368764a22a1918ecee1105c523ddebd2b02288d14b1a18f3cfbe
SSDEEP 12288:JuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:JunQ/tbw/2Mkjy6Fr7g0of
TLSH
T10F5523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 10a1941938556b24394504ec0472c87071866e9e25c0a615b96b8df601eb45fd
MD5 f9e00fd2e107d87412ff7e7ca7dae4cb
SHA1 f4fcb1306381dc62a6c62ab063b86b0eb4e17c65
SHA512 f39b5de7b12bc67cc6ed2c1f17b678cac55c5863e45bfecca2954a8be3340905973b0619ade9810d0731cfacd5938fc02e047aeac2d3edd67b3b85d75983fd42
SSDEEP 12288:kYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:kYnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1B15523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d3fea94592c20b8d38179ac3f061e7455927443af2a3465a8c9ceaeb14100635
MD5 728d02d5169c45e3a5566e654843126a
SHA1 9ec7ed7ad03f7cc83f3d8bb016f485f9eb1e4647
SHA512 78f1c29afbce0ad885260dec50f841399f97160390c3d8021e53dbad44c4e9305aa8cda351e133ce63dce197faf73b351fc4013262337972d806fc7056bd1c59
SSDEEP 12288:YVBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:InQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1A65523693A69F4C7FD2742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 21bf0eb6bee6f43b9c9fe5444ce4488aa6bdec71d5917030dce12f5505c7cc74
MD5 68bb45981ffbd06607708d3cbdfcb80a
SHA1 22ef3ae346ffd46cc6138bac8928cdfbfffb4cb3
SHA512 9ab03e873b9ed1294caa36cfc2c36bed322d9047bd9d3026c79aff01974442151b914000bafcb0e9343b6226c16926237927f952cd744f1c102ae44007934182
SSDEEP 12288:SJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:SZnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1495523697925F98BFA1706F14C8381829B7F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 be837ad4f0dad133e119ca00e32db47bb434637a45141197ed85bb6a30b735c3
MD5 53ea10adda186cbf03543ca4eef95607
SHA1 ac7f272e9c0bd2ca95b8739b8387675ed2c6187e
SHA512 52699b2f9646534845aa8ca5663ca6b7f7be2ac07e5cc2d4f38d946f91695e395ab45a74f76a83150f7d72971eaf55605c1265876f87effc08795f0b83995e74
SSDEEP 12288:26GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:26nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1CA5523697965F98BFB1706F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f49756d66d87c37b81de39d83a02d5e9f05f2a200d7d56c572502ecbd5ec3d78
MD5 222feac4230a9c3f2027521270fe5a44
SHA1 fa8ca117d6a458ced36107206dcc2803216f4150
SHA512 451231c6aef82d9c0c4419b6b7b1f572dd1bc5fe25ac6f798d501eaea97402c091991c4948c5338625e7532319a83a789447b7641aa2d8ee2783fdbd6e456895
SSDEEP 12288:42GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:4WnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1255523697925F98BFB1B06F14C8281819B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5c60bb1643e66e945784a374e879504561019532cb4fe8f821952febbc16ba2b
MD5 0b3e9ecd695cb80bcadcfbbffa9b7955
SHA1 a1be54e4c872fa0c094187743eb1f27bd5e7d83e
SHA512 e254a8ea596841d2e3f6904d33488b7e66e7344fd14df17458794ad7ef18af937b7f1a9f52d3075883c35012ca0b0a9bcc81767e6ddb0281d9e478292fcbcc05
SSDEEP 12288:niZwbDzzFEoS2cPvyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:iZM3zFVSOOnQ/tbw/2Mkjy6Fr7g0os
TLSH
T17D7501A9B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e7c603ffab6ace22e4d23c05988bb5b8e1b0ef3294c69b739cdcca79d475c260
MD5 f587fc3e297dd5043b53e5a8b52e6707
SHA1 17f59c0ef01f322ea27bddd65d5b4a5297452729
SHA512 b2d2be22414ab068ed0da3ea1345dfb450d54f94e4377b651087c6b255f09c7732be170725d7da059edf8d5c338f68c8c914fceeb0cce29b03a63ac954d388a8
SSDEEP 12288:RzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:RjnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1C355236D7925F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e080cba327ffa34920e08d4a39c73d322f32bf7185a5194bd69b34b56e119d10
MD5 29768c49c06c2ae577053638f509e162
SHA1 f93347631340368597592718d9f4865bd8906b9b
SHA512 052af17fd18c6897a21e8677b9410cd7709cdf674614e28bf7f85e1b03a9d6072a0895b913a813aacc40f17a7f24165d41cae32179cf9fc801166951c87ac7eb
SSDEEP 12288:w3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:wXnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1205523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d12b605c5c2322e00683a1d63390db31ec70551673a9158e87afd9b92abc488e
MD5 b552e2bd80b9816836c288aca74f5440
SHA1 8c7375b890446258b88ba6353899c1c48cc67001
SHA512 342449c9106630e094c7d5f973b95379e10f621871c4a198064957d89fef69ff2a9f7435cdca3ab7d1e9b5da9c5e68207b5fee971a5d578cd6d6b8066284f7a5
SSDEEP 12288:XyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:azyynQ/tbw/2Mkjy6Fr7g0oa
TLSH
T16265021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f55cb86ed5effc208a7503bab2a04ad079b9a18ae8a892b0d5e873152bfcae30
MD5 eeb7d4a7d4b6908f607a5b2e979a1512
SHA1 0a4d3c89ae6f48f887cc11dbd0e2684098a2b99f
SHA512 8d6e179b959a15349ccccd8abc29eebea51cb0e1ba43e2e5b2fe1550924136edd8514873e2983dcc2e786a42e265e642900543ba3e087b37a2f224976bcd5bdc
SSDEEP 12288:TzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:TjnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T14055236D7964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3678825ef772fe9092358208cf90e30aee7ca994c0a84b07f0d3608c49cda989
MD5 15ff8d72cd26d826863a6e4f8fafad9f
SHA1 33ca5877e78de4e942c925d6deaa5b5220a5aab4
SHA512 67964dd954403d0ebb3249e2a0b94ce8ea14fe27ccaf07ae7c73a19e737d5a8c0a4a9fefa8dad6ec5566ae0a0ca60e30561a7e6a748b93648ae3c1dfde47edbd
SSDEEP 12288:BzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:BjnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1F755236D7964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5ccc612896f8396ccfd9f132473be4af5480a91f419852e8dad399298b6602ab
MD5 80f67a16ad92e9efc519c5d1322107b1
SHA1 84b22dc791d6e7f4657b0ea53c7f94b44119993e
SHA512 274f09813fe10e94b0115193caf3be011dcb7b69d1925847eba918eb8df9651e6cb6b0c985d20f5b242744d46563bdfb5d3549051572998fd2ba9004e19c0761
SSDEEP 12288:XyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:azyynQ/tbw/2Mkjy6Fr7g0oO
TLSH
T15D65021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5b82b22c35447d1c2f53601b9c8b681403096be39dbe49c465f7f841ee25803b
MD5 287a6a81a00d7032e15584d59bd60e1b
SHA1 43d7fa6a8eff974a11f647f90c6309d03ca9531d
SHA512 67d1c5d6bf0cc39d71aa6da07602ca042a3a48a006ff83b3803a21c2b013d739611ae7c15e74b029ff6cf306e1a384c4723d4132412d8c84d5b81e6cc168798b
SSDEEP 24576:fT0aLl3z0zDInQ/tbw/2Mkjy6Fr7g0o2:fTDLljtQ/lFTjN4
TLSH
T1597501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8c126d89fde7a27ce5205d80c511654107b4894fce25f88e3919759cbe5abf85
MD5 e105eae2dbd972ad66a47de86f6c6d9a
SHA1 3e2b33725ac63d5b76e6a26fc0c8a1ba02b0d3bb
SHA512 9ba3426ca74d484db60b90dc1028e0106464fb15002ac1f8633d422d9782e91bd50239bcc7777eb1b140668619a8046c7a6326120dd40194b3726bf9303a3cba
SSDEEP 24576:x31d9CHKy7GZEnQ/tbw/2Mkjy6Fr7g0oK:h1d9CHKyaKQ/lFTjN4
TLSH
T1FB85CF90F3E414E9F1B78A358D724512DAB67C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b757a7ee03de05e1ecca38834b9cc3db8c3800b5d84e3238225582c7b53e0a65
MD5 b5c1c9c1a315fd60264120865a70fbc7
SHA1 bb648288d1647eeb4dc7f604b92fb54fc0b4daad
SHA512 a345675ef9b26c88c98e0f5dd655499b2dd989b8db38f12b3f1a0dd80a91f1df9852ca3718047236980c1bd1b817c6985f8f70cb242431c1a8146ea1de8021c7
SSDEEP 12288:z4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:z4nQ/tbw/2Mkjy6Fr7g0on
TLSH
T12F5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 400294b01e3fc9a27f7fb1d3fb2f00b031034349702153f7f43dc1061021125c
MD5 415bee0b496dc1a367686fa7bc869f33
SHA1 c9bf49b157ca25d4e93ca351309c2d4c281f3744
SHA512 886845b9b5a080f3f1214d28747cda8359a2bbabb1858720a67f3c276a2c314a4fff67e2b63ff7819ee89760b25c801613af11745c56c928772044ba64df6503
SSDEEP 12288:eSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:eSnQ/tbw/2Mkjy6Fr7g0of
TLSH
T19F5523793924F99BFA1B06F15C838182AB7B0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d87a0c548be0a561cdc8a3918912aad9d5b8294238e52f5a0d39d74ada0e0d5f
MD5 d69a9fd4a565d169de564a8c06742a72
SHA1 887df83f9ccde318bfeaeb26981f36d76ac34d99
SHA512 bb63354a73033e7e3ab7ef58ae51352991ab018442806e0efa11d0ee5b516daff41eafb282a7ba496bf3771c6e656ff6c852ddd21e4a7841871b48540d12a35d
SSDEEP 12288:EVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:E1nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1265523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d37d22d72e623a96e0fa4e02a337b7124e2a6f9fe27d20e1d07e91bbdc8d5f73
MD5 909c21bf6f746d0261f0b6dce67acdea
SHA1 995102bf107e40901b53d110a0bfe72d3e2801df
SHA512 7d517390867735c8344576573412bf72618bcd947fd5efa0725a29af9f042378399bf3fe5b724f15b8b17ea68d3f8fc52521c0a5028b68fb0b638ce087edffbf
SSDEEP 12288:XzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:XjnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1A75523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 03ded911d5cae0fcbdbc8fafd94da6e6780219d65c69918295cd63dd156a8abe
MD5 a2740f980781b49595be6e7289f48715
SHA1 79483b3b2aea880dbfb800c1b22866a20f74d336
SHA512 a9279533b3eee6a04351de0e550281ec5a6d912aad18ea18184617c06f330b0c35335f4f6b997eabf75d8a9d08f2ddf346b6ba6a50611587d4c0354e2f6ceee8
SSDEEP 12288:b4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:b4nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1E35523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2050904b84231f1955039547d0e71a47d7c681b4447d905a8374723dfadb1646
MD5 f5f8c9b5ad4ff7778836c3a41251a998
SHA1 0af9bbfa3eee8e1b1c17fd762cd057581976161f
SHA512 9ecfeb54a1f8709f247d26243e985a743990554b6ba2b1a74288875822efc8da0aff35b0d434a319ea00049f9026eb6d61ac54b80bfd53508acda05921e9cf24
SSDEEP 12288:a7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:arnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T11F5523697964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-08_180552_1516-5908.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-08_180552_1516-5908.log
Size 1KB
SHA256 88feb5a4940f59129a5ece4880a9b94d4837152e8d079c859078350cdd9d96a0
MD5 a192350cd985b723336a686eeefb0d8d
SHA1 7f5356ee9ad44e17ebb7f5574d1a190d75bf657f
SHA512 de575dcd1a1e0084408b59d27b942b5614c9c974662717e3a216400a00c6ae685d962da5618ddb4be6c86594b7939240bf6b2511c33b2890593f6247d04a372c
TLSH
T148217F193BD85A05FBFBDAC2D8FB14439E3A79926834C61C00A5424D0876F82EE7472F
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3f22f7bdd22d75cd7794fbe04d7e36690e9a86559f9317920e0c72ce73d881a8
MD5 8c42ff84a052205f4247c4e188e5f14b
SHA1 1afc78dc34c865626d46237453fc45e0ac5a85a4
SHA512 12dcb04e737625edbd4541925a28062a1171036494f3b357b83ae0b931d347cc01566616be797b21bd197ac2238fdf7e4791511299bad0f58b70800e704e5c4d
SSDEEP 24576:4fwv/k9RX6wkyAInnQ/tbw/2Mkjy6Fr7g0oA:3MnYInQ/lFTjN4
TLSH
T19385DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 11ddd7d47f6884e9c56044960279cf6158b8492c46b93e5dc6d217927363881d
MD5 0cc09b635fba751d50d1af163e03c73a
SHA1 3872937a75ee83f7395098b8e66f3da4ec2fbbaa
SHA512 b3e86d7d84ef80c67ad1c44c8fd2825e5e9bf672595e931ff191914d4e8a807f72e1f049720e1694784b0707932f7331a82db90a88efbd57b2dd9164ffb4cf21
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sQ/lFTjN4:hySzP3Lm
TLSH
T1D5066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b12457abf4e205c2618a1b1ca93400f720e99474829695d64abcc28cadbd4f07
MD5 bf11280b3f1f540ea695a989d9ba31d8
SHA1 83cb1abb4f4ddc8a305f5d1bcd441d246b4dfd31
SHA512 2110b06b6ba4673745d279c22105f38171ee84c2da77ea92e73d98acd728dcf5227ac0aa531e4be6be26f6114e970d1ecb302b913ee01563ee31a58368755610
SSDEEP 24576:K47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYenQ/tbw/2Mkjy6Fr7g0oU:K47JUQj1irIhCnDHUPfF/8Q/lFTjN4
TLSH
T1B765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8f6240a3ea9c84095b236be5dde497fde074713731df038d1a36ef4ace96822c
MD5 611ecf7cb711266f2108f3fec93085bb
SHA1 402c6e7c00164f6ebb08364a9a25f948c8e6ba40
SHA512 6d80f01f50512f474b5aac48b120a03d472cd52bea71ac0853cafa079b0e0fe9b8dee00e665a3e706e311e6253514807612f72bc236ce9b57f69f056bcd1081a
SSDEEP 12288:TssfjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:/TnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T17565F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 6df630ab60091d9d80b9ebf3968f20ab9f17bd4aba0c1d4f5086233054c51280
MD5 628359043fd629cae2a07c6414e6d0b0
SHA1 8af97c5cbeb4933e29ae43a279830bf99b684114
SHA512 5d92819404ef41d433ce42af78921f3b9edc4ebc1d48c9cb6d0025f9d81d70920e56adbaaeb83cbd862ac5ee2e1451787323c04bb59c3b2033669c93715117d9
SSDEEP 12288:IXqWU3fUkUifSVFiNwSuB9sYu99vHeiCM59vs/4n6brqn:IXlUP22YqsbM5Fs/4np
TLSH
T1E2351840B66AC75FC6AD40321E36D1CCA7707D51EE05AB0372C9973FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c2bc937fc769ef68cd9798fe67c018a2aafecdeee142523c916dd7bf7b6a9c72
MD5 663d74effb0d37c411d6d6572ee972f3
SHA1 3bfdd4d1043ff93d6ecf8990c75b7e21809efa71
SHA512 89df76891769a090fe31c96aea021c6acfdec8c73976b033cdda707ce5ab81bfcb43895075aa6625025a726116b25dae068e0587fb6a6176e1b61bba5a99f566
SSDEEP 12288:NiNwSuB9liNwSuB9sB9giNwSpB9RB9TiNwS5iNwSxiNwSuB9viNwSw16Lp9AZiNL:YEEGYI
TLSH
T10255A841A437A3CFD1FB6032072A5B4CB764EC46B7055F267388453AD82BB25A4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 deb8707503623bc891153edcee4655133e2bccadf0b021016264e00d3838ea33
MD5 de7c25958e86a5464bdeb3347830d907
SHA1 3bbe25b8772c4a40df52fbf2cd35418235d5cd8a
SHA512 5a94919d5ac7e38481b69e436fbfa463a8bb959bd0c022a26dcae90c11b3c068a66182b69f0b899a2229d4943932721ff122a13a312dcee395dc083c28dd51f5
SSDEEP 12288:867rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:3bnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1565523796668F94BFA3B06B058928111673F0EC5AF90D3CFBB082269957D3C40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6bf0979715c026b523b657576405c278f701e8d18387b07279ebaed750d8f1d8
MD5 9625bc30d7c4fa35ad499725f00d8536
SHA1 1930eaf6c50c3d077861a3aaa36bf6bec5505cdf
SHA512 1aea43c516e0604ff82efcee33d8bc850cefb127501aa34d8edf7398d37522bb5ecc2356749738c514afc5d02c5acdccf97647cbe5dfc33f7774cac7350fac9d
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYtnQ/tbw/2Mkjy6Fr7g0oI:/gb4mBIBhGFeQ/lFTjN4
TLSH
T1A565AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 225e8dd96b6a6cdc55940d94dc40f1de5e7906c6307214bb52935c96c6394915
MD5 6ac547dd13f837402cefd4dd5a0b02e4
SHA1 fa53c074ddcfaff0da6a62b56f86600a19cd98b9
SHA512 73475a6e4e73f17326c0f8d87c021c5ea61c2e8da28e053899c9f87f356c1a4eaa57479e29f357855197e2be9431117b7bba7909f02d936dff44751ecd040fb1
SSDEEP 24576:8G88u8FpJqH1Qzria7/mOnQ/tbw/2Mkjy6Fr7g0ot:/7ZFPqVva7/VQ/lFTjN4
TLSH
T19985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e766ebe69e9493be3a2da44b671a384013fff3562644dd63b8c332753ebe1349
MD5 a106dfd109c4b1029b43827f72f4e8a0
SHA1 eecd840d68d5b38e29c0b9814a36afaa650e3571
SHA512 1d03e3282d8e521d63bcfb0d918ca3d5ba01549a9404982fce06dc30d76a8ba767ab31f575e8ef2486d5ca1e1591c654e2caf1cc3e38365ba51db2b4cf2a1d22
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6Q/lFTjN4:6G05lO43bELm
TLSH
T103D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6dba0ea07b94ea1c454c44a66a71133a47ab0fc573b8bf5a0a85b48f3045a7cf
MD5 f73647fc2f0ac51ff2819b17f74dd48a
SHA1 750d5e18807da14cf70b2d3e0988665fe57089b4
SHA512 583ffede82ab04c0a7f3dc9640708c0958aff892a1ff1aaf8a436b7345b92fc5fe6c7202518712ec5443d6ca51a02c3b70db9ca16df72ac842a3775bf9dfb9b6
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnsnQ/tbw/2Mkjy6Fr7g0og:Ta5POZ3+Jt2pasx2+mSQ/lFTjN4
TLSH
T1A765AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ba6ed2c708ef7876ddb2f43a643e4c9dc939c98d665fecdbcaf585397434c915
MD5 7c91ba0fc87e296cc0ac9c1227839a01
SHA1 a8a670447826817ef41f28665f779d502d073d1c
SHA512 e1a3c7505c95033f0c1e14ea2b53cfd71b27edd121a34e7af8efb7917bd1df484312313ec7b07a5a6647962c9e7db52ceed1be563d22083bcc38086d2f2b640d
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkGnQ/tbw/2Mkjy6Fr7g0o6:aNc/zEOVHF1Q/lFTjN4
TLSH
T15C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d378cb0c360a5ba81b7da0306db51fa63e646b3dbc6384e0165227e9e808ba01
MD5 b6c9333c71760e6731fddd6b0b85bba4
SHA1 c9ae1da5322905f0f1c77ea8a527b70817b9cc96
SHA512 932b9bd69820e150ba6f29410685d107e5317fb262b04fcaffc56f0210fdb2e36471764c3af221fcab57366a93c145c8734a8cf7e71dfe746fb420d9bdff937b
SSDEEP 24576:w8kNvNnaFeYhJNtmZBmznQ/tbw/2Mkjy6Fr7g0on:w8MwBtOmzQ/lFTjN4
TLSH
T10F55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9d43fa291f332d9033581ffa6e681367443cb71dcbc8e7a93bac0cc15d89a989
MD5 590c1b9b807a4a4fed0668d8436fe029
SHA1 2e6cad4dd8281c60f3dbe9d7c75cc1789cd31185
SHA512 dded3a020a80777297a6c4998a5880926b75a09900eaf84454feaa1e5e0ad9de1b1f72e44d85174b2e2d9babfe406a6e7b95419987eb8ff19d13c303a7196174
SSDEEP 12288:jHvUrBFrEjwaQKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:jPUr+NQKnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1AF65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 aa3e512aa4d4e32e3f1c4943d53026c6398d3eb53cbe5bf97059adb5ec18d9cb
MD5 44e208a427a39fe173cb971903e31f6c
SHA1 714bacde3cc626952b58f1eaa6886c5fb8ae02a0
SHA512 1e4e6f08fbb181644ff29059e5cc97216dbf81cf764bba3315ec04970f8a1d95008981ed2e9be0acff77e6e86a078aa1e1ef4c549d2e7d8091e8c8180957d631
SSDEEP 24576:ED3FHshBIYQgAfnQ/tbw/2Mkjy6Fr7g0ob:EDVHeBIAAfQ/lFTjN4
TLSH
T1E075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-93-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/244-87-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/244-304-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/244-88-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/960-124-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/960-324-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/960-122-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/960-131-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/976-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/976-142-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/976-144-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/976-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/976-136-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1428-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1428-321-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1428-117-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1428-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1428-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-0-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/1516-8-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1516-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1516-41-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1516-44-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/1516-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1856-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1856-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1856-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1856-339-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1856-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1856-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2208-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2208-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2208-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2208-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2208-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3308-338-0x00007FF99EB90000-0x00007FF99ED36000-memory.dmp

Download

memory/3340-254-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3340-67-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3340-58-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3340-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3972-289-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3972-83-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3972-75-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3972-77-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3984-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3984-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3984-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3984-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3984-325-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/4320-73-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4320-56-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4320-71-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4320-48-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4320-49-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/5700-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5700-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5700-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5700-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5700-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download