7835e238ac45f9858f7ea0a42b5560d3f041d102e8ea6f6b0ba17cc734097523

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260809-rdjrkasthz
SHA256 7835e238ac45f9858f7ea0a42b5560d3f041d102e8ea6f6b0ba17cc734097523
MD5 8cd827c4beee80ade198eeebedd8bb3f
SHA1 6f9ad5648fae1cb4d6e3ee6d330f66ccad5675ec
SHA512 2ecc46214290570d1b833a8199dae5cb2c4f668f294ad716466b83f4ba7633bed660bb0152d9e649c2d187bf662c671dfb4f1ba84315175305f67ee8cee1319f
SSDEEP 49152:u474cNEpbt0rjQsM13HbDUKbFZNi4vbkfcdC5r5p3mATY00Ge30jaNf1TWbdz:OznQQh00GU023W
TLSH
T1C1267B17E6B940F5C0BAE1798A579517FAB2781A873297CB4791474A0F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1516	elevation_service.exe
1940	elevation_service.exe
4084	maintenanceservice.exe
4280	OSE.EXE
1768	PerceptionSimulationService.exe
2588	perfhost.exe
3100	ReFsDedupSvc.exe
3244	SensorDataService.exe
4544	ssh-agent.exe
3580	AgentService.exe
4936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\67c35892e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-09_140440_1236-4808.log	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067c0480d0828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1236	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1516	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3580	AgentService.exe
Token: SeBackupPrivilege	3100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3100	ReFsDedupSvc.exe
Token: 33	4936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4936	SearchIndexer.exe
Token: SeDebugPrivilege	1516	elevation_service.exe
Token: SeDebugPrivilege	1940	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2392	1236	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4936 wrote to memory of 4408	4936	SearchIndexer.exe	102
PID 4936 wrote to memory of 4152	4936	SearchIndexer.exe	103
PID 4936 wrote to memory of 876	4936	SearchIndexer.exe	104
PID 4936 wrote to memory of 4164	4936	SearchIndexer.exe	105
PID 4936 wrote to memory of 1844	4936	SearchIndexer.exe	107
PID 4936 wrote to memory of 4444	4936	SearchIndexer.exe	108
PID 4936 wrote to memory of 4216	4936	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8cd827c4beee80ade198eeebedd8bb3f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1236
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1236" "1448" "1372" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2588

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 777e2db96d5d023e6d9f61014abe178f615f854bef6eae1b5acd014d5a85ef08
MD5 080d3caa2d14f7ff9d63ae7c6b1e4903
SHA1 82534ceaa9fb63e13b7f6b1196ef81a22fe8583a
SHA512 3fb8774d74b9d3d13e9807309e762198b1449f4c3a23348d02ef5e6203800cc10dec48b0acacdf480e8aea613e366db48b4abea89c7a7259a0d5a45b287b4794
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBe30jaNf1TWbdz:t3q6HjBUU023W
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d7b8df92f6b6c28a7ba309f465bf0d84743fb3dc74e9960f2d35b024f53205f0
MD5 441dd5776dd6df36ac663eb596eb5df8
SHA1 a96be84fe87e16968717960b77be27d00c09a3d3
SHA512 ec10c078cb0c682c84c260fc988b769deb613f1513e6365c2e017d70f2fc1051559640fe72c0c2f360c9a807dca8c8473d3cdce2c926fb225b33fb4b1abef100
SSDEEP 24576:mXYfDtczAfgXe4i7ojhsP5Lgrk1TWb4AN5:Ftcpe30jaNf1TWbdz
TLSH
T17565F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 578da95848c8601fd5f3e4fc16b44960823d6bf65f4d6479dd4dd6fb546c4234
MD5 26e9d83e648dcf4aa0c595ca428e883a
SHA1 2268f0b8e19598a5e77b0825877bb24db645c905
SHA512 fcdb720234e11f6d3f2053644524ab28abfa45b2d63c33750a34604a025d959e457b49820b4a01a7baaa3822dea6287b1abab71f409e28d5b764104d395bea23
SSDEEP 24576:u0Le5ji0hmxirMwgXe4i7ojhsP5Lgrk1TWb4AN5:uPji0Acke30jaNf1TWbdz
TLSH
T1A785AE26F6748775D073C0B9C5D2A78AED71308217308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f880df236f72c21a5800025cc628fb8839293e9421401e3024f48563c9fa68b9
MD5 46a564d77be756750287d0905d659704
SHA1 8298273804caab6cc52aad8636199866934c3a93
SHA512 8f12b77b075e3eb9e7bd71de056a540758084beb63f07098378113a1b6ab594ef7c60631599116362fbb35151288a34e507255049939245660171454acc2e55c
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWE6q8wyu2gXe4i7ojhsP5Lgrk1TWb4AN5:w/ezSC6vUzPvxHjyQe30jaNf1TWbdz
TLSH
T1A0756D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c79e4b49231fa3c331b167e0c4fd6729affb89835e93112f91ddca5f591d3e73
MD5 55ef67f637b6b5513ecad5e38dd81779
SHA1 4075b177127fdc15f192a93d3971c18bd9de1f5c
SHA512 d61827a42c6a7eacd7468929fd3e004273c13df51f912441dc312221c4f932fcfd51280e744fdad8e41790bcc3ddd8b82c2c0c07c4fe37f2187967166d26aad7
SSDEEP 24576:aVbqPb88hv/l+6jgXe4i7ojhsP5Lgrk1TWb4AN5:aVO88hXl+ze30jaNf1TWbdz
TLSH
T1AD559E66F5748331D073C0BAC5D39A9AEE3234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 581f62da0604337eab03676c4bbbdd3d2f5336d4a2d081006e582b3cae36d558
MD5 403898ba90f2f1a83becc23f96a7c3a8
SHA1 c54725fe7e825869a72ddbb4e748319297f2c5e0
SHA512 f3da36f5220fab9f77063b5e99c502e0b5164004b9214f4219eaac2645ef6393db26f918d1afdb5c63b43c93f0e4675e867655f78025f33a19c96401e4abaaaf
SSDEEP 12288:aRn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aR0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F64523919F5409C6E38BC3F4A0F7CB91F9E11EC025448E6B47E0FA935CBC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e4a7314a6df056cf2e322eec5588ae9fe9a09952c674aa73d752f63a0c8e4f21
MD5 e08b2c5d23378db63d9636c601df1233
SHA1 64c508ded05d4c5631366d3c82b007cb65030878
SHA512 42d8b4d2b04bce89eb61dd7b8ddc97674ead88ea567d1441bdecc5704c613d2bf2e8379ab2487104d5998a985833b477e6923baa25a4dc87ddd55b1c15680b4e
SSDEEP 12288:JeBNUbTVO86US0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JJIULgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14E65CF3BEE28ECD2C27E8DB85691C740E7B278704B5293CBD164820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 10a5ca7882a9d5213db29b40aabccd69226aa4ed5dafb28859e3dece863ababb
MD5 f37a04b3a3fcbd01c407be42798a1671
SHA1 5a0d9472761719d32c21ff5736a9d1ad6190b1ae
SHA512 9bb9f56c8c8da5ab22757cf0e7c0b46b6bd5479dec6d32aa67574aae8e7f99c7b2005160ef3fb939b20ce65689020343b5fd83d0f655ea23daee2ef9abeef275
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:WQvGAdlCEL8c/yRNw5CJU023W
TLSH
T1E5267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a361f6be408ffaf51743ed540d1a9e7a5139a80f33adce8e45604fbe6eed8da1
MD5 8aed93b108f9fcd201f1f59e1c344bdf
SHA1 4ad0b308aeb4b52be3cb509fa07da97b0cd2bc19
SHA512 e9f064699fbcb846c9661b53d6a1e9e15a1bfff7805d58d2191dbbf1b9987cc934fc852f01542f54814781b4185e0bcdecd65ca30bfa17babd0fcdf98c72840c
SSDEEP 24576:QdewsAjpgXe4i7ojhsP5Lgrk1TWb4AN5:gljUe30jaNf1TWbdz
TLSH
T12375E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c201fa9c17c9034c3550777b2f1f500a24b666c9a9f2d0b1f2be6d629885ea32
MD5 4529f1c0c683f1bde8f4146ce589f0d4
SHA1 9e73b035ea7edeaeb4da0062df95791542a5be90
SHA512 16c26c8c7a1b1d46aa2083721ff303b7751b2d95707d0445bedb83deda03efc4751e6459d0b9cc4a96867a13abd485301bfe338f090d149871c4625253425a12
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8p4W:gUEtQevvqc2W1cpV2EI32c4W
TLSH
T12E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8741ce285083bd6cb02eaf57d79e1080af1d4c0d36d4760dee7fcea51607fa0a
MD5 f6cd3ef8da8d56e38235eb0a772ddd50
SHA1 2a5e721799cb071c8bf38255209752e7131e0052
SHA512 2db1baf321904b8fb99fc300fc17c67cf03d0709c7bb41f1c46f2dd004634ba5cb888952515df0b798be39e65d725bc0fb2fb1a1ca8213ee5a65eb3c1ac97f84
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/z0e30jaNf1TWbdz:8oq2Vjnm1U023W
TLSH
T13ED58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 69f075d75be618bf17490f888b4b6d3d674f31796f0eb96f6401bef00e07c109
MD5 89893116737ff8097d33fb71df8701b9
SHA1 319cd86697e062a062e5598d80eb3ca3dd189ef1
SHA512 7b48e73fbe63b9d4fea87ed0231249bf8752f9547f075b367c95acad76e29b1b6808e70737edfd5bc6a7122d207cce972c9bfd02a83b91c6a20cb60b95d09127
SSDEEP 24576:zAhGLJIFoiwtA5l7S53CgXe4i7ojhsP5Lgrk1TWb4AN5:zAMyFoiq5le30jaNf1TWbdz
TLSH
T105359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 df7c451cf1f3a52024e330f81439b040faefe084517056f4339140ac3c644542
MD5 8d2552ae27d3863ab36f79471a3224ef
SHA1 31412e1635488183a7454b084e236c0a9b5ac670
SHA512 b8a6f06dd9f5480c04277cabbe7d8caf1de3f32eac6153e857efb4f22bc289515bfd79817b2e96a410d479e111bedbd790d429fb4b2d1ac5b3676133749f5a1b
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+CJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:6wuoOWlgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15665F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f82346e8df38d94acb1e32427c1bf4d6c3173ded4ef4390caf5e8e997e627f8d
MD5 4418d3c38b336be842b59cd498069ad4
SHA1 5d406f7ce2f68e79250ceb74cfd3ad0308f2a747
SHA512 2ba5dae050951e79456065acfddd87126f257db69a9db5c1854ae2e78ad52cd88157f8b5d3a772021f3359ee411d625d217894b42ebdf135ab7e448acb998239
SSDEEP 12288:dBZ1Iy40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7Zu4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CB55129637E420F9E2978278D4F68741E7B23C92233147CF02A096A61F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5ae58172b3d3680832e24b221df651ac352210ead5a6ea5ae48f2241c3951988
MD5 98d9fad790c90033be918c7fb69c603c
SHA1 5a09b5be317c9b84fe75c5965b64e08180351b4f
SHA512 0c9d41259ce50b8cf3a5873901da7e3e3845938f8ce301ff57b3dcf476c89659ee08080569918d5010c7d27e04ef3a15508d77757ca162bb7467ed4aea078b87
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:RQRQyi36YOcPQLvw2gAf+PN3OU023W
TLSH
T181667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e04f5adf0f4250c2a024811ff34852d9161eec037b05f49fce0e7f14235f6ff
MD5 9b3acdc9e0a2f7e515f02f9917e008a0
SHA1 a9ec189885547e86efcc2bbc00183e57db858105
SHA512 77c8a8e602e38bccbfcca47e112fd1eb0e98285ba4a1257edcbb8ac16dd074234a5a095db698f9e954e3722f62f7be7fe056d0f1fc6a33596796ca4bf36a97e2
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:QQRQyi36YOcPQLvw2gAf+PN3OU023W
TLSH
T1AE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bf414b0eef9e8a7aabbc5a555e9244d757e2ff7d133c0f75b533ddf3fd2ec4d3
MD5 07e2ae631e2fd15c8e1695c5a6691502
SHA1 6fe15075aea79b21ec7c8f83f0da7d6cbee1e822
SHA512 f449ec9d9e81c8136ae3fe392cea9ef080097ea7f0b24fb07b0428a919558b6ee10fb2aada37b9b44ac1dd8a4083a65cd146c83219163f1ed23083352bee0d75
SSDEEP 49152:V68Qg55nhheWu7PNU3/ke30jaNf1TWbdz:jthWRc/kU023W
TLSH
T10CB54933B2F20099C04DE1769F4A872196E27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 771e4e3ee7bb0ee304048f07297c719d142c79729855531b97f47c4a58a767b1
MD5 a400845c2ceca2ae1398623e55ca25c0
SHA1 07fa854c1db5236dfb5bdaf1c14bb5e393c56c6a
SHA512 94a77c2b1ec885d5449878c08a9c9584c0854570de8aa58e008102f84419c704a70947e5ea92b28db0ab25f6387af543526c94bc7e8429a41419390292c0c363
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:hy5112gYy5azzVvL69nLKnhZ7U023W
TLSH
T1D6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0197a745551ab3f367bf6bb27692cecd3a478d762d7f6e46f3865978802b98b6
MD5 a3d1c06558e00a8a20ae26f4f23381d7
SHA1 c7c1081dde064ddbc0eb425322d8006ed3424920
SHA512 0ca57b954ce7ca4443ad5387bc7166d7ef5273aaf2ffef798b7ae0aaee0de20cbcd510f9d85e9eb4be6341c58f113085cc13c423b8770dbfb7e3be1a4f027fd3
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQe30jaNf1TWbdz:nu6JmVxd2dQU023W
TLSH
T15ED59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7dd9081799fcc3693020b9399d0cbbdf4e1e679733131bda1b1fc79413c271ef
MD5 8ca5f6dd0d34e93c0a1e16387df56a2f
SHA1 cad9637965f7ebd7eb1a2ec9bb24f424c1fd8dc2
SHA512 e7c2e310594cfd42b281313bae0a63fbc4cae82e82367d4f4b0607d3ab2d5f31f3c510f009c6fc8c922e998bf918c6cffcc6798dc9d56a29e1f48ad891e407bb
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xye30jaNf1TWbdz:amifPbR1U023W
TLSH
T1D0B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 093ad6ea241d89869df34ec4b7563eb6e45404844118da11defa8618ade52052
MD5 5913052530f64e21bebdc57b8495723e
SHA1 62f8c3ecb29b489fd1b6c14faeec69b275f63c49
SHA512 5af597336a30d9e7da98d88a99601aeed563826c751640ef4fb2d7bc2046bbea7be964ac45fe5380ea10e238be1df558c40d95254b0a6613c505fb427ade6aa6
SSDEEP 49152:qSuZQIY0Be2KRRVtOnks6NMHqPe30jaNf1TWbdz:05dKTi61PU023W
TLSH
T1EDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 554b1e7c834a38f9c129866c40d1e0e55d60eca11e995c900c5ed15914dc85d5
MD5 47374988d160ca103853ff5cc30cd3b9
SHA1 5e8258bcb7c6e43332fb7ca24d629a8a5912d4cc
SHA512 fc08fdfe3f266c75ec9b48478b5ae5b43605760fc08666120499c76b37b751ed8beeaab5191c469bd00b3868ca3e4bdf0389f077c76430a39674cc4828e45710
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5w2e30jaNf1TWbdz:JX2iyphRU023W
TLSH
T1BA95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c6848e5167ef6c06d1612e3ab39243e551082ef521d46a8220ba34287f74ef6b
MD5 236901903ea0c32be74d10770ea6d6a5
SHA1 a1d557889e5eaf25607e9e616625dcce1117ee63
SHA512 d7342d6190208786a5742a78bbce68ae0c8838c18b730d838859dfa3ee048606601234d1b94bb0e302d3c526e275606ba2d16650233e75531264f1c5a96d9d14
SSDEEP 12288:IP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T165452391AE5509C6E34BC3F0D0F787D1F8E02EC2724449AB17E0B5535EBCD9A6A9C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a917ca9ff4c8d4c14e0288aaba0672032b484d6cb912c2fbcb0bc7bc4e9a1ba5
MD5 883cf22be6fe263eb9696be70b16f4e7
SHA1 9fd879ce7b015095311cace96663f864b8bef2f6
SHA512 ea13a7c5f91e9a634b30fe3134fe3d7125c9bab99ef1cf61e8fb81f14d9d2d2a90e2d6cde8569348db837a3d38bc3fcb945be816b3e15e371b116bdda7f8749e
SSDEEP 12288:x80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:x9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DE4523A1AD5509C6E34BC3F0D0F787D1F8A01FC272444EAB57E0F95359BCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a828178bc1f82335ac98c6af841807ec60df0ca23509f57a7b21fe63f87054e1
MD5 04b8acb667aba27970d201cfa7e97d7a
SHA1 fd2e403e92b0df4ab48d8a5360315e1df88e229d
SHA512 542411d49bcc5c90c227cb56a7b18946c0399142414cf7497984745aea7bf360f1ecf6c2d7427112ad400c8a389b303d0e317e9cc159374ebdbd7df256bb9e23
SSDEEP 12288:T60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TTgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T149452391AE5509C6E34BC3F0D0E787D1F8E01EC272444EAB57E0B5535DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 55ebf6f1db9a48b222af23df5892d30c0ef53c2e6b0273d6a3c543f8d55ccd9a
MD5 9042fd1e54865269c2d22b2bfe7c863d
SHA1 cc0300726e398ddfb3971ead93efac3fc9b72c4f
SHA512 ed3177412980492ffb24b79efeff4e7cf6f6d885852fda877eac4f13e955073ccfd905fe4457d70b2f33fd0187936faea8a85134426591fa70e93631b4edc83b
SSDEEP 12288:5VV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FA4523526F5505C6E28BC3F4C0F38791F6F13DC173118AAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 17458501f16f257fe44d44a44dcc09e97f47b7de2627894aa0c089489948c5ad
MD5 3425e88aec1c1ac326cc848842f15b79
SHA1 43cee61586988299db6926567400d852ebac8700
SHA512 f07a875edcb4cce6900d1a6f4fe33216704dfbdf25a448a34e15c9a983fd8b936f872ef251aecc4a0a389fb70d56cecf97722f845e0d24eb27ca3130fd98ab41
SSDEEP 12288:IN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FD452391AD5509C6E34BC3F0D0E787D1F8E01FC272444AAF57E0B5531DBCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0fe88c894a592b2eb44065bf28b81d661338075dfcfaeaeee70f98d94c915076
MD5 60586a26986846184dbe5e11b187cd17
SHA1 a26d332369c68f4ccd24cb4b0e60f66908b2f507
SHA512 31dbe4cafcf3482aaff555238fa73e67fef832f18e4f3263d9698a462e6f00a5a70dab0e657ed234079b5d267b505d0bbde14b6ec15ccce4e7612bcebcc22216
SSDEEP 12288:bw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:bRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12A452391AE5509C6E34BC3F0D0F787D1F9A01FC272444AAF17E0F55359BCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4eef783bc0dc2f1093978ebf92253c65428d628aa02757892a6541d8c9b0a9b8
MD5 9bebf5bc2ddb5221c5d8290f393a2c14
SHA1 8b64f3fb26266c8676cb9147e0f3a561912a437c
SHA512 9dd6e63e2b79487afbd7a738e4ca573dec7ed49c0605a6b1705a93aca6a1053df57945b236451339a288a730de55fd034d01c90294853f62239dac88b9e30f0a
SSDEEP 12288:Z00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1514523A1AD5509C6E34BC3F0D0E7C7D1E9E02FC272444A6F57E0F5535ABCC996A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 85ebf066bb914527b78bcf0738d0aafda8f2c2b69e765282016d426b13e2b66e
MD5 08ebde036f7eca1ca4745bd3ceb0f850
SHA1 ae2f9811de3778d0c9f487a1dcdce32164f91ba8
SHA512 0b0737106ebbde6a573c279a6d6fc1a11f19e78f0556af198bf3158d445bc0465d7c380400b0fa830feb979ca69929129b8203890a345b7a157b7eb9d58326c2
SSDEEP 24576:+ZMSzFVSOdgXe4i7ojhsP5Lgrk1TWb4AN5:+ZMSzfce30jaNf1TWbdz
TLSH
T18D650195B3900CF4ED67827DC8A68A02D6B27C561760CA1F03E436675F733A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4d362cec429071a5888cef2819775dd26a6e43e74f0a76081f75c28e2d3a51e1
MD5 4849b0ac6633dc36b0f7497623827338
SHA1 c9ddf6f7f6b2276e515028b1b5a2f0b50991f3bc
SHA512 288d62fe204ef120ce175b2ec79efebd3b110bbf2f84540e0dd6a88eb5705f0d70c49284b76d737916ced4669fbc27ac86686f99fde74ac349d2651639c2dd71
SSDEEP 12288:Jr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T182452395AE5509C6E34BC3F4D0E787D1F8E01FC672404EAB57E0B9531DBCC9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d5f4341e1d70b984eedd32089e54209460a144b179c41b5d45bd21611c5737fa
MD5 b39408e7c483eb900c9a660ff70fb0d8
SHA1 887b92d5536c9818eedf6b95a9c8a47a568f25f3
SHA512 af8cd440fbf8480732b988449b83ea5c44392bcdcf544d19cd70d50644683fab24707d1c3a4c1fdf2feb183b725f75c490150631ce54283a8e8b52db272119c3
SSDEEP 12288:1X0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1EgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D7452395AD5509C6E34BC3F0D0E7C7D1F9A01FC672404AAB57E0F9531ABCC9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 408c267faaaf5098d71e813d0bca47eea84ba1e9a04783a7bc97eac1fa5cdec3
MD5 be9f3076d8fd0f934800d3672c1ae012
SHA1 77c5b2bf7390c776d5129d48728ddb41643fd2f9
SHA512 1f8a4e9b1c2181c2659d8e8ad3639913a6b38949f211c713b90df5d0675ac61c2f4618b22d43b3113e63bd4bedb71829af3a23536f4fd146b7ad3a7622050d50
SSDEEP 12288:ayPz5L840DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Hzy5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DE55025777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 50ef3bbab254638d8cde46f3bbc165e15f86beaa3d387212264fb5027b813f50
MD5 f314be1f50a1485ce9a3677fe27277d3
SHA1 842e51a98002d837f52ffe92c4d75f5d5adf64ee
SHA512 7d4fbbb560f8539d8ca8514bb089e23a85f127d27fd53a1416f6f72743f804d0129eadd2634f9103f0c598d864649344cbb27737e69a94097c9c9967ae956fb0
SSDEEP 12288:or0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10C452395AD5509C6E34BC3F0D0E787D1F8E01FC272404EAB47E0B9535EBCC9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5df484af94d03422d7cfb1e376a00402ba299e9a9bb0adfff82b4987692545ff
MD5 5bb6dc5df7f1e788412b530f81cc535b
SHA1 4ba3677177c97db6b94fbf4410fb380520cf7c04
SHA512 8fe2f76ea8e029ad5d4356d4ff8312d8b618d56b57d1b47085cc45c7245b389ef41776f88a6db080b1576ad9074821a8815394eebdf6a5a896c0e413e26b1c80
SSDEEP 12288:Jr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T188452395AD5509C6E34BC3F4D0E787D1F8E01FC272404EAB57E0B9535DBCC9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6a3a01feb72f7b6a7dbe63e4a02453c34ef9a3a1dfb177d2d55bb2a825ae42ea
MD5 bbf7af881da762bf2749c46ff4ab334e
SHA1 cc3a0d30630676ae70598a8daa1c7d50fa84625d
SHA512 26f8b3edf99db1c99f55ec31bb3f2986d94ed03a7d2b91b0c17f2ca952171119ab26dbfe95339567730b9246fa91a1debc3f26978a5936128436dd3f4f32680f
SSDEEP 12288:vyPz5L840DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Czy5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16155025777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2a199ccead2c3f50ff135f37daa15ed02ef9bbc7cf498b556d0ed3a638d8ba24
MD5 6557ee1230528f3e1b675d0b0c37b8e7
SHA1 8c5a95e4b50a2aef547cd57b51edf83ef636b7d5
SHA512 fedc53fdf6a3f5328cf1fdef8dfc952d0d0300b2c050e5b8d1968dbddb4a9250db2ffb9a513f370b0f8c48c320fef0bab50adc4b53d89cd6ef1aef42f0157f5d
SSDEEP 24576:ZTHaLl3z0zDDgXe4i7ojhsP5Lgrk1TWb4AN5:ZT6LljZe30jaNf1TWbdz
TLSH
T1C46502A5B3500CF8ED67827EC8A68A06D6F27C560760CA1F03E436675F373A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 74c35f7d24c369247038e39bc279bbc1b9bc303891972e5cf48f76e8f87629d5
MD5 314f0e7bd1dc6474706acae20b1558fa
SHA1 b15131470a162fc30bc0ec8327ba9d9bd7f87eab
SHA512 f4470f00ce9639524317784172e5b6481dc3047a0fd21b3299d041451e2bbdbed5be21919d5fff38913463d29b00c2f9bb1366a176c2621e592ec5bec43a2d98
SSDEEP 24576:o37d9CHKy7GZHgXe4i7ojhsP5Lgrk1TWb4AN5:y7d9CHKyace30jaNf1TWbdz
TLSH
T1E375CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 87bce146ce60b3ef9ed9bd36775bfb6e3a4a31f0dc27b18909000f84ee9eda87
MD5 e59d206172f78331ea5b7fdfe6fea66c
SHA1 e99f3b6aa4ed6d921d009cccc10c9c43e51aa26b
SHA512 7bf3d0bdff75279e67204b97b2f32128becd77f8d0c52b254c107a220c38e24b6373c7c2611a0e565041e31be015b1aa6da32e355900ec6d20eaacc4713f62e8
SSDEEP 12288:/a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/zgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EB452391AE5509C6E34BC3F0D0E787D1F8E01EC272444EAF57E0B5535DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8955286725ba4de6592f7ca945e514d699cc2809446479fef148880ff6af15e9
MD5 94200ad7bbacb8e8303de7b90cd5b13b
SHA1 e9eb129ff4af8b2d3963ae445b47733b17b44c90
SHA512 bdf657237ae194e81ee336f09119ebeedec0841dd0f69569222d94ccee3dd8b936ac645eb94960dcaf1bcdfff69c86fb9b61b87bbf72df4e0161cbd3d01b8b89
SSDEEP 12288:KY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1144523A1AE5509C6E24BC3F0D0F7C7D1F9E01FC272444E6B57E0B9531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2254e3a5f2b10768d5b768b09420bbc16906ee0e0a604a1b8cb3b17b7e0fdd72
MD5 bf43c07aaed95e45c99429540f8612c3
SHA1 fd2b3c3206c075108349d26a93f9a40df55cc1e7
SHA512 5b5233b4e4f753ccb2fabe5fd6ae4d1db42b4a2aa64b54b2d64f5f106afa6e3a18dc31b26f479391b96d68bb8180315b47b458a611c91eaa59852ab0f01c041c
SSDEEP 12288:Gh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T170452391AD5509C6E34BC3F4D0E787D1F8E02FC672404EAB57E0B9531DBCC9A6A9C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fd3b12c8737fe2d748d79947dae134b0cb9c9a9f55be0c79a37119e943c68ced
MD5 a6579be9d099234f43ba8c37c07beee2
SHA1 b160872c695f12a278d166fc1924fcfc6b14563f
SHA512 3d4612a074d8f46b8a4e684cd112eafab4f896f4c5ab0d07cfae3e2022f66a30aad24b59f6f2f856013f84733b4a374d4f6d255a731bd86803d2cce586844531
SSDEEP 12288:9r0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9IgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E2452395AE5509C6E34BC3F4D0E787D1F8E01FC272404EAB57E0B9531DBCC9A6A9C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1ed89f733e94c0e5f426d71dac98d26da5b06df94c8bbd535ad51b9497c65a7e
MD5 5085713f7e9dad6bb4920ce1f3cba513
SHA1 605ba08aeeec9d1e3cc67a227938d421de24e9bb
SHA512 8efa198401d806436100aa4ebe5b12cab70ee7ce3427a560878e4c899fea55b98498f4df7c7689e83309bdba9174cf4150ee5cb09134d16d3dc50808b0279b57
SSDEEP 12288:Fa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T116452391AE5509C6E34BC3F0D0E787D1F8E01EC272444EAF57E0B5535DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bfef6c783db8f62b2f96fbbc58d222da877c58b8c45aba1baf636fdfb7862063
MD5 f1d6fe70137d0a9cd4c67e25968c36e2
SHA1 08965ad3ed4792c1a0abdbc634b1f256f4df3339
SHA512 402dc82ec8986511be9857a08ff6e8fceb25ec5ddbf7d159a5ff58e1e19f536ac2ea1c3f888548053ac7f3697ebc19d73641666773a77ba873c415984dc21c8c
SSDEEP 12288:ND0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T194452391AD5509C6E34BC3F0D0E787D1E8E01FC272454EAF57E0B9535EBCC9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-09_140440_1236-4808.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-09_140440_1236-4808.log
Size 1KB
SHA256 07d56943d3ee417e1e997dd772329e924ef5e72c8181272b3f738e916d2e5205
MD5 d74301a34939f439df8c9abb26efa3e0
SHA1 1e4147cad134a6c1a83eacd5bebe66957b1ab3f5
SHA512 b10a1e65912cb789880ff18fd4e71f4f3b403a2788887c82564d187459299476b561df0d2ec263b7309fbc3387f65135b23c6731104c9f82636312f45d2de455
TLSH
T1A22172192BE84A06FFFB9E82DDFB10435E3A79916831C60C10A0434D4872F46EEB0327
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 364f86f7f582487fc097162490ecbcf453b12f28189debf69f73cc00dafe0eba
MD5 4847646e72bf91c1f5216c027d3ddb3f
SHA1 445ae533b5924cea1b248ae5f35a16f84ffe3942
SHA512 b061be5301dbdb0434a0c28cc55e6c5a453ced9991063e25ff460346d87742755cbad21829cc5826013343b2cebf7cb256591b9df70d5e363419e626a39b4f95
SSDEEP 24576:mfwvok9RX6wkyAIUgXe4i7ojhsP5Lgrk1TWb4AN5:qMnYIbe30jaNf1TWbdz
TLSH
T10985DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 532bd7b611fe5eb5d9172da024dca813c92f33b9a83a0fbe7ce287700ada6a87
MD5 1ace9b768e089cba1f516708f2da4613
SHA1 f8749ecf3daf6b50fae84061549e3c9ab7451fac
SHA512 802643702c07e7fbe245db36d3586933cde15688044e7389415792dda95db3c106f2af0c75585cf26c9d069ca09179238f157cce5174ba7f8b99ea94003c2c8d
SSDEEP 49152:JYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0We30jaNf1TWbp:xySzPuU023W
TLSH
T152067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fedb9a2c8c2a84d463cc99359b8f52d76f704cb0eb12e0ec849768a1384b40a7
MD5 01c7144bc2dad788da098aca46ebdcf6
SHA1 cdc485060171bfe2e8b35ee2139abfd4aef496c7
SHA512 2220794280672a3306d8402a83d38f6b203aabad982d3e0cb19bae7cca4153495c92fb7dfebecf060146321b95bf88c9a48a127314d4f71ba28cd81d6660158b
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtgXe4i7ojhsP5Lgrk1TWb4AN5:x47JUQj1irIhCnDHUPfF/Ge30jaNf1Te
TLSH
T14F65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0a4f783128d09948e9db6495052a7559f6efe06c20887814d28655c23709bcd3
MD5 d1af8e46e344c386da6eb7fde3f74376
SHA1 438bef446176874e4cbf78e4a37c04807d5bdeb3
SHA512 e753778ae8c783b9326baef9bc523349fad820d9dd4063bb1dbe5afb7c2a2b76e21f132ba452ce9f40fe5fdebbc8a05e7a53f97808eed10408f9948caf12b5f4
SSDEEP 12288:4Nsf70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Z4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B155F15AD29802D8C15E92B4C3968A81F3733C9193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c64667bce0848d087a21ed2c7bb28d6d8e4eef2f54a527df73b736f10e75b868
MD5 161ae734387714047804f519dbf1dbc8
SHA1 e942d6f5002f48888f4aa5a1bb9f83e8cf1a3cff
SHA512 9ad4f6ead33d43e9b35b32c3cf850ab5eaea6626871c01e4762e37e6624d932e3e140786546be7dc793e693d802141e8c96441c28d02af8aa5108daf7815ba8a
SSDEEP 12288:/8r+h+qU3fdXKD60TpoDtBUmDH3eXhpV1YThsWI:/8rcdUP304tBUmDHOXhj6TCWI
TLSH
T1F1352850766AC75FC6A940325E32C2CCA7707D41FE05AB0372C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8f0f86d911fd14722ef655da2905171be4167b7ea230423a9915dfd42b15edba
MD5 c9a18a707e7a8a80d6491638602a9d8d
SHA1 9d759e7592784cc4ae4f424a13515e7d3be564d4
SHA512 60716eb0c2393f4eed43bba8ecd5ab62b88c5bce33afe68ba80efe9b62fddab74be03a91e55c746ada172c0c94ad08508be05af78d7c97031431ab1979924b9b
SSDEEP 12288:EfvX+u2bvypkyv4GPsoCutH2yI78HWpsjpS6S8g:MvX+LbvIkyv4GPsoCutWyI78HWpevS9
TLSH
T1C755E9416537A3CFD1F62132072A9B4DB764EC07B3456F27B3C8453AD82AB25A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d3c9a769dec86e60055d0b69e694fd99b213b1975b4a21bbe5a06adc4bed1046
MD5 1a1140e1ef33c362bf306cde53e13b54
SHA1 5f5cf35f31d6bd173fb6557567624e5669048697
SHA512 a5f18e0c783663c64a8c6978e52d495c7087e08d26e8a48906c7964dedd89abd20d9908c4de1c256010ea6077164d7c7bb12db2aa851b046043e3a2e7cfd9a5c
SSDEEP 12288:6F7T0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2QgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D54523619F580DC6F29BC3F090FBC760F5653EC0270089EB96D0B69319B8DD99EB8919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8929ef8a8b434e60ceae1546d3b67e9790f8cdfba6d1108f2873e3d307975601
MD5 cc6fe2ade1587c08f65059168d804c8f
SHA1 22e1248cecafeba844d58de558be0b9a6fcea2a5
SHA512 3362055f62e9af16d16d2dce2c31f522354d1c7b68a8e615e01e296e475e47dc9e38b30e8162b2112985f2ae551cf0974afa0d492759bffc473316351a769c46
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bY2gXe4i7ojhsP5Lgrk1TWb4AN5:Ggb4mBIBhGFoe30jaNf1TWbdz
TLSH
T1C965AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5464fd1bdbf8f798516ce07ce61c461c1f202303e19feea5347087846c21c2fc
MD5 3bfea4185c14d374a7f184d510048c65
SHA1 cc3d23c92f28c3d955797ff9b3037829dd9e1c08
SHA512 1e4c80692f6e73afc976dccb9fc052c3fd5efa36c1b605da9ae0e47e0b56e3718cc593bdf95d522eb9e06168089d4360edca44f5dbcfb439cf81f540778a9ace
SSDEEP 24576:VG88u8FpJqH1bzria7/mdgXe4i7ojhsP5Lgrk1TWb4AN5:Y7ZFPqVea7/he30jaNf1TWbdz
TLSH
T1FF85F16577E101F1D07BD138898646A3F6B2B8111364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fedeec6e4378a3bfe12a04b78ae50af1f968dee3b13cf0205cabb0298d8d1aca
MD5 7706d42f4337f92f67c5dc85213c8cfd
SHA1 5e075a55009a3a3113c1ad6af77a60ff7cc65e9c
SHA512 e173bb7b2d429dc056de6d35ef129e67c58ea6b7658132885e2be56acdca2886c2361d9eae37c413f5890e393d9c343106c69db4398718ae8c4b27d8152f3c98
SSDEEP 24576:ZPUr+NQhgXe4i7ojhsP5Lgrk1TWb4AN5:ZJQce30jaNf1TWbdz
TLSH
T13765E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c274d3625badd3ca70b4439ff5c809c7fe1d25e03b70107f0e25be9bae4008b5
MD5 df15223380228782b8844cb0db46be9a
SHA1 964ea4356d68d32a1751b544696854e63741404f
SHA512 cf65c703e6fa654d7a20e9f45047a4e5cd4199e6bd5bfdfed8bb59d0752b27408eff6fb916c0311a2cec12fc6daa5d0aee7f8e1cd7354f2409e153f1ee9fb2d1
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjse30jaNf1TWbdz:FG05lO43bjU023W
TLSH
T15BD5C06E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5a5456dc7d88eb388dabe3df70573f39291c0a1a13d0705933fd0355514c1fc1
MD5 21bdafedf764f6b8cff5277082e5d957
SHA1 fabce67af6ac1e3c8e6ae1cb9cb15ce5225f0f92
SHA512 bab567ec5131e11766f1d4f6eaccd778bd797eb02f4b822146feaa474858db9747fa7e7113cc87d7480ead677e6ef90193bc9c8f1eee392c6e6858e5cf021202
SSDEEP 24576:Xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/gXe4i7ojhsP5Lgrk1TWb4AN5:va5POZ3+Jt2pasx2+mke30jaNf1TWbdz
TLSH
T12B65AF5EA6F801D5D1B9D17DC583861AF5B1346253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51be9b51689c1dac34cc2a8312f644a266bbd5d2d50357491e20a0147a7d1d75
MD5 b33f345f8e6456d145aa2b8dbfe10505
SHA1 48dffdf2a5d18ee8a1e0a7da4ed2e2bf3f1c67e2
SHA512 b394f9874b7eff82ab8da9293589413f5c99e18e3d57d169d17d45a6f2993485614f31c00c45971d78d030a8d8afc1c9163eabb5f13f760a5af6a2dfed7aa4a0
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkFgXe4i7ojhsP5Lgrk1TWb4AN5:7Nc/zEOVHFBe30jaNf1TWbdz
TLSH
T13B858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e31cdae70d9a17c96f5b8e30ddbf955916434cd5f565e94203f08f5d77d65b62
MD5 f0f7fb3536c5a8a0465d834505987aa3
SHA1 b71335977ccc28c14146a4633a09da081173f2ac
SHA512 8bb5312f3222afdc395a57d65b4d94a28cce25cf1432da0b5f84b6c428470cd03150c451d42a7e5e5f302914cde427a6afdafe69c9a31d7d3aebcde303d97415
SSDEEP 24576:P8kNvNnaFeYhJNtmZBmxgXe4i7ojhsP5Lgrk1TWb4AN5:P8MwBtOmMe30jaNf1TWbdz
TLSH
T12055AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4972a0dee886ced8f2ebeb73e7c4a2ec742e482f5b69b0540881cace17dca2fd
MD5 a1c62a8e2b87fa60878a18700248d9a0
SHA1 737e88d1697693ff54866bce38b282cf1aa31d4c
SHA512 036208b02aad09133190a26d37fc97405a927ed09aef05f6465b9b3ec0d489894c8b7190e02bb0057ab7c1c64fcd9413bd2c10382fd99c91d9fdc8929145c3ff
SSDEEP 24576:ID3FHshBIYQgA8gXe4i7ojhsP5Lgrk1TWb4AN5:IDVHeBIAATe30jaNf1TWbdz
TLSH
T10D75E17DEA5C04E4E57BC1BCD6A38A06E67138A903215ADB02D0D1B61F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-0-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/1236-7-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1236-1-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1236-39-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1236-42-0x0000000140000000-0x000000014046F000-memory.dmp

Download

memory/1516-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1516-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1516-311-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1516-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1768-80-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1768-146-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1768-74-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1940-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1940-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1940-313-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1940-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1940-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2588-84-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/2588-89-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/2588-142-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3100-93-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3100-143-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3100-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3100-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3100-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3100-335-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3244-315-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3244-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3244-110-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3244-144-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3244-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3580-127-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3580-133-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3580-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3580-135-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4084-59-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4084-55-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4084-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4084-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4084-49-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4164-331-0x0000022AAC000000-0x0000022AAC130000-memory.dmp

Download

memory/4164-330-0x0000022AABE20000-0x0000022AABFFB000-memory.dmp

Download

memory/4280-141-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4280-69-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4280-314-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4544-116-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4544-122-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4544-145-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4936-155-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4936-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4936-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4936-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download