3cc438b8fa2dc209123878aa6e80e459d8c1a7ddca71b2d2d05619a7efa9c373

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260809-vereksbe26
SHA256 3cc438b8fa2dc209123878aa6e80e459d8c1a7ddca71b2d2d05619a7efa9c373
MD5 4813df036cd30a101e1a6008c8dcfa4f
SHA1 a78c1c4c138a259c8caa87cff85ae8003e9ee129
SHA512 70ccb0877f7f37fd75918a8cb902cef991127c70676ace7d0ab9d91663df84e1c9de1aafb6e9713ac078739466ba204b92de8cbfec682f7df0788c548062491c
SSDEEP 49152:t2lWq/pQd+MhtHM7jO/IOFBFileoU7ZtxSHLQcN5tU8ojaTJPaB0zj0yjoB2:tajHLBcB2Yyjl
TLSH
T130267B4BE6B940F5C0B6D1798A579617FAB27819873297CB4790834A1F23BF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4340	elevation_service.exe
3668	elevation_service.exe
1208	maintenanceservice.exe
3292	OSE.EXE
4656	PerceptionSimulationService.exe
6024	perfhost.exe
5052	ReFsDedupSvc.exe
1536	SensorDataService.exe
528	ssh-agent.exe
5276	AgentService.exe
912	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\646bbb18238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af5b42ca1f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048f7c30d2028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000cdfd62cc1f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	828	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4340	elevation_service.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5276	AgentService.exe
Token: 33	912	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	912	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	912	SearchIndexer.exe
Token: SeDebugPrivilege	4340	elevation_service.exe
Token: SeDebugPrivilege	3668	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2524	828	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 912 wrote to memory of 2508	912	SearchIndexer.exe	102
PID 912 wrote to memory of 4532	912	SearchIndexer.exe	103
PID 912 wrote to memory of 4664	912	SearchIndexer.exe	104
PID 912 wrote to memory of 2216	912	SearchIndexer.exe	105
PID 912 wrote to memory of 4608	912	SearchIndexer.exe	107
PID 912 wrote to memory of 2912	912	SearchIndexer.exe	108
PID 912 wrote to memory of 2548	912	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4813df036cd30a101e1a6008c8dcfa4f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:828
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "828" "1440" "1320" "1456" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6024

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e9d31676e87cc7784ef4c0f62496a962cbe175f6309a37313dbab21d60c465f8
MD5 af9a51bffb72d6db8eb5d44acae9b168
SHA1 26c9d1146262f8b9ff2684d1c73f165cb9236eea
SHA512 435315e83a2c982827985b482ae2b6e43c378a28fc705ee26a03b2348443477a9acc60f4110b171f16c2fc61db1788e29b7048a949ddf42660519b09a7fa430c
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnaB0zj0yjoB2:y3q6HjB9B2Yyjl
TLSH
T16CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1238347e0e54836fa453589723c8ec3d80c69f15222347681767a2d4dffe444f
MD5 2cc131c8759ccdd867e10a1f7ce1b1b0
SHA1 93855b1bf2f0475b2042598221e647e511484de6
SHA512 8c6bad46159c74285d63ab59b699ec3a93717ecf10fa19a834e6f07d7ab9af3ace549fc76e27723b757c8d40a2c6ce2ca669ee5e1168e022701c3adf2d469aee
SSDEEP 24576:oXYfDtczAhatr0zAiX90z/F0jsFB3SQkw:/tcmaB0zj0yjoB2
TLSH
T199650229779504F9DC67823CC9A18506EB73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 57bc5248218b0d2e1d8ffdb73475cdc4b53c11b65aeed94c25e8524329e76703
MD5 d198e53a90a75f9e6b81a09ad31cf93a
SHA1 fe0798f56bfb1cad4e8284d2026951dcda6d41b1
SHA512 5bf240596b5e80dedcbd7809273913cc4495af1b9498423c0285dd81351f1c1a53753cd074535df34f20590f939cb66f46514e548869a241dbdeb74860824dd9
SSDEEP 24576:20Le5ji0hmxirMMatr0zAiX90z/F0jsFB3SQk4:2Pji0AcXaB0zj0yjoB2
TLSH
T1DF859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 72fc547206ec7b7a17b151ea9e15d7ad3ffe515f2a457aa873ae085b29f44348
MD5 95308c330f0d6e15ac5eac598f1cd22a
SHA1 ea7bc402c26abb9c3ad3a9ef74e4f6258d1d92cf
SHA512 5e6ec754b142af44e86862c3740cdbb41df81d53293bc235832204bf20c1c67c14b8396a5edfbae8617baad3506679dea76af7d02279f6f53e8bf877fc2d1291
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyu2atr0zAiX90z/F0jsFB3SQkA:c/ezSC6vUzPvxHjyDaB0zj0yjoB2
TLSH
T127755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9716a78b8b2ce687e842abb6078f2ac5e542e6bb8dc0d7188cf845feb2e060fa
MD5 28b40bbb3560110c462a4aa837922615
SHA1 29fac335f3b71bd4435b526abd7348485177e55d
SHA512 4daa41aefdced13fbd875665cab0f7d212cf89fccb3fdf47daa233bb159377cfd313cdf92a9248b5d67a2cb71daebc32b89b01265df5747da9bfe23609f80d9d
SSDEEP 24576:OVbqPb88hv/l+6latr0zAiX90z/F0jsFB3SQkF:OVO88hXl+4aB0zj0yjoB2
TLSH
T18255AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f1cc9a0836d959ff99c44cf9ec3815f713a5631b3e8fc32a75a0563d6ad0cd44
MD5 b7afcca5533a536bb508ff048c948635
SHA1 a39a78fc43ba3d5bb47156a8458701166cd44711
SHA512 132a9eb6a56de756d98365f73c90ab0ed3800ce2b2b396e7920714586612a75079c9476f4544f29b2e9b27248a0e002844ddaa497496ba7d7927a71191444460
SSDEEP 12288:ZRwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:ZRwatr0zAiX90z/F0jsFB3SQkO
TLSH
T1D245230B350E80F2CDC32B3526989C4B1AB99EB065E2AF45E1913F4F9D3C2C6D6656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 16ef02a325648cb04ce064beb607b90dbac020877fd07a0bb986b1c460d1ed08
MD5 1df299a2ffcf25ac6c7d524298de95a6
SHA1 28be598344f6ad5b6a0558000da6da80cdad62b8
SHA512 34eaefedbacb809d149529d9df74786fb490960a2de838e15bd9e2620b9670840ea430f07e8f586ce54edcd62f57a4287cbdc7c5a077262429296dd2e988c73d
SSDEEP 12288:+eBNUbTVO86UtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:+JIUtatr0zAiX90z/F0jsFB3SQkm
TLSH
T1D965CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 afb44581d7f9010e1e0f03fa3c7cf5b09835263809e449e99011952e964cc282
MD5 8994f050b1c5ca75671131d7d7a0b99c
SHA1 ff3ba76bda9b9c37d5fdc83c5f0356a9d519dd33
SHA512 9a427b7000acf1f8902b977e81208dfd25ab69f742b85f74fad1eb7075f46bda3141fc70d86b1ac3d46a80a3fc4535088b880866b237e1a18029659c0563f664
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:+QvGAdlCEL8c/yRNw5CRB2Yyjl
TLSH
T179267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dd335bde5247be638746fbebb60b5088539aaf52dd0c2b233004fc92bdfcfb39
MD5 d624ccb8f819348b50de9e56c9e1365b
SHA1 d1ce3d5c78a8713a49c0d21a941c4aa502c6d359
SHA512 d5483819ef0145a65de2a3d9e4abf6eb6376d63d7abfaa064b2d2827d738c4032e54ab50f8a42e3d788580a4947e87c909b628d3c6cb7389c6f7e721ca99fbb6
SSDEEP 12288:gAwSfxL/2Dc34DLLmt0LDQewsAjnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHD:1dewsAjnatr0zAiX90z/F0jsFB3SQkL
TLSH
T18E75E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 291af5b75dc4babaefb3e8a2a4878d780a30d9072fb315448deba7efc9a1cb66
MD5 a1a26e15b6ef27439c8e6247c804d12a
SHA1 aafb14514b2a0f27e06916f28c3f63d08698973c
SHA512 61bb582f8e2aaa239e2b8fc4f924fa63ea1bf1514051017685ab9f5081e12ba0b264a7e797c540d8063163a87b1cd12869b6fa05139e72c2bf444ad58ae72289
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyZ:6UEtQevvqc2W1cpV2EI320
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dd77968b527458c4bf9b393571e61b31c968871e331ae8fde084787f8259755b
MD5 f0022205bbf167287480938831beab5a
SHA1 fc2b099589cb5d8442050c30d49acd9de272aa09
SHA512 3b2ca1f06a9cc9151e68792270d189a8fb5e83593068115796a4651f50e05321987fe82af9f2f91f7d56c2ceec4256b834f56e523a276d2a42754570578f41c2
SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/zHaB0zj0yjoB2:zoqtVjnmFB2Yyjl
TLSH
T18CD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2aa7eb5a7a25b049a57e78a284462ccfa5c63c1704e868015b81a5024109ca6d
MD5 ec634c5d702744f6dd970dc3f8be149e
SHA1 75ee72acf435fc46eb22cce46bbeb59229c2b8d0
SHA512 3a1ac9b366df25af8d36271beeefcc5c91a07fcfba8aedbc648721fe97f858dcaa00ee333f7fe29f59c3a7b881d52decbb5193e6838fd13667c44b72046f03c0
SSDEEP 24576:NAhGLJIFoiwtA5l7S53iatr0zAiX90z/F0jsFB3SQkd:NAMyFoiq5SaB0zj0yjoB2
TLSH
T177359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 24e631f3564ee5bc4e1aee1ff8c232ce36539eb68ebad532aca52712e88ccf03
MD5 613173be7ce839fd16b1829e20a52bbb
SHA1 45b7b87300cf43c48ed0649ad4108ffc313f1992
SHA512 51ae2f96fc9c232eb71ce2ef2e6089d9f1d213aeae7037e54e5b5bda62a4fac352e0e7754f5dce6fe80ec5fe25131b1df12883d682c04360b4534a3d52305394
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+CWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:kwuoOWjatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1CA65F14A36A90CF9E9A342388547C536E7F2BC112A61DB1F1360CB5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5bf617aa5cf6f6507614655d8ee572d01e760c8a8ed0648185870c44eb97b22c
MD5 2bdaf35cf0a174de61c40525e8ab010c
SHA1 602dcca83a0026a7da9136485f1dd39f8e529615
SHA512 d3c403dbfa565c01e0dffbfbebf58b65b8a33c105f3692776edaede8d5b2220e2d7d98c420f0f2a5e32bfecc4e679d84f485882af9f8372ff34029acecbc437c
SSDEEP 12288:HBZ1Iy3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:hZu0atr0zAiX90z/F0jsFB3SQk+
TLSH
T13255124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 27a8740910c89f52a22af193d90b9ec6df94b29f674377bc8f833e26d8bc6ce2
MD5 ca1205f57ad40b147abe4b6b3ecfb993
SHA1 b67c9f0f4b754caf6ee7a3c2a444552db2564729
SHA512 bfd8a7bc366eba8a5e66af557f7340eb7a21946e5d4251a280326bd046674aeb57d48b0db41e71dde92bb8163793722cef7f1337c93ad789d92419ebf70cb5f9
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:bQRQyi36YOcPQLvw2gAf+PN3QB2Yyjl
TLSH
T111667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 57ba8e955740ceb36008acbdbf313e60e33cf5731166cf958f13f62908a4d405
MD5 340fa5e202eecd6358e63de5f2220bcd
SHA1 1350d96af85baf174606d1ce64ca8b4e2267b6da
SHA512 f606bd249c1c4e0f4978c668d88cbf4202c969f94fa11e8ff14632c989786a877041eb6f19ee04d1586760428c66c4a905117efa46cb8848cff2dece9c885501
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:3QRQyi36YOcPQLvw2gAf+PN3QB2Yyjl
TLSH
T1C0667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d5a89a6773a5cf2b8b50b933d7b33283008c63c7f3b68c25731858385059c40e
MD5 6c1bb9dda84a3c2a541ab7c39e03fe69
SHA1 09946ae59bc18d7947ecd97b2b531756310ed1a2
SHA512 fa6902e91575dff0bd8855793c1c2f42b1c8e32f7d1e62430c876a76bb25d35a44e7f48c62243e9d130f7b8810c58d483cd8e99f17b296a10cf74127eeba4048
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0katr0zAiX90z/FW:K68Qg55nhheWu7PNU3/XaB0zj0yjoB2
TLSH
T115B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8111720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e59ed622099ece051ab2c702283f614bc8cbeb442b77a37e9a9e93235ede9bef
MD5 1ece6df0d768d4ee01d1ef37202459dd
SHA1 05350a727692c3a2dbb5797437848daf6df2f251
SHA512 211f85d994b654f23d2f2be7f94bb14c526d5b728851b85146a69608500fe28aaa93a7bff3f74de892a4d159c4e30a1592636dd105400e4ce127d0ccc7fbef35
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99J:Hy5112gYy5azzVvL69nLKnhZPB2Yyjl
TLSH
T198167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e89b2471388dcfed1be674dabb1362e1153ec413a963f8ace756300549f3872b
MD5 407851ed32a196b889067c7b5343cdb9
SHA1 0b52f1e76130844f8fac7be5eb75e1860dabe38f
SHA512 92dba0c9bb9b2f25c35a965939a1768529f3a7d56c1b4bb6645f880a90d67b34ce31a3bd06c6e58234970c55d15c7518a02d5b19073ebf47239aef115db3b9ff
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmaB0zj0yjoB2:pu6JmVxd2dxB2Yyjl
TLSH
T18ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5f78e320ee415b2e2df2c6b9f1b48096c8a16e9e636e3a6c8f2e11ad0f63a106
MD5 5c080c21ecc9875bf36d0f1e8eb5fc3c
SHA1 642fdfe786e863a9646d57417575678290b9302c
SHA512 34b528d637ba01844f824f8421d427914389881c9c95ff612aa855b4944816ebd0e4f48684aa89655ecf5d19cab10011b4d306619d3a21bf81aea5f354b8b24e
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xNaB0zj0yjoB2:kmifPbRFB2Yyjl
TLSH
T14CB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6d44c0cbb3185451cdcbb64568683fdcd73240418f25e691e5c8f5b7712ea5a8
MD5 a9e7122f7b6084e79e52cd8c6daa1eb3
SHA1 65059f4620b4cfdb507cada7e913f369cf3b1eb1
SHA512 5d35d5781d6d497739f5df981cf61d8fd201696a85003a8f057f737052fdae11553a7821661c53cdd24c770b982d56ea1bd3df5a70d6e15f2574bd6d33a2ce8b
SSDEEP 49152:kSuZQIY0Be2KRRVtOnks6NMHq0aB0zj0yjoB2:25dKTi61rB2Yyjl
TLSH
T1E0C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0b82ab18e513b7d91a9641c78c3e53c153f03d44164c19d1045ecd1915490b64
MD5 1bc6281e8189aa796ce788d50ccca273
SHA1 d3d959affba26237545fe4445f4032fe79b35e61
SHA512 65317e8a8b526a2753a4c13dbe35a60a1fd2124115e0b5311fd9dc22a576e754482122c463214259c2d4c8732584811f759c1d39de4eb00a016f12a0332cb87d
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5whaB0zj0yjoB2:PX2iyphJB2Yyjl
TLSH
T14495BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fb054f35a92ff1279b3774a8ba9c6be8f78f18b663909aff11d5453f20081f14
MD5 13339afa89afbd195b6c255e0558bcf6
SHA1 41dd602721e7845f0236be042efd263b313e4a97
SHA512 c029fa5d8123e61d4ba589470180a538abf7531815bc332868701d75ed51fed17590e4b958658ea386f74e24e78a9d48492ab0d52edb7a3939da2420ff6d9ce2
SSDEEP 12288:84UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:84atr0zAiX90z/F0jsFB3SQkq
TLSH
T14C45230B341F80F3C8C31B355684984B5AB95EB4B2E36B85B2953F0FDE382C616656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b2979e9edac745a9f8a5ce48b82c4bd79789c1f5a13c0f3fbea2249b72605074
MD5 123b2fac375f07984b38aa2f5c5295c0
SHA1 28cef4e2cfc1655c9b240882f0ec97f41595cf02
SHA512 a006fc4ba1ab091b9504ef594acdb4aa252fe4c63e16ef084cbd22fa3fda9f60c7aba0da0e8703494faefe340f6e6305c8887a43d2f4f6c147bcd6246715b65a
SSDEEP 12288:ubUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:ubatr0zAiX90z/F0jsFB3SQkC
TLSH
T1EE45230B341F80F3C8831B355684984B5A795FB472E3AB85B2953F0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 606f7d68abb0c906ac7877c0b9c501e74ff73df4f3e066b8d138b09181f38c68
MD5 db9388270b5944ba35b0f879c0fecdac
SHA1 33903c7e04c558c72101552d1fe176807298d415
SHA512 78a5bf498cc6443d8c75e571f1cb6f77cdb7cb3c9b9ab22d9f58812da3bb5624ced08add6805bb1964127a988bb6c4169751708790704cc0edc1ce7f2ee2a65a
SSDEEP 12288:uVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:uVatr0zAiX90z/F0jsFB3SQk1
TLSH
T14A45230B341F80F3C8C31B355244984B5AB95EB476E3AB85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 71e007f80e2bfe2e18fa0e3854be6075b9e36f1af71868efad8019d375615d75
MD5 e84c4d594a8625e584d048b0248942c6
SHA1 783aea7bc94e184d50e6cb880e1b7329d78bcfe7
SHA512 e2956018a7017f1938bce03115488b764c3038aa84d6aeccf4310e0dc0aa45ed4d0415854f19ddfbbaf94eb921a1a1425c0ea391d6d89c4346b38db8da6d4ca7
SSDEEP 12288:rVCUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:Eatr0zAiX90z/F0jsFB3SQkO
TLSH
T1A945230B351F40F2C89397358694884696B9BDB0A3F3AB9FA2413E4F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1106c83117fd5fb06da79eb0bf290d41cfa29c6a92a27ce661f1565f444bafd8
MD5 1f570cbd6a2a7cb2fca6236382754046
SHA1 1586294406d9ded55abbe47bf5286c30597a1351
SHA512 223ee6a627beaed5e8d31fdc07a917e6e89d0db77d2b0616a87fbf229a668cd27491cc0ec769a6d269637bf6bd873b89e11a3570d723b31e21ea82656d690493
SSDEEP 12288:v6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:v6atr0zAiX90z/F0jsFB3SQkA
TLSH
T12F45230B381F80F3C8831B355644988B5AB95EB472E36B85F2D53F0F9E3C2C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6c311e0794163a696b99667706f3982efc86ffd3264339c563fa7fa396322b44
MD5 30fa682f8c781623f84a200aa4dd7f88
SHA1 8d10c5015e2e91a80df663cf7c2a22dbd544a2c5
SHA512 8f77e56d5c2ec3248101025aa1417f55c6a38fa3a589ad700145d2d7b8f2b1edd2c42fb72f7f55242b8263126ce681063d0590fe79baa7ecac0abbff633a1b44
SSDEEP 12288:RPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:RPatr0zAiX90z/F0jsFB3SQkA
TLSH
T15745230B381F80F3C8831B355684984B5A795FB476E3AB85B2913F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ca5a72644efeab50f6cb8f2cda1f4acbca4a44d29872cc80d9d0f5c3f99b4070
MD5 b9ec8db4356e2c7fc23a7599fc1e736b
SHA1 eb1550c7eebf1c4e452556433965e4933508b612
SHA512 7ccb04dfe654a6c2124e9c806a268bf9d69762ba22fa1d68c99a50f4d42568becb7de1b7ceb2d640666eb373fddc8fcaa5d9d35ae960f61ee2455cb0b4264ad5
SSDEEP 12288:UTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:UTatr0zAiX90z/F0jsFB3SQkL
TLSH
T10B45230B381F80F3C88317355644984B4AB95FB4B6E3AB85F2957F0FEE382C625256D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c779f913ec99238b4adc40bfc6c62c280b4096e4db3495ec9e48f9826d9ae9a3
MD5 df8f8998a151678fdaef34eb3ee029a7
SHA1 7c7d29305c30be6b13d998fcd043407c7f350514
SHA512 1376b911ae0fb6ef19232971dd7e13c4787dab179099be5b084d9850bb1ba9382afe79bd884577b32c59d927c7353445667204ccb5bbde42a7effad9777cb901
SSDEEP 24576:lZMSzFVSO7atr0zAiX90z/F0jsFB3SQkx:lZMSzffaB0zj0yjoB2
TLSH
T1D865019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ac4b0fbc132692fe1b5f7a3bafc4aca1448a9fc9b166a2ee4bd49863665be00c
MD5 33a0e63a48ebef6cde361b13a1f7bee2
SHA1 3859669f1fa7941ed0d8400fec2b339f19b63be9
SHA512 efce9f7ed10b5768fb0e61dcd18115e6fb79fa123fb2f6632498792dc1264add1173180519f27bc5feb1a18506343641f7c9273005bb56bf8c3c6c05f2799b6e
SSDEEP 12288:DEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:DEatr0zAiX90z/F0jsFB3SQkc
TLSH
T15845230B341F80F3C8831B355684984B5AB95EB472E3AB85F2963F0FDE3C2C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 70f4b2224da158705b83adbbc37ee59adfe3651d93176402688cadc8da7abef0
MD5 827d3e69cc67e38879d89f5fd11dcca6
SHA1 20defd83d7f232942ab3e2b5dfa42a0f55d53323
SHA512 30fd12bb477e7cd8c17618d36a29c12ebac7a2c2d712e8b1b1fe0d7587a7ea9fc7150074c12652de368d355644ba2e856e4c43ca5e85352f0daa7ebf0438edda
SSDEEP 12288:rAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:rAatr0zAiX90z/F0jsFB3SQkc
TLSH
T15D45230B341F80F3C88317355684984B5AB95FB4B2E3AB85F2953F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d58656679b41754c63e006d7f661e4cb57a8bfaeffd7b02adad2bee17777b109
MD5 1306caf39b7a1c88a873c6d8e27398da
SHA1 75159ed2eab7ab4dfb5b6f5733de30445d741057
SHA512 8802a45de0ed4e34984faa1d60adc5b3c73c0bcb857760992dd5a83944c271dc9e4e831cfbdc4e4ac87d1aa1ac18eb0e02d77b22467b6c11c7173d70252d62d0
SSDEEP 12288:3yPz5L83UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:6zy3atr0zAiX90z/F0jsFB3SQk+
TLSH
T17E551207326620F9C4639238C9911D06F776B83117A19F9F53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c1d68b3823156fa5479a728d1ef5697f7ddeccc30faffe3392fc1b53696c7041
MD5 f0cb16cce6a8c9a14bafbb5ed13e4076
SHA1 10dde6b7f13f832428bc6f0426bbcff02581de46
SHA512 ef4b6ec208ef26878a1470bc6d72fcaa0599d65734054a1a1ae3cdf275fd168cf9c83ea995cb3f2862ab01c30975bde030337010060b650d1d1d7a189d26d8d9
SSDEEP 12288:LEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:LEatr0zAiX90z/F0jsFB3SQkA
TLSH
T14845230B341F80F3C8831B355644984B5AB95EB472E3AB85F2953F0FDE3C2C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2a6df5bc844d0c8dedcac7a44e94af9c1165a6ee52c064c76b27c2780e984f89
MD5 223b2153d1170d84e7df01ab38f6b6b7
SHA1 d9ed43df77558fca81221afe975f1485c625ade9
SHA512 ff136b3570a550ce95b5347a95a24673ba9482f39d60fc57acac9bc966aab3fbcc3a182df912acdd6fe4afcf4c032dd37695c0a1b14b02eb7beba08f5a6ce58f
SSDEEP 12288:AEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:AEatr0zAiX90z/F0jsFB3SQkA
TLSH
T1BC45230B341F80F3C8831B355644984B5AB95EB472E3AB85F2963F0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b8c3eb5a2bd59915a3ea5c3c421c086c46b228613ca06535f7edff8fbce3c1b5
MD5 8f3c78780c10aab2c44d734ccb749ebe
SHA1 5bb18037369a5a88807b7a7dedfd1827c9cb095a
SHA512 419fa9c6e7e94d0aed13d26dbcaf4ced5204b0b1d8eb0e7114170d6ae7d62017c1cf4680f05e83e620a7bb04e09cbe931ee71228bbc58e385014e2b9a72603e7
SSDEEP 12288:ByPz5L83UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:Qzy3atr0zAiX90z/F0jsFB3SQkG
TLSH
T1FC551207326620F9C4639238C9911D06F775B83117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 020fab7443a0e44d74783d513e2e63399de4e49285b68d5fc070107b4f03fb43
MD5 6e149b975242867dce96c54882eef94b
SHA1 b650f32541775e8cfa19b8685067938afe9b9632
SHA512 6e054cf81d58305e7a24e9d66ee873efbce8530b49fd087a940915d68a30cb0222568a443de457e5659c6c55a7015ae5649fe95fe02f493950b4404fb9cda28e
SSDEEP 24576:yTHaLl3z0zDFatr0zAiX90z/F0jsFB3SQkT:yT6Llj2aB0zj0yjoB2
TLSH
T12C650199735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 fb412f7add805de6c5a8ac533e35ad3d5ea1c47a12786ecbebb2dc500224e6b1
MD5 bf6bcf55f06b573f839cc5fa71ca9e3d
SHA1 e441c8a848dd38ad00729fdabe61059639e25593
SHA512 6afaf72d367ce25a528dd896e8641d7e774cc893ddda245eb2a0c82fa863a153566e96163d3f344760b53010a7ce2394b5195d39afd8b7fd32c7fc042df0b8fd
SSDEEP 24576:Y37d9CHKy7GZpatr0zAiX90z/F0jsFB3SQkL:i7d9CHKyafaB0zj0yjoB2
TLSH
T1A175CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7b032ed9407bb4062b26afb12b6d2d3487e1eaad16d5d373e8845ef359bdde9f
MD5 97584bd01eb8d6b0c5e6e019020cd763
SHA1 2124cd2b4d153a61e4ffc708be28b0876fa8d7b8
SHA512 fc2a543193d4581dd2aba6ea48a10525a29b39bfbf9123081fbcdc422ee3e7ee7f0aad547f8dad55cdad0e1d8e8019dd8fbbfcc8c671caa95ee4190406eb8bd3
SSDEEP 12288:Z1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:Z1atr0zAiX90z/F0jsFB3SQk/
TLSH
T18245230B341F80F3C8831B355244984B5AB95EB476E3AB85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5e9b52a8bca82aff95fa221ab4a4cfff0863753facf2608aa382159fa1c2969c
MD5 d51f052b74b9a2baec77abe8257f374e
SHA1 6f76ea1a07514033724b9ec300f34d5bc9d2f029
SHA512 ac2181f9f1acdd0a0de6af2eb30f27fcea09ad879a509774071a270d1fe77319f2f92046e94c16eb51991d5ba437d98dbd8a03c47fd6a291a0cb0e887af4ec4d
SSDEEP 12288:aXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:aXatr0zAiX90z/F0jsFB3SQkY
TLSH
T17F45230B381F80F3C88317755688984B5AB95FB4B2E3AB85F2D13E0F9E3C1C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 996402e31dd3d3a8957ce72f85b08475967ee48d05bc73e18ae5364112d8a005
MD5 03432a6469e7ccf379e89bbff4f7814f
SHA1 fbee50e708e0bda9b6c0cabb45180108493a1b9a
SHA512 569ce93e821a8510bc08b90edf1d2819706346e57c1167e0a91c253468344e6b02f582666a94ad8cf3dfd03afa42b84131a3867f8fb4563c46c6c57767b4baa4
SSDEEP 12288:wuUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:wuatr0zAiX90z/F0jsFB3SQkE
TLSH
T1CB45230B341F80F3C8C31B355644984B5AB95EB472D3AB86F2963F0F9E3C2C626655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 49f7a479eb578a3bce58b3e3d2eaf4f82928c1e32b7da1774a51a18d07381064
MD5 8b7bd7d255743ae910ad9aea75b5de79
SHA1 cbee02d9d03144dcee03902ae745b14124bf4571
SHA512 d509d57e9f9dcd871ca56ad3fa9c7c922629c28f97f9115d1602a930294c3294a471025c9554238f52734006c207755b09c15ec04c336c6903b5ddbf159b2782
SSDEEP 12288:0EUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:0Eatr0zAiX90z/F0jsFB3SQkK
TLSH
T14945230B341F80F3C8831B355644984B5AB95EB472E3AB85F2963F0FDE3C2C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3094d0a3f4bb0ddb0ded6e7c0fe7e21b8417c091c263f3a2da76b3013567d77e
MD5 bd07379f4758d3a138a21b021decf54c
SHA1 1cc607dce64e2e5b00ab4157ce715143a88abef0
SHA512 4e7ce9f8fa1fb76b998dafaaf50982f567ec2177423874c2ce7562cf63dd6d11d2f6db951c3bf8158e22d13721e95f62547e75961325f3164a8c3a2e755e06a2
SSDEEP 12288:S1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:S1atr0zAiX90z/F0jsFB3SQk1
TLSH
T1C245230B341F80F3C8831B355644988B5AB95EB472E3AB85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 17261a86aa07fc3b703d6900822d96e8ce2bcaeeee7ada378f75caf448aff321
MD5 ae2c454e36b0eb0d9b65b0424c0fea94
SHA1 eeaadbb3ef8d715466e91afb6b9daf8e0c5f3dcd
SHA512 5af3b15bd81b263c3f58d16ca1192c2ddc857c9bbfaab3ec390425aef337b02afe9a519488e2732aa04e34c3e9ad80a3a3113a885bbba8ceaaec60ad242ec04f
SSDEEP 12288:Y8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:Y8atr0zAiX90z/F0jsFB3SQkB
TLSH
T1BD45230B381F41F2C8831B755684984B4AB95FB472E3AB85F2923F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-09_165435_828-1048.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-09_165435_828-1048.log
Size 1KB
SHA256 da0172295a721d73ded984f04987d7e2791a8140d3aa33bdaa9abd0b2144a5fd
MD5 7f7a05ec23e3f7f3ccb8ba5d473a8210
SHA1 db5743f54eaa3f5aae098e80b19374c4025416a2
SHA512 ff8755cf284dbc690a9329016194abb9b162c365412665bb63612bd9b2df8fa7c885047060cb9371797da2b73b9261a7c296e6f1adb7186478a18dfac40eb83b
TLSH
T1A121B4492BD40A46FEFBDDC1D8FA11439E3538526835C95C04A1938E0832F41EE74323
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 863d1778a9faa6d7bbe225912dcbd46566901efc2744746336be45dddaab6625
MD5 76b442abd0d47ddc70b52648d3ede32f
SHA1 80648fa1231df79d70e38980d8126d0586850576
SHA512 ed778eaf2fa23954add331b5e1bd7e6b9a58413b4754163e164f7a410a2e5be8d1af8fc01d3c35719414d7edc3d7fc92216ea4b4d65c950681daf60bb71062b8
SSDEEP 24576:Lfwvok9RX6wkyAIQatr0zAiX90z/F0jsFB3SQkg:tMnYIQaB0zj0yjoB2
TLSH
T1DF85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3ba286d6b4048d4a106d5ae4130460625f61f0e3857b0783cc5874efeb14a2ce
MD5 7070fb15a1aa26574534ca92f6a4268f
SHA1 a495e04421f57da1fd5bc39e34701f13fe23fc79
SHA512 7730352e4d681162c63fd8074d98e7cb8f637d8a3d4f90c43e753d75e78e019b58044cfc6d3af0245e1d630efb81095dc0b7eda5237aa7aec7c5334edddb13ed
SSDEEP 49152:4YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BaB0zj0yjoB2:GySzPwB2Yyjl
TLSH
T15F066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 830aa93c07714c960766c3890f4353198e71d65e16506a474687113cd4f9faa5
MD5 40620fd5dd58600e8cd01575c38cfec5
SHA1 1bd9ca3806f31b50b03b2f4c4d35ad0cad90025a
SHA512 4e626fdbad4fbccd6ea84bbc07db66b189ee4a988180a2b41fe5c3ae7299e00e8fc136fc3bc4c301e0ed46805ec7784725f2a093d76c3cb645a8800d8958158b
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYLatr0zAiX90z/F0jsFB3SQk3:+47JUQj1irIhCnDHUPfF/RaB0zj0yjos
TLSH
T17C65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c587491339e45c06be72007741a228559bbfa83834bbdb16f14c7264e5dac2d6
MD5 32edd5a1ca56eaf10fdee97eb21ce692
SHA1 6df0b8e021d7d706d8dc1de12acb3b5868643f00
SHA512 4a00faf157d4ab43d425e46140ca30ae41bc99dfd058341529c47a894984a543f95619d4aa8587e3e1160c4c7abc10a8e19bea567a45a4aa93c595aee989894f
SSDEEP 12288:6Nsf0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:z0atr0zAiX90z/F0jsFB3SQkT
TLSH
T12B55F00AE25801E5C4AE6239C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8335cf5eff119c3fb3a62267dabc836fd5ae9beed23f49a8c2008a1bf22df299
MD5 73743773fbd0d5635375bce7c332d434
SHA1 baa08b698b879c88fa0a93ea050c5dd7f0f128ad
SHA512 250507482e2fd428e3bc21936b9851daf8da678e5442be285188adb770314edec774e93604cf2c4c48e4dd43b556b20e50e1a153a9e1844486f8c78195f29022
SSDEEP 12288:Xjyh7y5ge2HANO9HGOQRhOfGj7q8mK7XZQ:Xu7I6JhGxRQfGj7qlK7XZQ
TLSH
T1D8453950762AD75FC6A940325E33D2CCAB707D05EE056B0772C8873FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c0a12db4ae1b1def85ea8e82d87080049020e156daf8ccfe1e5f517bcd8dc7b9
MD5 0a23423c964e7f036f3758ca760cd4ad
SHA1 f5d4dddad228e778ec3dd3e4e73e5d0e46df4487
SHA512 9dd7ef505ac967e3006f9914ab8ee955d05a81257411a57cf62b28e3c45f1f9a27bf630458b1d9b58822915bfd54590ff7bfd4c031d00b00f5ba7d02a98414fd
SSDEEP 6144:q7HZhqgRF8pR4XI1II1AE8sKXGeuqBKDexHSTWu2BKDexHTnBN5QoH6Vt+Ylxri4:khqgRF8pR4Jceuq5u2bn1wt+YXiPCL
TLSH
T1D265E881A137E38FD1F76032072A9B4DA764EC07B7056F2673C8457AD86A756B0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3e23d1e367c8cad0ff8ba3e0a5d975e5940b2f848b924e76321416d41fbe0809
MD5 bbf0a091d7eff126c271563153b19036
SHA1 91356dc41bcca56c6b0b8858ea6f645dc7d7cabe
SHA512 8c669eed0ba0a66ba0ae755e2b992da00184bf3e8f9fedad7f1eea9fd2323fff2aa2925eb2f28ad3154c41f5c95954fd266c616b3f4c8c0254718971dc246dfb
SSDEEP 12288:IM7sUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:Jsatr0zAiX90z/F0jsFB3SQkE
TLSH
T1EF452307351E80F2DCA32B3416588806267EBA746BD29AC7F1413F4FAD386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fc562ac6789ec33e8aa484b8161b05a025725b3e0d7d752b30b0df3351a4beae
MD5 08a4afc82db33ad3d30fc3a2ff350d49
SHA1 42ebf17755f70975867add55ba1a9da3b2d4bf40
SHA512 c81ba466990ca5c84a72dbd7ffddb5f500a2e602c2ca35834f69405805fdf2fb3991e25b10c809b12668be16009ff6a098e14a57fc2a68fbd9fb1ca6e9245a87
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bY2atr0zAiX90z/F0jsFB3SQkZ:cgb4mBIBhGFLaB0zj0yjoB2
TLSH
T1A665AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7264757a3cce806a51a305c67bbc79b0d6bcafc438aab5ffe9bb877c87f1ee6d
MD5 5343d2488bba81dd33e8c7a3dd27c05c
SHA1 f831b2210fbf81476c18dafd3e1ad5fa75c71931
SHA512 631ab5ea51b7c54514f5da0522c89167f68de544fffbcfe581202e695101c55971239364d3d8fb1de13b9f03e44249bdcce61838b7774a7de593087a3362a68e
SSDEEP 24576:nG88u8FpJqH1bzria7/m7atr0zAiX90z/F0jsFB3SQkV:G7ZFPqVea7/OaB0zj0yjoB2
TLSH
T12185016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 eb525b7bbf3e89317d429562c538c585d97047646fe2ab8bd24ef4b090774089
MD5 1d49c1d22008ec22d9d9aaa65b86d52b
SHA1 3aab4d62d9fa6fdd67d0c39f533c75e8f423b4a3
SHA512 9e0b0ffde8fa085e687a915f31cb458c08b844a47861343b76ea83d6e041b2e58d5d4bd112e425b38554f98cecb1b39fb9c113c516e55124f95d4511eff21670
SSDEEP 12288:JHvUrBFrEjwaQfUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:JPUr+NQfatr0zAiX90z/F0jsFB3SQkN
TLSH
T15665F11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c46048b22f3728f7ec3292cc2055e138c4992f8a3cfd3184c4401c43fbcfccd1
MD5 69415f962513b529f797ada02542337e
SHA1 d1168a06ba9d7fa62c7e6f853f3b4b6e74c12696
SHA512 635f95325f50c1915302007acb63a5a8f71a56fe41f5ef303b5b775c1ed99887f8340a5fc03b391eda609c2172440a9a96a49d6a2d6b0d34a857a424ec28ec82
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPaB0zj0yjoB2:9G05lO43bHB2Yyjl
TLSH
T14CD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1b63affc81f07bd0df17ac3d174d805444588b3b192ae5a6e2cc922fda573e27
MD5 e039f64f5591041018fbe4ba320a68f4
SHA1 666dc358d7115101df0425682db1cf9f9e4c1d7e
SHA512 fb343f776b842b48c1e7f27e82f044076d697fcb80d181411beef329e8484c682fe0a00adc5d237c85018a8f38da382e1ace221f7131d68b92ee72d06be9c020
SSDEEP 24576:Dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnBatr0zAiX90z/F0jsFB3SQka:7a5POZ3+Jt2pasx2+mXaB0zj0yjoB2
TLSH
T12965BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f1d57f07f798f320ceb86ed6a226fdab92264040a20d04646c56013ab7feb837
MD5 5c9202c6f17a50b808489a67e22b039e
SHA1 2b28ae563146602e02fb2166f90421cacd923a5a
SHA512 40c76dee197a9767cb5ea9929cfbce46ee128a3049e035771e7e4d83a25c0309456050f954e14f7f85d6d34e986581dc11f70cd5a53579ad17a4f3115430ec3a
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkDatr0zAiX90z/F0jsFB3SQky:+Nc/zEOVHFuaB0zj0yjoB2
TLSH
T1E3858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fc8e47ab1c38afe78ef8c21c6648eb04dfbbeecea3fb85a152bc202e58635515
MD5 a651efc7625d9e5d44c11a33226d98dd
SHA1 2671041c0b8a6117e400037fde613769ca8e53ea
SHA512 59564e52875b70cb728b4b8ebe51e631623365aa6d46e60e5dddd9cffc8e3f702b3b9b804fbc23ac80339295226d06851bfeb91188ea9c9f1aa97319b3d9a26a
SSDEEP 24576:b8kNvNnaFeYhJNtmZBmSatr0zAiX90z/F0jsFB3SQkL:b8MwBtOmSaB0zj0yjoB2
TLSH
T18C55BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 05a4c0d79a0743da80c09467c541e8f5378703da7f84910ab1796bb2a940642b
MD5 781e57bd599e6384aa95c7d1e1f18b8d
SHA1 6aa1011bbe1f802b7e2afeb57fc56629e05673d3
SHA512 60ba43c33ee4afb388b5059eea4b95ae3482a8ee79250527559518ee129f19a17eef6478a4069ede1fcf9ecf554a37d23b4749a26301797df60e40ad7a184682
SSDEEP 24576:jD3FHshBIYQgAYatr0zAiX90z/F0jsFB3SQkj:jDVHeBIAAYaB0zj0yjoB2
TLSH
T17A75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-128-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/528-129-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/528-121-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/528-321-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/828-29-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/828-33-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/828-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/828-0-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/828-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/828-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/912-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/912-158-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/912-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/912-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1208-59-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1208-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1208-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1208-49-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1208-55-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1536-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1536-322-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1536-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1536-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1536-115-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1536-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3292-287-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3292-70-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3292-64-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3292-69-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3668-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3668-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3668-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3668-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4340-15-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4340-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4340-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4340-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4656-76-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4656-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4656-82-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4656-74-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5052-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5052-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5052-337-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5052-103-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5052-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5052-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5276-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5276-143-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5276-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5276-141-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5276-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6024-318-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6024-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6024-87-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/6024-92-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download