7f321d09f62bb1b7103b784bc2bb30f9db0654199e9409cb05a70b70546f20b5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260809-vjm8qascpg
SHA256 7f321d09f62bb1b7103b784bc2bb30f9db0654199e9409cb05a70b70546f20b5
MD5 341e9477539a4f93393c0e5d8eb64403
SHA1 22714e6f0a1b9dd6afd184913ad4edaf2a1d6abf
SHA512 a131ad36e2974dd7bf832f3bc39d9fd469d3bf7850866a0ca5ee83f07d2d78f2a064da96b85ab78efee995d2a3a1582ad0f377e5bf9c5e506b6047414e57c4b0
SSDEEP 49152:tbGegVwcsiC1eV74jsNf4Vqy88MJWGU+oC+pbNcBvBkAhhKa4FiTzEJjBoLNiXif:Roni1Ry9qo7wRGpj3
TLSH
T120168B07E7B940E4C4BAD13D8A969657FAB27849873197CB43A0871A5F237F09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1760	elevation_service.exe
5076	elevation_service.exe
1880	maintenanceservice.exe
4144	OSE.EXE
240	PerceptionSimulationService.exe
3088	perfhost.exe
6116	ReFsDedupSvc.exe
5660	SensorDataService.exe
2276	ssh-agent.exe
6072	AgentService.exe
2868	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f658bddde62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcf267032128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2aa90c32028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ae384032128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001058a2c02028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e44b3dc32028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1760	elevation_service.exe
1760	elevation_service.exe
1760	elevation_service.exe
1760	elevation_service.exe
1760	elevation_service.exe
1760	elevation_service.exe
1760	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3168	2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1760	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6072	AgentService.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: 33	2868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeDebugPrivilege	1760	elevation_service.exe
Token: SeDebugPrivilege	5076	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2600	2868	SearchIndexer.exe	100
PID 2868 wrote to memory of 5460	2868	SearchIndexer.exe	101
PID 2868 wrote to memory of 5576	2868	SearchIndexer.exe	102
PID 2868 wrote to memory of 5128	2868	SearchIndexer.exe	103
PID 2868 wrote to memory of 5564	2868	SearchIndexer.exe	105
PID 2868 wrote to memory of 5336	2868	SearchIndexer.exe	106
PID 2868 wrote to memory of 984	2868	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3088

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5660

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6072

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2776 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2776 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a3eceeac7105f216a1808170033f6fe9ee0e53a02f9a42d893a375216b71e3d7
MD5 87bc5d5aa90bf852b2fd70a888e7e8f9
SHA1 2c4fed72e4db1bb308a7898db6c48bb2e29b21a6
SHA512 943a552c77ca061e345c9486235f0093c34f057bce1989be1c57956e0fcc280a142ada2890c9a01fb71e8219926e291c92039ae2185598adf2ff5dd7f0d5892b
SSDEEP 49152:Sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnOLNiXicJFFRGNzj3:03q6mjBZ7wRGpj3
TLSH
T1A1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 580b12b390a717b3f228653c7bdeb5a0c5e5c08a39b89915e9bc5fee1a1284cc
MD5 ce3aaa30b979ec329f152ba80c2ec094
SHA1 0cf38dbee2f5e7bcc60f153fcfeff506c0376ee1
SHA512 73d15f4aeba17e28d203b340798cad0f348b6b535a9ad2b2db66e26338228aad7206540b9863d13f44bac02cf9adeb8c062c006bf6c93718d1c6c2fd1867f49b
SSDEEP 24576:bXYfDtczAd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+tcMLNiXicJFFRGNzj3
TLSH
T1C875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d5fa518ad473f071276943323f6214e12e3df3beb0b3ded90b9aa00935eca99c
MD5 796a2c346a1a84cc0428bf095784c13a
SHA1 1106b095e4751ecd4850f597700255487e5a888e
SHA512 1d353757415288781114393f3f1aacb8a281edaf5e5404a0814a15bb21d96f27787f3f5e460b8d3738957b8b9d07434392cc338b4972632782abb916d0166e53
SSDEEP 24576:Q0Le5ji0hmxhrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QPji0Az3LNiXicJFFRGNzj3
TLSH
T16B859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3f292b57a8bab129fc54ae404a99ea9fe3b44ec1fe22644c9c9416f8535c34d2
MD5 552c122bb1d19883326d236474438450
SHA1 4043d72fb2f76985e3ce586fe02a3fcc7997c3b4
SHA512 80df326423f0c8999ac2df107c65adfb724bc2e9bbe80a590112d1bf8b1703761486e7532075b3ff72dc8307b6c6951d99f80ef46e172456d346c6b5e98f51c5
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWj6q8wyu8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q/ezSC6vUzPv+HjyrLNiXicJFFRGNzj3
TLSH
T1B6756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3fbe0f66912e541a43170c2b055a567bbcd1691e67b9726b15ea31283ca224ce
MD5 9203cd190f1da30ed4e938df6df01dd1
SHA1 2d76269482f73de9806232e4c147419726055392
SHA512 2c9ba5de94e74fab918e3ffc7555cb2eaa64a97a0709ca6aac56cd37841af7ac6899e891f9da8dd0d4f8733c1652f09afd76472ef915f06909642c4a3994473a
SSDEEP 24576:CVbqPb88hv/l+BJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CVO88hXl+XLNiXicJFFRGNzj3
TLSH
T1CF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5e96c5c361e46ad6899d0a213e577edf7384c4d5fc18c2bc389b9aa3e2b6222c
MD5 1c51b3754a87e40af96317b4f586035b
SHA1 c1c434d9a953cce38d937a85f069c6ff5b31045e
SHA512 2b2e7f5e2c6a0eaa5378988a67268bbf21d9f7d2fbf0022decd29c9b7dfdacd78a17226b27123bad3b7c92bd181c91bfca617b2bb20e7074b40be7a20ab6a7fe
SSDEEP 24576:yGi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sLNiXicJFFRGNzj3
TLSH
T11F5523D3468855B1FBFD003A867A5828B5845E2CCA595DE2D2543E5E913CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2b40608e0e264f534493ca190514d36ade7f1c1ed4267e52892ef6589a8ebd6b
MD5 de9d5283d1dbe79fdab44cce914b8672
SHA1 fe90f1f397598bd3b995cac1cb645cca6aecc78c
SHA512 9a355bc04cd507315028332608c920b5b06a992f039c9b51b072a0ec3c9395a6e0fd52aa978588b4aa86838b8f42f65b962bef9a41280667c3c197dd9df4380c
SSDEEP 24576:iJIUR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJIURLNiXicJFFRGNzj3
TLSH
T16C75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c01bce045ddec6739db392f6758e59477eb9322074bc0488a472ecc6ef2c8ac8
MD5 3719a439bf194efb809a6034244eb6c2
SHA1 4b1c004e8d0c73921a57161c92ea48f2fe117016
SHA512 b0f7a2cde383203e9d687793e809bed3c6d8b907d32c134c36c402bceaa756f49c4b25539430553933da3a754511858bbb4f0c3c2c4e777cd89c31eda431f9c5
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THR:PQvGAdlCEL8c/WRNw5Cs7wRGpj3
TLSH
T152266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7164306a5af5d134fd54c02bf6a91ffdc574c9627e6d4a09b93ea02c6af911cc
MD5 eb8722736356cbab58b4e494dc10d346
SHA1 8d0bb3811d9b3a2127a12b8df2230d053462f629
SHA512 e4bd3af7a6aed0d7c3ba241005362587c9f5d796ac5d9b12d3e2cb6577363822ca776d2f21de18a63f553a643aaccfdcd3814225f62362b332ade520798d35c0
SSDEEP 24576:0fewsAjn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GljnLNiXicJFFRGNzj3
TLSH
T10F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1102985562b6e363ca637f589794d6bfe48dc242b448f952c8288e742efc721d
MD5 f6bda0d141f3c3971d5f1610e0254532
SHA1 2fb0aadcc34cd33e293ddf2c4f6b8c34c4ed7bdf
SHA512 93a1791f2022d39e5bfb2120a4bc681671b2a1848550b099a197d31b2669a53f965932651cfcd0d63354a27ed8a2e610c944b9f33add00d02b542336968a9cd9
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjF9:eUEtQevvqc2W1cpV20I32B9
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 957cfeaea252fc9b1eed1a256f53ec0e0e5426ff795dfaf1ef7b01eecbcf6c47
MD5 85517ff97632681f61a5ed9e2a94f7ae
SHA1 a188cfee94b5eeeee59bf2468688f01e489206d8
SHA512 01dccc7f9ec06e6b3c19c1ac8a61066b07bc7e942489c61d2a350bcfd470f9dfd49f821f078e646f07d9e539c7213e4c4101178b3a37c9f615894a6ee3793480
SSDEEP 49152:UCbRquA/m2yL5zLfFiV+XenmE3/zHLNiXicJFFRGNzj3:9oq2Vjnmg7wRGpj3
TLSH
T127D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b7f2b649e119569b2ec93e6f9cdbe83517a16bbf824747954281d0652717c551
MD5 8c33b307af5dc09ee1f36c45cb17982b
SHA1 f4cd8ba2f77a3b9895eb3dfee8797adddf3dd91a
SHA512 141b025dede6490a0502ba100424857ba784b8897aea622a1f5720ac96149e5a735b2746dd6540a8779cf6777e83e62164c3f7f99c9ffb15cb6cd131455cfc63
SSDEEP 24576:nAhGL6IFoiwtA5l7S53A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nAM5Foiq5QLNiXicJFFRGNzj3
TLSH
T1B7359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 31e5f12d52337dc85f257c8b2e4bfa20786d85734d6c0461ea216f2a7e6a12dc
MD5 89f84adfe703d40811b4da7a9863caef
SHA1 379f0753d0990960cc1d392bdf2352c1a0828536
SHA512 958035080238d469bad93d4243c5a48a28b4060d44887dda61575e7cc0ad91b3ac542549605d5e54691075c1564bb5182b496f11dbc8085d71c7dc3cc9f7425a
SSDEEP 24576:EwuROWL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EwSOELNiXicJFFRGNzj3
TLSH
T1A365F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 85968da9a59e34f4ee52386fd00ab5aef8d9e5a36f9dfa84972006890a9dcd49
MD5 1e8a27ecafca1f507cdee03e1204b3df
SHA1 505fd52c00bc781a8cd03fbbfb81b56a5ab361d6
SHA512 d06a6a3f92e7aed73d921e26b596b084ebf160b7019a833f58d32606c7d965ce566281de78eade4822a649562253c62d48aa9ad33214a94218b63c7584d6da6b
SSDEEP 24576:rZu+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bLNiXicJFFRGNzj3
TLSH
T11E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0cd3a25af9bdd08a1fb9583ac133b3d5c195b814ad3d254a9710b1e67f46963b
MD5 ae68264cde3b0900d0887854197102e6
SHA1 63b8457819d46a070a6ea766d11d0bdd3ec8be65
SHA512 23364672fe0ddce3bb1670af4841971cb98d300938b35007f029f5fffd0b307aa6450b7a6e519a985ca464061cfb47da1e86e918a73fb48b008d649dc97d7f12
SSDEEP 98304:zQRQyi36YOcPDLvw2gAf+PN3l7wRGpj3:iQyiKanX+PNJF9
TLSH
T185667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f5b974bec897ca293175da021b5cb966311200e150bd8aabcae518b1c3521f5a
MD5 2238502eacdfa776b8283e6023fb07f1
SHA1 78096896d6bd81dda4c667ed047d12554073c1fb
SHA512 ca627c299ddcbfd9ba92569569263c45ebf8336b2c6c914e3e594ac4e3e5fe05867ad560c08da8465afbefc3515e55e71a29fa10bc38557f78eb5e176e9416ed
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3l7wRGpj3:oQyiKanX+PNJF9
TLSH
T1DD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 20c2e098cc05337b5e1afc14faec09b426491c6d04ec3d1d9a421f9e4a4888e5
MD5 5d322d92b33c486b0387dd30cb2200b9
SHA1 fecf42a3f69e2f5da2a09e3cd85ff1cd053d6bb6
SHA512 6b8ab1ec527c2afba2aeda90277256f48053945c92e8dee3b7c1824f4f0398825366e237690606fa81034418ab5e4c10c30fb6365f42336de6a08f166ad37e16
SSDEEP 49152:X68Qg55nhkeWu7PNU3/3LNiXicJFFRGNzj3:BthTRc/37wRGpj3
TLSH
T15AB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 62f7587cf8157603265205fddc46a309c5db92d5b28640ee64cabba2e0153d10
MD5 9a8f7c1fbc43819778aa8fe3f97f5d8b
SHA1 82c6f4e57a700aec4a3bc9d44a250724dc8a1be1
SHA512 ea7b7be8fb484b5d3a85583e597e620430219014fafc1c0d4964b1453d3bbc2b1e12094b03f3d7aa55d9d66de7cc89a8d5bf5550f009a70c0e940a1db8f5f76e
SSDEEP 98304:9y5112gYy5azzVvU69nLKnhZi7wRGpj3:gLIHRWhEF9
TLSH
T1CD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 117189a3907944d1e0224bea9c1ba1d897f09a5b830fe6389223055d6ad0770a
MD5 5dada83c7fee9ea8bb9bf84be9b33f79
SHA1 a2497fff25f2cf46af63ee01ee59cf71156dffd7
SHA512 34be168bfbc48c22bf2e7d0d6675e2da98fe3672fa19538e7ccb870a6cf21762115bdb30006e27fd218a46c08a62c756bfc0ac26e70408b111295e6b1afd0d0f
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:Nu6JmIxd2ds7wRGpj3
TLSH
T1BCD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bd1b281a777702ebb770047d8cf21b0f9c31cd983aa39866290e7e9f1b241562
MD5 d8cac746b69901a5785ed495866f9f65
SHA1 cf7088685bb692d579bfb66991669a7cfc080b8b
SHA512 8b0db59be2376a5806395ef3ee4e6098f5b91d9c737ec1edb92a95296714bfc0aec310a894b98349c28963b5db45c1337f07866c18dd26c3d19b0445ec28503c
SSDEEP 49152:71hpsNoJpF1A67U44CwH7R4xxLNiXicJFFRGNzj3:7mifPqRg7wRGpj3
TLSH
T1D7B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a3e3681def8fac595bc1ef983aab4fa3eaefc4fd93e3e0d94bd275a4871dfebb
MD5 f59af4bc0828e2d8e4c0e32d9e634691
SHA1 8bb9c38c4346aa79c0501a5e0e3e5b686490e7a3
SHA512 adeed95d0964744f94131dc37b0275633b16ea5a8cf76c7604ae3aebb5d4cf87a75e1cf06b6fe57202eb9496cbcb6014b015b1b1fe556bec14a68f8be368838f
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHq+LNiXicJFFRGNzj3:A5dKqi61+7wRGpj3
TLSH
T198C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a6ad73fde9dc52b0f0c3b6bda9c52a0d55b06b662a88351b1ce7ac5909828431
MD5 11f990a20ba07bd3487027611a0e4e68
SHA1 a9604d43b357aae8c887b48bb082ca921f9b6ce4
SHA512 741d9fc858f5b33b3220fcc264b89098041cf0305c7a32faf603b9af2cf171d5ec0c0545c3e28a06af199e11b632513713195267d3bafc815e96893eda61a433
SSDEEP 49152:VhtSn8EApI0figjgiDn0AP5wdLNiXicJFFRGNzj3:kX2iWphk7wRGpj3
TLSH
T13695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5eab169e5f86bae0f8c51dfa8c3d7ecd76a9b4166a253a234e065cf9a2ce9e76
MD5 4fa0341c3f2776fcb15154c45fc84fb7
SHA1 0854cc80f5de3925ea3b40bb0bd862ec31d733d0
SHA512 a9b083827fa6f4170455eb9b9a0ff08f1e5ca89f3dd23a11901c12bb8e0a7a33b2404098a419d89ce33203b6a215402a1f33cb2146cb2a070d03d29b6929f647
SSDEEP 12288:xYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3548955B1FAFC003AC6755428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eccd2e7e7895887f6351b493acdc2b22eaf148dfe6d4feb9de7f0125adebf7a5
MD5 257ddd93b8f6e80ab57ac01431d0784f
SHA1 ee41d767843847230dc83899e45f4a097601861b
SHA512 21c6ff1f272d77ee239f3a4ac8304ec930a61761cd4756e9f06c8b71c4251bd2e2f47d92a6c56fb80b8c73603127ff5981cff927e2f034741ee895acdbe6828a
SSDEEP 12288:h3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3558955B2EABC003986754428F5881E2DEB5618E3E3483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b66f8561b5ef9b75ff711a45d2288cdf3ee0626a906043ec8a5f83adbca45df6
MD5 eb7ba408a2e74f0ef0600309f3003fc8
SHA1 8cb6db6491e3a04e709d799970bd902d7e080d09
SHA512 280c045fbcf59fc46e30bc23ac58d31024e440ae68fb0d741a3bb988a2d019e5144dcbfbf58476db8ab8601377ebeea734622c76a39e648494f8efd29abee9bb
SSDEEP 12288:01iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523D2558955B1EAFC003986764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9032f2ce7b84bc7984556957b1289f2ffc8b9947441386635964c8608133a68c
MD5 7ca1541ccea77a6c0a6d9747c95ca90e
SHA1 f22df1ee4d317746f89099ee646d30a11780b536
SHA512 ccdc035eae5f331fcece0279d0e9c55ad5e5fc6e2f2de99d1625de076dedbfcd9f69178847f9785f839e2910e2c73d9c9e683d63828610a167a15872da888de6
SSDEEP 12288:EVWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF552392168901F1E9FD8039CA764424F2E47D6CD7325AEBD3003D1E5635BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4ead34180518132ea9344a77498669c4565c6c8b57d87b00bbe18cf0e8cfee21
MD5 c27b15c2f43e8c3e99a9125012f057eb
SHA1 666482d0cc97dbaa331c3e4b390598530fec4e5a
SHA512 933fb0b4887b5af252e05df94f0f861f63355992be88805b0c56fa3a2c1eef41cacde7a651b1c96c2f07c4e4871d14488ac54d894e71114c8ab35de1eacfc065
SSDEEP 12288:ROiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5ff9a8ef0c4e9576603ec3af440734f2f4e0c2ef4db1097fdc003f3ee5c31eeb
MD5 9d199d9310a89c7a8b59c59b6227343d
SHA1 114c35982e18945a3e7a418e0b88c461ba5a5e2c
SHA512 d1fb13cc3c800b8269caf86bb16451dbf6f19ed0f2fefc22350f73b5f94975ac139050cb60a4ea1449a816430865b0067f6055f3633ab29480a50e4a90aecb1a
SSDEEP 12288:M7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 64a2ddbfb3ba445435a5651d83d3c3862943352d21d3eb5e01dcba4932b2234a
MD5 0363fd22bd8918d34fdf4f54650d9397
SHA1 02008750fe42b401099996a4f2c118ec1032d8bf
SHA512 a2565802806ab86dd1d24db2f23c9afbc489852140393407330b1b4b80b82e34cda1d3daa9a3df6ecaa995d7e677a7b97664ca6dd2f7f4c4f606750f06c8e56e
SSDEEP 12288:gviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17A5523D3548955B2EABC003986754428F5881E2DEB5659E3E3083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7678b639439e2bc0a2f08ecdd93ac54edbe3ef7f6bc14b105e75ca16211e13b1
MD5 8624d3e6f2d39e80449b89337e5dcee4
SHA1 0cf67e2f0231ae727fa70e943642b4295bed883b
SHA512 be5340f7cc04959302fe9016d72cb52912a28a8e14cffd202e9dbce5a6e6b1e193165faaed37d913321bb1d30a2faf95161f59184442995760af1231460ed1c4
SSDEEP 24576:4ZM3zFVSOj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4ZM3zffLNiXicJFFRGNzj3
TLSH
T172750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b59613eff6f23a7ca905969aeda1e8f877576420611a1352fc61077d10dc3b93
MD5 986cbb4408244c64db4e2859960d434d
SHA1 a6838fbda0f95023c4cc1d8b969324488d53ec86
SHA512 a03343adcb32feace45f3766ddb7e7a8ec8c3ab46757558e6130a451e3220724ac9bac436762037d123a2aa7b4e8564d33349cd00d5b5b2adfb12726ec07278b
SSDEEP 12288:ikiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3bea3cd0b9757433873b09a0869ea7f0e1312fae52b646a5f5388341c5f6c43e
MD5 9a12d3fe93a6d4a21651176f894a6780
SHA1 43e1e248629ce26e62a1325cf0e169b10ff89dc0
SHA512 1080fe34819368d8e53e079fb20a464fdce5f495cc25f6fb95cdf6db629c5ed7deb6d0a9937b783f3119c1d0532344f70b23199d862503e806ec811ce76c0674
SSDEEP 12288:3AiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D3548955B1EABC003986754428F5882E2DEB5619E3E2083D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1b360c244bd555f883ee84a2ead17fa1a2927c48c364da33319fe212085eb155
MD5 0764797ecce802e089275b3a6f5ea7a1
SHA1 7f8242e18690bc45ccab7b6af8a6fd227de5c226
SHA512 677f088f0e71851a8baa45c099b374f6b10c92c3083f8549c28b775199f409cd4a0b07a0bd111166a53c7fb93f56ac07c6398fedc011991081ceaabd8d7733d4
SSDEEP 24576:9zyX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9kLNiXicJFFRGNzj3
TLSH
T155650247629530F9D17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e035f6aa0bac5c7f81941dc78154b51eb41aaf5a70bf2b0d74e11a4215bf68c3
MD5 c678e7afcbfa608496ea37c713e4c822
SHA1 116e1b136f1471faa84a4268270d7ba3fbb456c3
SHA512 0cc2d9d3363a81d454ca5d811cae3e5997af537e66482e8bc5772cf20918c9682f0be30d57116297d07fe232efd95a3f2b1ad7e6c1c163004e3257330895ad08
SSDEEP 12288:VkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D3558955B1FAFC003986764428F5881E2DEB5619E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 720fa0584f6f0bed9c4467a4f505021e0d33cc2c8cef65f026018793817c5beb
MD5 5ca134bd81204937c18538b104abb8f1
SHA1 2b3d29d1e71f415510f2645ed53834009f6f49cb
SHA512 255b5aae7b9fbef74ffdc1316ad119beb7204671268f538555e515f2e30d97b99a8c975500cca142d3d07c3c88a2ed25f58b45c18c73ad9946c13c1001a77487
SSDEEP 12288:SkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Su/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A55523D3548955B1FAFC003986764428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a22a4048fb9bdf31b0cb015c2eedf1ecd4653fa93b87f2cf2d2995004ef27641
MD5 ee72b851cb1b1c902c0008f53df7c00e
SHA1 3846f871411b1fa8e6b23a07c287d1b699706fd1
SHA512 2e1bc21264a2bc601d1291b313b95f221fad577e4fa64983866b8a0bddc525d635a351297c4b0f07a6ebdc586662c86da04c054e9879fdc6798b2b4e193922d3
SSDEEP 24576:yzyX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ykLNiXicJFFRGNzj3
TLSH
T167650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 0b9b0f779e0bf7aaed39b0d502c2d7866f9071b0b2655066488cf894e9ce6926
MD5 f935b4c088d34da98d0ec5d69aa44042
SHA1 77a762605863139c793ec20df78bafd33baf890f
SHA512 f1981d4d5dff4b567b1d444d02eaff6fe2789463c9d1ecf4a1b26d7e806f9a0d7bad45bffbece21db2b221b349d02e47cad379c3e43a970a76b61bcb46a55117
SSDEEP 24576:3T8aLl3z0zDp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3T7Llj8LNiXicJFFRGNzj3
TLSH
T1307502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a1fd737cf137214b015e1459c4125dfb9a4eca4e1739ff047fd41186291bebe6
MD5 85558dfa12361b6272da804995f36f46
SHA1 c62988b5a713ef75b831791e5132c297ca963e3b
SHA512 fdd15c06bea8e2ab961a4c31adf1315f0cbf3cc89126eaf84c271eab6bf3a6cb81e40f25cff4a6f2b9fe457a3f864f0b0167dad335b4de6af4454cbfbaa10648
SSDEEP 24576:33rd9CHKy7GZF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Hrd9CHKyafLNiXicJFFRGNzj3
TLSH
T14C85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d78f1ebff448e6e7c964a3afc6e43c730883a909f730a591f55b7a2058e4ca84
MD5 34c5ebbf81c43a2ab068b6a4bf45a004
SHA1 67a429f2c3a8a0fcab143675987ae99b3f7795fb
SHA512 c7d12c3b7089752cf67b23ebe6faf9db29474c5a41f204d5084b6369335bf1988b9ce1c1d7127c1a3a43c6f573b6418a66ee109cf89c41de00f9732d03d7b931
SSDEEP 12288:DViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F45523D2548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cbbdb7449764aa35c5af3d3821377ad53db685bbf1f6c21a187d580b8d5ca723
MD5 9a6d8e9930bf1dd3795e9dc7384f3756
SHA1 983c152b3c0dd8495fb680a341f2f8495411d1f7
SHA512 6d6f6bd19fb8cde15fc1ec8d6f80a9c2ae9caa4cc3395587ef9273d67300c368a3020f4e3ab8710cdbbd46a6ae4d45261d48349f3335c21e7d82a18ca8c42d7d
SSDEEP 12288:HDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D2558955F1FABC0039867A4428F5881E2DDB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a62bd2a94078544c6e82af6bf8c841a3b7e1a0c6de686598662274dbf0d3fb3d
MD5 4e47685312cc52d571ff949cc5eacd88
SHA1 5eb2806a09425589d44835ea0ea202d8ec1942c9
SHA512 ce31c7a43c23dce0d0a31a031d5caf1b733fbbfa94d776a4180f18a12d9a17de6d6a3c2afd319981775f17040592f5456d5037dfc9463cd8867c889b1062645b
SSDEEP 12288:tyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B5523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8683446f78e6681d3561777a816a2dc1d127df860290063d0d92390ddc35dc54
MD5 5349e0150d9841fa01452054f2aa3b94
SHA1 c3fbcca1ecc09f3d9c8b645d5a77c85e9fe8140f
SHA512 f317c7574931b0ace4c79a22c39f3d292a2fc9a4e645d3c773364a9b72c624b81f20899f52d43a90c62dbafae1e193b3a6290048df4adc7222eea69ce430991e
SSDEEP 12288:7kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 18b063964cef89b24cef42437ce4c1ed12897df35025108ca5c8317607f6c19c
MD5 8e4c8e6c26787b92ca55ea2ce54beb55
SHA1 2af5a46a2a08994ec96c808971680054723dfd2a
SHA512 ff58034a45114fe4d8c5828281177c3009075d9b9e484e12ac6a6d62a2a6ac095fc04c34f70edb05a29f616f2dd93a6ee637a5e91e2e804fb54d9dcc446e8061
SSDEEP 12288:YViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4413189762ee8c703a6b459f86f10df95abcb57fb3b34bf60eb642436b809be1
MD5 15200a0a8e107ef23d9bbc27e1e86dce
SHA1 1bd96676cb3df177737c8350981c297b86a4b63e
SHA512 ca1d440809b12f57ac4bbded4d8cc5e28c129f8a0e666b547d89cb79086e0db8aad1bb343622c3dd404703d88b55e23baa4b00d785b934fab32f1087ea7bc2bc
SSDEEP 12288:IciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Im/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D2548955B1EABC003AC6754428F5881E2DEB5659E3E3483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5ec2d34db30ab7f28dfd3c1a2711c3e873260905c901aa3216b28b4add8b1a23
MD5 b0fb7e8b42bf8b6267e7e53c896f1296
SHA1 d35f5ca1513a318442fdd4931f146d03d9c598e9
SHA512 d712ce04fc9e5e8529ce447ea5ad1f11ff3d434dda983823e46e204b0ab3480b9138afa604847568b67e35f8102133f75fe84313ad8e41a3eb675959af23ca7a
SSDEEP 12288:LOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D2548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 939181b534bc6a6187a3df481b49d82466b93ca1e96a92eba5cd6a56295e5dec
MD5 a669c3638ba8c3039a5c867768cc7d74
SHA1 36175cd02c95545e22bd7dda80c1bce36080f076
SHA512 2a16d01d9ae6a6d04d4bc04e1992027661f0bea6e5ee040eb2a17a32a94f624bf0994ef77144548137f387ac80820f1dee3a21c0f684a23889cb52749153f197
SSDEEP 24576:yfwvzk9RX6wkyAIC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5MnYICLNiXicJFFRGNzj3
TLSH
T15685D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 be7ed3f803d9bfd9c284141ed5a4d113918eb3345e38b3ecbbd7803fba869403
MD5 e8ab013273899ff0514060526fe83238
SHA1 d57cd135a449ca876095115e90f58b5c56038051
SHA512 139faaa09584ce9810ea86d63f088e8b74b6e3a9dfd39ce8463a86516cbc05bd981946290a0a95e4764134aa1a5c8464335ba85089d8c8b2d85a9ac651eccb58
SSDEEP 49152:WYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09LNiXicJFFRGN:ZySzPF7wRGpj3
TLSH
T14D066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 58457605cd07dca6cc7cd3b89e19f7a2f746577b8cfc9942e9748f71d976ed28
MD5 b2184b617bb7f1ff005c38766daf495f
SHA1 d62627b6f7ea8c6333c2fdded7823b052b28a491
SHA512 134fcf878d4d617d62783c599f73295d363591fde9d35f625bd64f4effd056fa2614a609cd9261482591bb02f3aa03c7f4e68bb8628f84558cf22b47262202b4
SSDEEP 24576:947Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:947JUQjqirIhCnDHUPfF/tLNiXicJFFS
TLSH
T18C65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2faf3fbe596833fec7b8884646f9c54129cb62d442b0d0dc823ffcdcb56d2829
MD5 ccd992a531985a27dcaf2863d840668e
SHA1 60e65b9deb211e8286f3e35eff3a1305c0f0d0d3
SHA512 4f155b8dddc13e2bf68675363cea49c44b9f9e6e53e19b1504e8f1ab73c21c34eb49e98f73402cf62a2f18f212cb14b12dfdef74279da043eeb6ccf1f27a798b
SSDEEP 12288:zpsfUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12665F15AD28802E8D1AE5139C7664900F3677C2987E1D3CB52C0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 f092a93487944bc925690d72650c4fb4141b0642fd7d149532dad31904087965
MD5 595f31e106afe2cf3e40895e258186f4
SHA1 f7d4c29dd376f3696a5307cbdb72f58fa5f7a935
SHA512 0eb87029864743501f82ffcab1c08c293614d8b2602f72ce724b516d40b6b379edf553f48e7f6dd51442d22b2dfc7747131ae4cd0a3b7333bef64b3b976dc8b8
SSDEEP 12288:dQtdNU3f41viYyRjaTg+4thugGf+uxe+WEu+/OZfJzKIvWhI4kxW9V8cn:dQt7UP2pyEguRxebi/IhzK4WhFkxWf5
TLSH
T121553840762AC79FC5A950321E36D6CCA7707D01FE05AF1773C8873F9476668BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a20d88f56558cf0cd6c24595d0dfaa78b61f11099b6d17cbdef84997a9b113b8
MD5 f8cdd27c0e54ff2af5426e293cfb1f19
SHA1 10e8b032219584a7f91165e5edee1b87aabbc7ec
SHA512 ecf91ce50084ae55a966c9b82a1569c43c806521ce50945839017b8804776ef735fd75a410ece3937c1d589c0c4a3bc728ea5fb43d4520f21643e2761a729b26
SSDEEP 24576:ujafHu5NUjmN+xZkHAM/RJA1Ob77pdcno:THu5NUs+xZkgOniOH5
TLSH
T15B552C01A5A7E35FCCFD90374632C6CDAB74AC06BB452B0573844A2C887767EB5E26D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 71482847b03e57cc2ba78c7dd7f1de7942491a6b4359eadc6a5a54c9f562543c
MD5 1c158da260bd124c28160e59cdd9b29a
SHA1 04eed2bbc14bc037c06ef3bbae3e7a825253c3b7
SHA512 7268fb709f1989bd3bc35c88bf6d0219cecb47b3c7ea507f247502f48239d07ad2fdb68a6c4ca86e9fdc0195c94b5e38d07d98b9083013821a9eea510284e9a2
SSDEEP 12288:QF7MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:02/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AA5523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1f1efddff9b1b05463efa9a11d1183ea7edc91bdcbb8160137c59e29633919a2
MD5 034c18448d623b1e5732496d3589927a
SHA1 e3c7891d8fbe03eae7364feebb6c9648493ddb13
SHA512 b225911e557d99a6b2e298b374fa6e0e7e5e5867155e8e3282894bbe5471258caeded3124ba2a2bfe9274f5202006d4c739b6095c8352efaa0a93605ca22fbda
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bY8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4gb4mBIBhGFTLNiXicJFFRGNzj3
TLSH
T18865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 14c7e7e44ff7d874b3ba85b9aba5c4a5ac77171d9e59755dfaecff7a99c16638
MD5 9a01b1479d76a5b0b703598531c97d09
SHA1 e0b4934955d5b51c46cdc150a6e69e7ccfe00e30
SHA512 02029bd248d6aa3dca5217a9ca05fc69d9797ef5672e8d1815da04153f381f429aaaf7d59ad9a01c9c54904f85259de638956cd9547095707137d33251e73946
SSDEEP 24576:OG88u8FpJqH1vzria7/mj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F7ZFPqVya7/0LNiXicJFFRGNzj3
TLSH
T1A385F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 e66ade88632f6a9b22ddf1053291768e7d13f7377218c172531c5c07fb38ae5c
MD5 444f6752e5942852b478cb3715224d0c
SHA1 3381f11a9a2dd13233c1dbd88e548732903e0e89
SHA512 30bd768122a9ed12f79db9cc76a36be1f8a841f71621bf69b5524e43374d03519a686ef5aeb349e0216e752cd36012eface525fea7bd66d13a1ac38f58b7dcaa
SSDEEP 24576:SPUr+NQf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SJQfLNiXicJFFRGNzj3
TLSH
T1F765F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3a60f4ce6a44a7a96dbf7ede4006ccd68937edc20b2a0e5ae24abd1db1b95e60
MD5 b9be4536b87b7f266c4e9d07575a73b2
SHA1 fdce11695e67861ecb1797c55d3544c82528670f
SHA512 604954379054972544f3aace316ef31f8399586d4253d4c800c3d199085efc0db32a174c780d94a4b5f95ff1f42e7c4a3cb18f749cc114a23b803c356a1c4c16
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvLNiXicJFFRGNzj3:UG05lO43ba7wRGpj3
TLSH
T1FCD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b1d52477f0d12d5e95d3f066713e95e7ce48f3e49313654517a89edaea502476
MD5 6a798d131383ef6e965a0a3cc6bba3ae
SHA1 080bdc581eb9c50f817bd6e1ced8fa6053658690
SHA512 27b40c1bafb12496efb8a5d7b4e3c13e1c61dce0b7d7f1ce8f6b9b31d6de539e8d850364cfb039a19579dd8826155abea4065ad10e9dd6787d3b3e1ea55c6471
SSDEEP 24576:6fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn9/TwSfVcYG3K/cJHlnFR+IGNe8jg:Sa5POZ3lJt2pasx2+m3LNiXicJFFRGNf
TLSH
T15565BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ab6b2a470ff50083da811c2eeb7bf4849737a61a32c04fd5a2e8f225c802a065
MD5 02bf3f486092a09e7e3cbe14dab6850c
SHA1 2322e08a0217865bd51f87332ad326819cb1bee5
SHA512 5b9ad158d502d52a402c1fa0db7c4de6d2c1a544a115e19d98d1038c86341f7a37bf3310c4b1d8ea1634573b6c54a00fe2038d20fbcf8ab24e36e1b4c9c18a3a
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fkr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TNc/zEOVHFULNiXicJFFRGNzj3
TLSH
T117858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4951e765acee26693a8ca6f2a89e17a0ede8901d2b5221570204c33cc3aff1a8
MD5 0dc3d805ef8e907618635d296a50e45f
SHA1 532f885ba2b05c00faaad4bd6d304caf7911f62e
SHA512 d712408cef45e43fadef37fa400daad1c7155442156d6448396d14afb545c78af2c7e5934a37eb061d8fad76bd423fd1e2e6270948cecad86cf19154cf6c0718
SSDEEP 24576:RzkNvNnaFeYhJNtmZBmg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RzMwBtOmgLNiXicJFFRGNzj3
TLSH
T10D55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4e434a3e51667bbc023a6ca70786de0203fc20608564e2d061bf4d7b7381b87c
MD5 d0d585b3e75a14c094bbd48b669e998d
SHA1 275a369768af0e335d6d9dc7416c1e8b07603e1c
SHA512 ce71b2603022af9b973d2b088c7508d52dfb033330aaf3f5d5bf9af42a11e82d413748f609d8fa1027a51139a8318cbdeb769d5d67e8f0d6ed476e1110c43935
SSDEEP 24576:RD3FHshBIYQgAK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RDVHeBIAAKLNiXicJFFRGNzj3
TLSH
T11175E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-78-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/240-84-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/240-291-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/240-76-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1760-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1760-24-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1760-30-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1760-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1760-31-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1880-61-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/1880-51-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/1880-57-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/1880-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1880-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2276-125-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2276-131-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2276-325-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2276-123-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2868-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2868-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2868-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2868-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3088-306-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3088-89-0x0000000000A90000-0x0000000000AF6000-memory.dmp

Download

memory/3088-88-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3088-94-0x0000000000A90000-0x0000000000AF6000-memory.dmp

Download

memory/3168-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3168-22-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3168-33-0x0000000140000000-0x0000000140406000-memory.dmp

Download

memory/3168-0-0x0000000140000000-0x0000000140406000-memory.dmp

Download

memory/3168-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3168-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4144-72-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4144-65-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4144-265-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4144-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5076-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5076-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5660-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5660-322-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5660-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5660-117-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5660-111-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6072-142-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6072-146-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6072-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6072-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6072-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6116-105-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6116-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6116-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-338-0x0000000000730000-0x0000000000790000-memory.dmp

Download