709b17dc7acdfc71ff16dc8920cf81bd948d37d72a694498ef54a229c227fe13

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260809-vn35qsvyf1
SHA256 709b17dc7acdfc71ff16dc8920cf81bd948d37d72a694498ef54a229c227fe13
MD5 1d58a2451b0c4c6dfe3c32ca873768cb
SHA1 a52e4ce717ec8745ab59fcfe2dd0b3d22a489044
SHA512 eead82f226461486a115584f57cad0b740ddb0c18dcc21b7f9f1d9e21d562fdd7fde850a7136cd36a355202e77499f15c16d80d4f5d0fa876670b6016d1d5526
SSDEEP 49152:awtfbJL4tdVwAQE9V4ldKtFN8nQgqo8B9knTcWenuP/VATd0ovLNiXicJFFRGNzb:Q/4K9Gnov7wRGpj3
TLSH
T183267C1BE6B941F5C0BAD1798A979517FAB27819873297CB4390470A1F23BF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2548	elevation_service.exe
4092	elevation_service.exe
1916	maintenanceservice.exe
3144	OSE.EXE
3920	PerceptionSimulationService.exe
824	perfhost.exe
2524	ReFsDedupSvc.exe
4056	SensorDataService.exe
4548	ssh-agent.exe
4064	AgentService.exe
936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cac040a183806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\UseLock.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000410368d32128dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a5ddbd42128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9210a152228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e3418152228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cc1e5142228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2688	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2548	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4064	AgentService.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	ReFsDedupSvc.exe
Token: 33	936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	936	SearchIndexer.exe
Token: SeDebugPrivilege	2548	elevation_service.exe
Token: SeDebugPrivilege	4092	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 4228	2688	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 936 wrote to memory of 1832	936	SearchIndexer.exe	102
PID 936 wrote to memory of 700	936	SearchIndexer.exe	103
PID 936 wrote to memory of 3448	936	SearchIndexer.exe	104
PID 936 wrote to memory of 2240	936	SearchIndexer.exe	105
PID 936 wrote to memory of 3692	936	SearchIndexer.exe	107
PID 936 wrote to memory of 5776	936	SearchIndexer.exe	108
PID 936 wrote to memory of 1440	936	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1d58a2451b0c4c6dfe3c32ca873768cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2688
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2688" "1264" "1348" "1480" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1916

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:824

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2640 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2640 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d5c454d68d8384aa342bee42c91e91e2e5d8b93f6470de97f69aeea8bf495bd
MD5 b3ab54f0fc2e5c80e58d42f84a5dbee7
SHA1 61d23b8b14ae33a45cd2f9a4977b20d9d8a6b97b
SHA512 1eea0512c8de50efe7d03059e3c00420cea4f2eb657a87a644b90cad7cbc5bbc2a710e9d20511c775d999a25e37ddefe6a080eca8ea349718b80eaa55c4bd609
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKLNiXicJFFRGNzj3:93q6mjBp7wRGpj3
TLSH
T1CDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7650849bc1ce2831e7b5c3eeed3fe79ae90b381a722fc5ca265be3fdad73fb91
MD5 5c690fd3bd2c1ed3f99496bd2c672a42
SHA1 fabc474058f0d8af8f0f79512a7658e544ec4fd3
SHA512 7799b62f4e2e53500f4d8c0c71dc249f56c86279d2eaa28e8016eba034ba201df87aedddbfcffaac18d448149950f8af97b36b0688d729a9c30e16f3fb4d4a2e
SSDEEP 24576:HXYfDtczAZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:StcALNiXicJFFRGNzj3
TLSH
T14875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9fe6441720609961fed0f777d04878c7800c4e09f84719777c42831baabb27b7
MD5 e0a50e8c9c51d435084f704429e93552
SHA1 b60d61262876d0cbe73d09c5d97402fa31310919
SHA512 90678396addc76f2cc232b06c710191b8e42ed65651b791b9257e2d3013d62b3db8bcf210aba91c66fb13ddb9bb7f92aa0f334b49f471b1c2817855707aca70a
SSDEEP 24576:70Le5ji0hmxhrMm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7Pji0AzXLNiXicJFFRGNzj3
TLSH
T1A1859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 034dd6d497d36f8cc031a4d94036739f2427ee4480a7884d6fc922d2d3a6bf7d
MD5 1c301f98b24168bdcb98952b0400e462
SHA1 2e6c4fb252557781ce54d667f2a55ef92af0ceb3
SHA512 611c6f64174f7b4f685f615e2d8cd82c474d70bf8a6f633fd62b62c75fdf0031afcb96a6de3377048832fe3ef4c40d64bca8d1b7de52cba53c598536b228d84b
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWj6q8wyuw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3/ezSC6vUzPv+HjyLLNiXicJFFRGNzj3
TLSH
T1D0756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f54190fbe153ffa585fc5080f7d7520d9ca4c50384ae08e6b836f50bdd8a2020
MD5 ad96aaae5369e813837ab46015e22d4e
SHA1 55583abe9c5241d1c6c398a6cb773a63c2ba219b
SHA512 04ef10f29b2f5cad1e1771465368b43323179650f15fda21057c1df85bf4c40d8ad43e041d99b7aa31528415b6a9de3a12c9877532c111121655ecbbd9b63d0c
SSDEEP 24576:IVbqPb88hv/l+BV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IVO88hXl+3LNiXicJFFRGNzj3
TLSH
T1ED559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 de94c6f829c5bf5efd8bce2d2adef2890e3837bd8a53a23e13d1bcd53aa1fc55
MD5 287b105e4ac3899f87eb490d2c0b06a2
SHA1 e2aed63b5a0c0e8b623c4e367f49cc5d858f2a0e
SHA512 5eff0909758b1a787820a156443efc87d467ec54856591e83bcea45605116741369042c8596087f83bd2c1347abfec7e6ecb09717af90d7d1edb28f2be3c5bdd
SSDEEP 24576:mGC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T15B5523D3468855B1FBFD003A867A5828B5845E2CCA595CE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e6bfee6964b377f92f949248ddd2ba2c8cc553ad1c3c99bc9ff16f0ab80da2fd
MD5 0be156fc05f4c8155797b4f3609a43d1
SHA1 ab09b38c20d958d4ef0f96858029a2a78cb57d45
SHA512 d59721b221adcad27e2308ad011a577f29b052e0d77330d66c1b2bd9fb4b9648dd330efc344d2004bf4a6bf202848d09c586ee0e324209eed78c4bf3c8540b5f
SSDEEP 24576:UJIUd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UJIUdLNiXicJFFRGNzj3
TLSH
T14B75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f9dd714a2e5b4fa93a10f1f0179ead551e9efb1600ee8b5c1c45d3faae48138a
MD5 e8f7cfda363cc69c86ec49624afd6884
SHA1 6dd01449938b040439dcd56c3203bd10e63b2dcb
SHA512 3c7258f1323308283c915e2090225358dbd89653c6d5a6295bb255b141392d3c7bd16b198b0fdb2dde7c470e0782cd3c6b514f9e06e0801a45ce70157d414c59
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH1:bQvGAdlCEL8c/WRNw5Cg7wRGpj3
TLSH
T1C5266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 73243cf5b7d983259eccf999fc6e93251918fd6e33495010ebffcc470e4a3354
MD5 574c28b0a6f2d01d652b88de1b65042e
SHA1 83e2c5895bfb2ba8d2f52028a0a54ef716387db4
SHA512 b24914845a962150b55ba453f58074093147d931614d8d114d91e49dfb3667fde55bd89c0900f0060254b8d369c993513e46cf38afea709a560d2beacdc6ce27
SSDEEP 24576:/fewsAjH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HljHLNiXicJFFRGNzj3
TLSH
T1FC75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 183600c4e61510022d6ffb41bb8cae946fa441b5d858b92b940542f3fa856f59
MD5 dd5a59d39851a9eb2b08b908427668a7
SHA1 cb19a538477d97a58d59bf5b9a8ab55d0ca4d3ed
SHA512 ca5675fdb881ab90379ccd1a3b044e87f524a4ad070666c4bc6f30b75c70e2661f0ad95ac74b98f571251b3f4c1aac7768c431638d81fb213beea9f5eab8e4cf
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjF9:hUEtQevvqc2W1cpV20I32B9
TLSH
T125474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 52d2e60e84f56593ccec8a866efc5e9484067097a9f11f57b23ecf96b246016d
MD5 368b8e50612de322b9f15c908eb96a9d
SHA1 fb67cd10a898c6dbf496928827b63b3bab9e1c65
SHA512 5785c3c4e8b2419c34fd5bb7efb41953ca50bcc18424a818d12c85c2a7db83d49df4d0c3c55070254b53bdf1436ceeeea43d87683f35d52a3d7373e68d0b06e7
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/znLNiXicJFFRGNzj3:hoq2VjnmE7wRGpj3
TLSH
T10DD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 22d8ccbd8de075ada8802c5d72824cbd4a3f43e2127d938a2619021270b92441
MD5 f8f5a4672021555edea3e4356c104ae9
SHA1 c38056bb8c0592db675acebfb965967391992a7f
SHA512 5a6fb9b70c564cfdd889f72feb1bf134b6f0139c9245a5b73006ddf0af60b4fa39df12e2e6900d9463d5e8b3905f84ab7c7ced3f63ab3674a126cc2378c6ac3d
SSDEEP 24576:YAhGL6IFoiwtA5l7S53k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YAM5Foiq50LNiXicJFFRGNzj3
TLSH
T1D9359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4b5afb59cce1ab1eb9e7de7970bc32ba7b94dba0ca0adb8c38a296d0426ef3f4
MD5 e9fe64207d0c377ba9ed845e8b8adee3
SHA1 e74c7bf54e9d7adc651f361f089eda686cc54bed
SHA512 bd2e68905ed329c1899f3cc0574606cfaece08f54f1ccb27e3c2e2ca4e4a3a52ad01e112d1ceca4f1a8b5504f40af8c2c763f1cb0e8c8c9ebee5b3af71ae4c66
SSDEEP 24576:pwuROWr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pwSO4LNiXicJFFRGNzj3
TLSH
T1ED65F18632940CF9EABA41398657C035F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ca06e85bc09ead721e9598ccf117c9d911f8a1ad45f7f67c0f5d9af1d091f0ff
MD5 d7b324342ae06e2617c69e1eb11180b9
SHA1 da8d79fee2ffb36c431858dd58a73aefabdb02c9
SHA512 4a08bf615da9e320313dafd66c2fdf17af1d5c858731c5b52d613dcaeebd3437b7b2d243835ab074f571905910eb090ba0ab14b8b6dada60c248ab3f71af5346
SSDEEP 24576:BZuO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dLNiXicJFFRGNzj3
TLSH
T1C255129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 89b4a71e309379c5ea6c834366beb5523bbcdb0d5f00ab110db50c7fa48863f4
MD5 504d11d3fc5080ca090a1f4949184fc0
SHA1 c9d6c65bf4312ad70918f4ab25b75a02b27f46f3
SHA512 47659485f282a5ce3a91532c63dca75dbc9f4e118381ad47b9246ce4f0e482e15ef3301847a31e18f302634b19e98b598067f191ba0aa5a188975f1bb9225468
SSDEEP 98304:9QRQyi36YOcPDLvw2gAf+PN3h7wRGpj3:0QyiKanX+PNVF9
TLSH
T105667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e4c38191462ccb6ca9bd053b9905f6df77f83a247077c71d13e25880f881b4d5
MD5 eccdcd13f5f3939759057584dbaa9953
SHA1 660e086c099e58e1696a9d42c4652de1c773ed2a
SHA512 6b92319b2f57adf0e5ac9295a627d9336d93ebe90cce92c91bd25a5d4aa1ea541e8fdcf9e3da727efb33c6ab833f2ed064e0e474921b819ff74f931d61b4120e
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3h7wRGpj3:MQyiKanX+PNVF9
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9f2c890c8132709f26064cbb996105a66a54241ab4c624689032ed441033c211
MD5 8d2b43887e30bc321efa17265efa800f
SHA1 5638d1835ccd8661a6654fcb652db32606b0bb9f
SHA512 c2299c875e4eba18868baf4d8f46ed948980f332534ed586f763540aecbc7ff01b472280ab4b31c377bc0a25884449762c4f655e3be9509bd45be3862de686e0
SSDEEP 49152:c68Qg55nhkeWu7PNU3/XLNiXicJFFRGNzj3:WthTRc/X7wRGpj3
TLSH
T1E8B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0a7c9b59765bda7c4fe509a13da7ce32b573b44705326d15afa809b52eb7bab0
MD5 6daa54a15d4a0c35e7c5098f7d2e7764
SHA1 30d9a3a62432c121fdd1412b0daeab15e38ed732
SHA512 7cf9503c01c573b06312116c71e4535310ee592f125d2923f5edb79668106264341dea1d103477088791c382e695d28273e76ea1e01eee8228a2f5d821d8bf77
SSDEEP 98304:Fy5112gYy5azzVvU69nLKnhZC7wRGpj3:oLIHRWh4F9
TLSH
T17E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6db5e19de2e7599523d0afc9a987ead8b73b69778a0deadb453abb3c8f41d2a3
MD5 aebfe2fc22022d3c0a8e3ec0703b54c7
SHA1 6e6d3aaf87dc3162d4b0a973dd769b65ca13ecc5
SHA512 49ec724f703752727a1cd81ccb40b16c5efc1eb070f111530bb0c85ed4e4028d262e05083d45290a605bbfcd48bd4dce8ae580d98ddabd9177367ba804b65799
SSDEEP 49152:ZB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glFLNiXicJFFRGNzj3:Pu6JmIxd2dF7wRGpj3
TLSH
T13AD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f23a76d89fa2fb711102d73857936235bc6e5edc324dd1bb0af0a04a1e2e4d65
MD5 8e8678ed688f46b4777d8828bd8ba05a
SHA1 94d4091e532090a11466bddc9f2f4e400d15e57a
SHA512 74e53892c8cb5b10d8c0cea1d803467ee714b11a819ea880b50c7084200a8577b867c150926a84b742e6787e3ae1ce1f5cc9d11a4948a54f86084cc18ba2cd20
SSDEEP 49152:d1hpsNoJpF1A67U44CwH7R4x9LNiXicJFFRGNzj3:dmifPqRE7wRGpj3
TLSH
T1A2B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 93542b271a3c4ab16a3c039d4a3db484e0b4ca5155d9c66f99f9a999f594dc30
MD5 7721c50ea5633d3ddb6e6b5a28ac83cd
SHA1 0a6a0c2b74e09b5ee8b59e1d5eb022755ef7af5a
SHA512 ce06924e4f88781b8ad4618cf5e5a2d8397ade620f261356e2472eb75092943f92f956837c5d05fd16acc8729af1920f7ab90593becbb3918fb354d4b1a3767c
SSDEEP 49152:5SuZQIY0Be2KkRVtOnks6NMHqOLNiXicJFFRGNzj3:X5dKqi61O7wRGpj3
TLSH
T146C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 204758802d8fe8a3f03cddfd2a6a1cb74fc0a05c2dae820e4b11ced055348c5d
MD5 3afcfac3d43d6ed35a9b075fe8df4b9b
SHA1 5f5de4bfc9eec17798874a68ea9c41eda9b56521
SHA512 e5aa0ebf7297727cd0255ae67a202c0fbea85fcecf681fda7173b71202262eb6aef40499a32db78038362abdacd7c7598f0a3f1baff43cc18079c0fc4181a7ea
SSDEEP 49152:0htSn8EApI0figjgiDn0AP5wZLNiXicJFFRGNzj3:VX2iWphY7wRGpj3
TLSH
T1EF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 53e0f7b01b68ffdbe414bc8bc10d173e1000f5d68491ca4cde25436ff002e59c
MD5 239a285c846de332fbaf84f9c8206d43
SHA1 c0d2401864b4d0e47b5d9363bff4e8fcbc40b8b7
SHA512 6ab95ef7069bb7424d71d42fef26196b77729c7a49863ce8346f1b6cb01cc4ffaa4f55f0cea833e7a8afd0b509b82847922eccbc0cf6eeeaa7b97baf274036c6
SSDEEP 12288:p4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3558955B1FBFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 67aae091db029117f78e94fd43dc6618a346386cb780d320b9a879c19ac62b32
MD5 f9c75783067f8788dd4344161f044666
SHA1 5cf6a36c805f719136e550a89f1a026a195e7504
SHA512 7dc1c1480afac6e7e9f321e6bb4f42103b8ebed5afffe29b800e6694bca754d215259d547c4276ab7de52ca2ad44f5844d26e002a5bb9bc57762d8fa9b21d8e7
SSDEEP 12288:/XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3558955B2E7BC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 351c951f9c9bf9c34e0a6db76dd9dc7d502ad8733e28e8f125fa430063e3d5c0
MD5 37752d4432d5bef575cc840c10623a01
SHA1 e9a9df8ded70d7a7d80b2644ab6bf2fcffbd796b
SHA512 c4e6490e3bcba42d7b0ae8a041ffc9d11e768bc3c7a4e8ea027a24b653dcd2e6a857d4f9e6296e7e534d4eadc922296d10728b981d6b654ed9523f34966a6c87
SSDEEP 12288:I5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Il/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3558955B1E7FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d555539d8728e22a37307ec8768eb96e6285e5d1ce077325f099b09eb98b6a0c
MD5 b428ee0a831f9e3541bcc5ac38397ec8
SHA1 810640784bb4c4f0418969a0681133261e65295f
SHA512 462a9915fd3990a5c988f3fe2e9ded14ec385178a9223c8aa37a239acc2abb467a202044056637d03b1e0c7d499bcd33595c9f851f0fb76aaaf2e3d1fcd5925a
SSDEEP 12288:QVCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T141552392168901F1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dea0cd4125deecd157e9f148a2f43f624d91d27f1756a5f6d203cfd9b180b931
MD5 9f3bd75f2daa9b488fd25a7278f31968
SHA1 917fa38512c4b6c95e2f88669d72bd0cfefcd5d6
SHA512 cc37514034cca3aca37fd75ec3b8612b9c1acfe390d4e1c380dd5a85c62d5bc679e462ea987d7f767947ab5a1cba8b3c81312a650c5bf6f9479df0d17bc2ec0d
SSDEEP 12288:QaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3558955B1E7FC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dd26900663f7ae470c005320074de2758f0660cf81a45902e98e1ee8971e54d2
MD5 6d284c5e6a55fda978635ca8d8438a14
SHA1 a480c2beac52246ba3d0742478b23f84f740b3e1
SHA512 9695c5382e61a2beb45ccb20b41459762eeb4d6ddbaa6e334c656fcc8356474614314d9b1162d5c517b0485fa631ee8fcec7d3d67e2f10cd329d9b005aeeb2cc
SSDEEP 12288:47iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3558955B2E7BC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a47b663e2c9033a0f7ee63652dffb4a4e9bc4154b7ceb20d52004b7237d2a39e
MD5 54cc31d6bca63cf0d9724f8213478ed1
SHA1 58a99d87d10b5d51a5df1f4d99db257f4e2d54fe
SHA512 6caa98415309c3e3ab865d60b6c74fc7991a2595c3a83d069f8722d80c4556223c2a07a332b4866aebe68e68a588097cefcce1e95db849a637491e59aa83f390
SSDEEP 12288:qPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C85523D3548955B2EBBC003986754428F5881E2DEB5658E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c17dc04ebe7d1db81bdde03845bb56b5ec20bfb4079903109bdfa7f25111fb22
MD5 49d2445cbc84a1b1ed64aa3240f8bc32
SHA1 0330de365c006c9a631e1d9fbddf0d6dc9598287
SHA512 ae4299ea79f1ffca93aff4be881f057c796b646da320adbff82c1c8de4a4ddd1ed47d2ae5b961bf7c1724d60a5adf30d4752c0870af6f22e98f453c55953f5ca
SSDEEP 24576:tZM3zFVSOD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tZM3zffLNiXicJFFRGNzj3
TLSH
T106750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 111f275d67d44e30aec82bdafef7600e41c982ba35876bf87b1d8ebd13bd8d39
MD5 1873f1b02dda62c241eea763c451820b
SHA1 78e91ecff43df4c1e71cef4db354bd5c420ed721
SHA512 99a0ae43b33b50f6e15bb3a615e845342ba1e090f9f78debb4bb212ce4f4703791394c8ba357bc0c8ed36285818691e3ddc17914c41f9c907b46529c5849a958
SSDEEP 12288:hUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3558955B1FBFC003986764428F5881E2DEB5658E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7abef8ddfafdb015fe0b989507a4410148fb3f8a49291e2cd87302c838f63729
MD5 61167184c00eeae2dc2bd2f6faaf68b0
SHA1 c117e8829cbc629c91016c99b129336d4cb9ae1c
SHA512 43e03e49c36d465a714f577636eb79686eeac6668fe08df2f758afaab6fdf2289d95bbd9c5f1fcbcc94eb664066d91f5e4cf1b1188e12bcbd5fbad1ab26d8ee3
SSDEEP 12288:ggiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3548955B1EBBC003986754428F5882E2DEB5619E3E3483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 85994efa342e92168ae8e2b3a304099b32e726a27ae0a2f5626849874ae858ad
MD5 f939400b7283abc227a2c10cfd03a39d
SHA1 a725193ae65ace1aa7b60746295d97fe90d9a046
SHA512 2448b31d8b6027ca50307ae966d18d80d6b7907a1888050d3a256f918dd44e4aba0494be2b2d323ed6f8081477fbfb973fa6e41cc5298c3f5cdd67e9744645a5
SSDEEP 24576:Qzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QYLNiXicJFFRGNzj3
TLSH
T174650247629530F9D17A4139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fa122a0b3c920aa5e446b688193ab1d23dc8b4a7efc1ea76afe6d96cedb356a6
MD5 9c72085d178b78453da93e8505d5757c
SHA1 6bca9deef9c634140a41c3b5b8dece8d1973f3e6
SHA512 dd3877df237efa1b30a56565fa7c411f0059ca4f4148f96dadd119dafda61f99be3ecdc5188b6009a0571ff75aa4431974428bb6318fee174df552f748ea64f0
SSDEEP 12288:gUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3548955B1FBFC003986764428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b9edf5ab2e76a0e28ac6d72fae3dc1bf26701ef98f1bc7ae7e850c106107f51d
MD5 f64c25e945bdbd0ff3fbb1e9931ae25a
SHA1 1378b8195afc0ecc131207aefd81e83e9d3d9adb
SHA512 91c979188885a4960aac8cbe11e5c0be37f7fb4b8995479cf20639514c134a07ea36802e1e534bca371de06ee38fae73a1e9a92d08bb307983edb85c4e94d276
SSDEEP 12288:NUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1445523D3558955B1EBFC003D86764428F5881E2DEB5658E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 120d4aa695fb82db613f89bfcc792224acd37f79a14ad5c4125ef481f62b2184
MD5 6fff556948d46204e2a0190d31e99c8d
SHA1 f165ea8e4727fb751b3153b0749aa4d46b84b993
SHA512 de70b3681f8f8f8e0324e27bb1bac23157f948ef6bf080583ccf2f7f651be46f80dde0ddd03d7b02b5822346539e6c6da78a0c6b124347d7f8a34c738cf23854
SSDEEP 24576:Hzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HYLNiXicJFFRGNzj3
TLSH
T1AC650247629530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 75a874755ae9d9d99af1e38c6a1a1dc426d73728ec05c91ca4bac839847f40dd
MD5 e6430606cce20c9a9335651ea8e2f8aa
SHA1 d282d6e3fbfe31052ee684bc16bb185d6c79c3c9
SHA512 c088b75ff8221caeac56df4026a87623273f6bdcac9aad357ee80304b0ae8cd65a1671aaf2fc1bf9b4464c014a4b0325dfa09cf20d759459d0ad87de738f6e20
SSDEEP 24576:aT8aLl3z0zD1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aT7LljwLNiXicJFFRGNzj3
TLSH
T1137502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 730c21fd9870b917120f9f7108974409bf3b08258bb3f2ef783b33d636b71199
MD5 613213818d6f050bf95ac1b1e3efe172
SHA1 fe54a062a73292486557a0587e5321af4928695a
SHA512 2a90547f921c89a76bf684e7471070c169f2febcb06a92df9b651187cf12e4fdf66fa607151b6c2ee473ce5ac36277b2dd01fcd021f449282ff7754442f01176
SSDEEP 24576:73rd9CHKy7GZB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:brd9CHKyafLNiXicJFFRGNzj3
TLSH
T18C85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 23a213107367fb91a221cd436e08060af10866169c661d49782347629ba42f56
MD5 a0bc88036b46cb487c172d83b0686131
SHA1 8f820ef5bf8b409005e8f6f1167aa25bfcbc6a3a
SHA512 18c91ba7cb7588c3380c731747f57c34f55012911682d9b3be32e6822a85a7705ced3bd1d24740411efb10a39fd82f60d93841de22f532a8512bfce6c8caf37a
SSDEEP 12288:4ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D3558955B1E7FC0039C67A4428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1aadbf4190f04e7e28091415f93dbb8c7415c149d8f08d28b5030a193e0c8999
MD5 2d78c6017267fca20aea1a18fd78b498
SHA1 6ccc7b86eba8cd279f4aae4d1f20eb625d4b9e32
SHA512 643d31f492931967c23d3a3ab19dd0e10790fce9a1be867996a1846ac3cdbad2762a2db532f0bae9bcf14c71f1f27c768b5980190da0b971aa177015538e11c2
SSDEEP 12288:LjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D2558955B1F6BC0039867A4428F5881E2DEB5619E3E2483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 11d5b96289c9a35f11e212873641aa86fbb0f02ebec65fdc1c712b2876a543b8
MD5 a59e2e15c6cc0b82c35f6f94954ab7e0
SHA1 ec9888b2f26175ab669d6b737765cc519f13914a
SHA512 efac14cb3f5156a9afb09e8caecbc3145ce06b9b9aecf4a75d5c354102b759e6fab881f314f18339d4b5d3e5ebdad3fabb19451b8ab03f130301f0458a28e3c2
SSDEEP 12288:7+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3548955B1EAFC003D86764428F5881E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 36d68c2e93c6fb2d749bb3a93951f70fbb830a7c8d27baec847b342a4435680e
MD5 382d2156ea3e1ad6d776846707768d67
SHA1 5381216c0475d3d075dfc21c7686867a895a98fc
SHA512 6b03f46d72fbd899b1056ae32193b95f57f341f6d852500e53cb61d882d430b6ea8e98cd5fa6a8d4890ae15b14f7cec39d75a20120d62c4772d1b97251ea7976
SSDEEP 12288:hUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B1EBFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6f6ed756e94bb80f65741a1173ef2a0fc39f92d940e8f9401e195182c5a3eefd
MD5 a5047c1f0e0e4e53169bbd8ae3fb8c39
SHA1 fdd08461a389f7c0355849ed62c7b9458aebb20e
SHA512 24f3405cd03bc996804d1973bbf53086ded3ccbb53ad35b34b41f1ecbbf7f722ba94720d008b5794db8fb93d70c1f0590543c63d6fccee9a0ae7a61fa3a7dd6e
SSDEEP 12288:iZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1745523D3558955B1E7FC003AC6764428F5881E2DEB5618E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0d6495a03a9dd70ad5abb075fd1dc51d1373c813a844a236efc349f5f9e46d65
MD5 58844b29582e4dc31466f0a2f0b6c36c
SHA1 edead54ea0eb4d3f617aff70beb028a6e6f5e0b9
SHA512 b67cd610c6e34a67395a5b8ec615087193db9bc2d920e41b3eb53d55ccdc110902f024e1be5d27c70cc31529dda493f981310d625f31b4c8cca91cc0029855b1
SSDEEP 12288:qMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1345523D2548955B1E7BC003AC6764428F5881E2DE75659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e1c12be796db08c79ec4794592b9cc72690e709932a283a1cfd658fa20cfdf20
MD5 a80dcc42a85b3e7320521b87e97d8b23
SHA1 b47558fed7f1eeeff11e786861f959c6198a6b30
SHA512 22cb4a5eb59851ab8b0e8fc466c14afd6aaf99f7a546d7f6d49e270585710a18889cd3af908d4a62ba69b0ac1d7a0afcb1339eb29a2e92bb230d2b7f75974887
SSDEEP 12288:OaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3548955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 732b3b6e9104b3caf6418768525a2ea3ab1fa1ce10846b2a00d161d6cc809115
MD5 d7b88e29cf8b9485b0d1e477617cb0ae
SHA1 440c4b4e88e22daaf886e2faebb024226d17ccaa
SHA512 59dedec3f94e7d700d85a2826a13c4ae9c30f1c7e56ff4c02ab8392db1cd38fe85ced20a34797c3f020f5799d64e0638e98c5c196c3bbef90618f2f38f2a79d3
SSDEEP 24576:Efwvzk9RX6wkyAIi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PMnYIiLNiXicJFFRGNzj3
TLSH
T1B785D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d7a265222e04c295a0d10b957f37b1c62aa467a9961a525652a3209576fb937a
MD5 57b39ed0b5007c9cab4dbbad06363677
SHA1 9899dae626ca82ed1f9c0f59776d8d615343df6f
SHA512 fd3bdf3e7e55181171583b3b7f40d88a3d483b0c5c0dcc92bd4f0b3b778212567ce56d18b4272b766bc3916d60399efd63e1fe4cf92e52b5c6b881bcd98db89d
SSDEEP 49152:DYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05LNiXicJFFRGN:uySzPB7wRGpj3
TLSH
T106066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8ec652501f017c8a12cf428e6bfeb4c16d0c6f9c9ed6a468f905311337e113fb
MD5 bfdb17d0835b1a17050b597bd323b47e
SHA1 3da499f6bdb9dab8f7a196d13512b1981dadc610
SHA512 c0ee673f1137f7ca263828a3b12023007adfe330c97acac09b4bc5bb663a1749ae253b8f0a99643214ef481b137213ceb98fa89a23c5a2137c6a43c652ec99ca
SSDEEP 24576:Y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Y47JUQjqirIhCnDHUPfF/pLNiXicJFFS
TLSH
T12265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 06b78a00eeac69eb34a0818113050dc0089d3ba4826bdbfb43f254a678e24a70
MD5 087c0ce60b875f9df7a0bb85212e121d
SHA1 c77b99c5769dd094f56b0d27a89d0e96ce455d63
SHA512 81d176455b2c003252ab898ad22c9671d015d265af7beb305e271e107e94ad7bf450d92071eb5d282dcfa5a74d6c30ee99f1695ff0d370d99685333f71ebc860
SSDEEP 12288:OpsfEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 06f2e09e3a1850d24bcb0bd1b141b27ce8c325accacf63da4a17cedc8ed2d813
MD5 6d217a718cc0ea5464efbe0e80433f6b
SHA1 708742e73f3dbf85c369946207a4443fe34fe3d1
SHA512 918b42cc0f13e75ede4943590d84281f00fa7ba31a60bc1c53af6212a0dd573056b05321b7c67966c7523989dcfe2a30b8321be0a1bcb309850f172d1b453480
SSDEEP 12288:IoqxU3f/e5PfEaUBwgIZ9k79ut5gJCJEl0qp:IoeUP0P8aErIZgs5gJ420k
TLSH
T1C7453940766BD75FC6AD40321E37D2CCA7707D41FE45AB0372C8972F8576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 486004174cf882edf91f6db0ffafde763b407d7e8d0c6a7b75940024c851a479
MD5 665b41064518c0ffea61cb6ca7fb2404
SHA1 aad307b606c281689688ae0ea37a2a56c6e8d60e
SHA512 758b26b90798e05dcb961cd78032b3b5f1bd4bbe84834ff53e3acdc5073cf08bf61c9c1b29d332115b43ed2d352ccbde14f1d39425526afd45ebf769fc446b56
SSDEEP 6144:hCX629ZWLYdI1+I15bvXubcbVtMxxUiAcbVtMxxnPIZAw9iCdic:qebvX2ziWb
TLSH
T1ED65D9816437A38FD1FB6072073A5A4DAB64EC4277056F277388453AD82BB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c32429c7ad489b7b905e2ad1a64b2d4cfe46eac58ec4f1ad2d59e219a2dfe573
MD5 b42d2b676c36aef62f441ed6c3953bb9
SHA1 b678e06989cd242918fb9f0a233353c416db43ed
SHA512 6fb5089b922c3cf7261761f42f028ed02dfde346963077fe9365a65e6dd6bfe6a1d5fe282848e2b2422adf0cd5d5439a49fa82390c053d95672108bcceebc46f
SSDEEP 12288:UF78iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523A3568C59B1FAFD0039857A8434B54D7E2C9B1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7433cf35faa4eb5ecdc120b26028b04f53ddb17e0655cc33392eefa3b2a806cd
MD5 ecff5653f4c9569a85d4efa59a81fb24
SHA1 6ad27a7df81a098875758029ef5113750219e9b1
SHA512 08b30d65e3f02fdaeebb179a91c27eb8ec79e0b2f38917e5f9138c1b38c85d46f2d77a407a7eb555ad5da4b5bf4790026700974f4ffaeaf6b566f3e20d54ddcb
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Hgb4mBIBhGFzLNiXicJFFRGNzj3
TLSH
T1F465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9ec1b1be1e10be87e067b044cc645ca52a0f9b72e5348ad6a3dc9a83ede67f00
MD5 3c8f5e0002b1eecdbbb10ed57775ff9a
SHA1 47a4c9d025a9520a48ae113dd0a07a80bbd22098
SHA512 b31cf9accbb5c57aeb99ed472e158ec4ed27917203d5211d2acec3d9299126fef916c9baf137d100977db930aa35f8cf7d002afa41dd47ab1e986924c5f63eed
SSDEEP 24576:bG88u8FpJqH1vzria7/mD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:67ZFPqVya7/oLNiXicJFFRGNzj3
TLSH
T18785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 68e2d827cc6713d58be268c4f7e7e7034d8776cd09ca434d36988f64a1e9166f
MD5 9f5288b6f8422cbe700e1a04f6cb54ea
SHA1 66daa7a2f96abf02f2c2e6b14a9154b3f1c5d514
SHA512 598a3991c98700fbeb0cb80dd4dea346d1d1022e0eed6cf8557ff2d8b969a0b2584997f863f028c102b52d9a1991ec5edad085148f38dbf43d9f27dd7c97f355
SSDEEP 24576:kPUr+NQf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kJQfLNiXicJFFRGNzj3
TLSH
T14D65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 af64e590febb6bc835e15dc04a69fffb6c212825bfb6ffdfa8e04da68b3b1d82
MD5 6cf7ef93155278fbbc8dee1ae15802d8
SHA1 38b8b971aa4b0a14e8387dc79486c90f205dd073
SHA512 78ee3e9d84c96ec5037316199d4e5875940ff023308b1a5387314bcd49d04b9732fe6bed060b6e0063031394635b3eb0ae73d1e12f69cd1825d29b5026cac9c3
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvLNiXicJFFRGNzj3:4G05lO43b67wRGpj3
TLSH
T14CD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6f127e49bbbc0f7538d6d9c6dbda692a5fc02bbe63b6c1d894e55d034acb97b9
MD5 3f5ee7394b4a6d228631a17d93fd6cc4
SHA1 c20746893ee66b1c1a7c0375e4f3015701c8f69a
SHA512 39929a74eb463ea86616741e88c39ae5147c133d5c8d80de8a42d7037a02c1610029fea498d2d32c83c7c0b406b3d17170c82cec0ad25d20d45e5e535d81d5f4
SSDEEP 24576:Dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5/TwSfVcYG3K/cJHlnFR+IGNe8jg:7a5POZ3lJt2pasx2+mXLNiXicJFFRGNf
TLSH
T10165BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8af78130c610ae020fe4e31fda84e7a0926ebd7b41e0e22d5b8eba35c1d6c4e8
MD5 612825c8d0e8a9da52d88bf14a423861
SHA1 1cd253a21867dea49dc383a007dced6eb0e7b412
SHA512 f7e27503088933926684228be1a6ce8e78db37d981a3bc9e95770fac2d58cf5e50a644c276c6821916b5eb6416234b3318750ea594b7662cffbbed4f60cde645
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HNc/zEOVHFILNiXicJFFRGNzj3
TLSH
T12F858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 00f050ff4e339f0a0a3b4cd3eb02946002b0e94121880d610e08c79bdbfbf34e
MD5 4628c1a32e6fc7b88179a71820647588
SHA1 dffd859b2dd98dc9d6237411bf8c6e4cbfcee803
SHA512 0196b9bd83b79ff5f1f3a070b7e62e2201279c5ef0f4779dc4629b3dae04413c0d62a10b3c6e9e068f593d13b4a8a0b767ee6fc06615caa41760d3aae4868530
SSDEEP 24576:dzkNvNnaFeYhJNtmZBmh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dzMwBtOmhLNiXicJFFRGNzj3
TLSH
T15F55AF6EA6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7ecaca946cccaccf31dc19f8fe36973203630311a4db59ce01e6bf499b65e5b5
MD5 d870612892aa916166cd7a3ff9bf9d02
SHA1 fcccea6222635ca2651131c6c88f9a9179460bba
SHA512 6631026786f8f0624c40c2d6a8c52a0bd1e58c97d5b210adf819587c7aac1185f5d5d28357027738790207075eca465839095d38517b442101382d6ccdd9f525
SSDEEP 24576:WD3FHshBIYQgAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WDVHeBIAAqLNiXicJFFRGNzj3
TLSH
T1FB75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-85-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/824-316-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/824-91-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/824-86-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/936-323-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/936-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/936-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/936-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1832-425-0x0000021D0AF10000-0x0000021D0B635000-memory.dmp

Download

memory/1832-335-0x0000021D0AF10000-0x0000021D0B635000-memory.dmp

Download

memory/1916-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1916-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1916-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1916-45-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1916-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2524-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2524-337-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2524-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2524-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2524-102-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2548-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2548-15-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2548-23-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2548-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2688-0-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/2688-29-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/2688-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/2688-9-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/2688-32-0x0000000140000000-0x000000014046C000-memory.dmp

Download

memory/3144-62-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3144-63-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3144-205-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3144-69-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3448-413-0x0000021B8E500000-0x0000021B8EC25000-memory.dmp

Download

memory/3448-334-0x0000021B8E500000-0x0000021B8EC25000-memory.dmp

Download

memory/3692-423-0x0000019D1DBD0000-0x0000019D1E2F5000-memory.dmp

Download

memory/3920-301-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3920-73-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3920-81-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3920-75-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4056-114-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4056-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4056-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4056-320-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4056-108-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4056-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4064-139-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4064-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4064-141-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4064-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4064-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4092-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4092-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4092-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4092-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4548-120-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4548-128-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4548-122-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4548-319-0x0000000140000000-0x0000000140295000-memory.dmp

Download