58228d7090dcd4d8a2861c290e8e5026ac95ef7c34b102709d2fc9d88e798151

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260809-xdwzsatend
SHA256 58228d7090dcd4d8a2861c290e8e5026ac95ef7c34b102709d2fc9d88e798151
MD5 26f52f7133e2c20355544355180f694b
SHA1 6977938c0c480bb351c9ba3ca34f8dc994d70d1b
SHA512 b6cd6e01a5b31b181b12d3cbbd3cebb2ea6bad53808f0d1eec8044b1e3e950bd55cd283089b21df8bf19d01149b8cf74334092a96bceccbf0560770078595707
SSDEEP 49152:3+XFr1XxKxQMIGN1sm9nL4gKJZAg1BXVo/cRAdaCYUNCTpiLyONaB0zj0yjoB2:u/G3KPFo8tu98B2Yyjl
TLSH
T193167B17E2B941E4C0BBD13D8A979657FEB2784A877197CB4390861A5F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2856	elevation_service.exe
1928	elevation_service.exe
2492	maintenanceservice.exe
4396	OSE.EXE
4304	PerceptionSimulationService.exe
2628	perfhost.exe
4272	ReFsDedupSvc.exe
2252	SensorDataService.exe
5448	ssh-agent.exe
3828	AgentService.exe
1864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4d2bade0238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c5953332f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6c9d8352f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000489456372f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027be1a342f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094dfd0342f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000716976762f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
1928	elevation_service.exe
1928	elevation_service.exe
1928	elevation_service.exe
1928	elevation_service.exe
1928	elevation_service.exe
1928	elevation_service.exe
1928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1052	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2856	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3828	AgentService.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: 33	1864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2856	elevation_service.exe
Token: SeDebugPrivilege	1928	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4588	1864	SearchIndexer.exe	100
PID 1864 wrote to memory of 2892	1864	SearchIndexer.exe	101
PID 1864 wrote to memory of 5304	1864	SearchIndexer.exe	102
PID 1864 wrote to memory of 3064	1864	SearchIndexer.exe	103
PID 1864 wrote to memory of 4484	1864	SearchIndexer.exe	105
PID 1864 wrote to memory of 4440	1864	SearchIndexer.exe	106
PID 1864 wrote to memory of 2500	1864	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 1892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 1892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 314abe1be122ef66333629720dbba07966b254155ed62dc7b478770da0bd81ea
MD5 ea126900c55c4d6e7bce1d46e7fef7fb
SHA1 cd2d546ef90f12eaa50e84d35fc9ce531aa8a53b
SHA512 86c05f1c5e1c310dbee468e1c7c8d503e42a80c5ad7ab42ac360cf32a3e5c4001436248e4c9fe587c2eae22272ac1d6de577aa2b06ad480382050811f51fd6b4
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkaB0zj0yjoB2:P3q6HjBUB2Yyjl
TLSH
T104D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3f9a12b7408117dd83df2455332c8c840e4665691c43d97162f3f206aea14649
MD5 f22c68c220870780ab5230bb1b4a2ac4
SHA1 e0af7ffbcdecb5c3962601fa2c36fbb29f682874
SHA512 c6419f01cd74e94987d75cca4b6283932d3367ff75a5cbd357a4de8aba92b42b1f803ec33cb7fb8de080dfea75dc5a9b07031819f6c1b290853937a72578da95
SSDEEP 24576:aXYfDtczAZatr0zAiX90z/F0jsFB3SQk4:BtcuaB0zj0yjoB2
TLSH
T14A650229779504F9DC67823DC9A18506EB73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5e4453dfae76aaed098b821ae628924889d66289c54cbd963686d755ef3f2050
MD5 971382af6a0702b7917daf587ca9b0b1
SHA1 0c6c27561438c2d38525b282e62a55d782048000
SHA512 73f56e6196a8db2bd83c64337d6661f0ed458aa89506c950474dd7b3b8c5a55d130c2374cc443a342d8eee41358b148fab2a4b13ec1959c67ee053b6fd5120fb
SSDEEP 24576:o0Le5ji0hmxirMcatr0zAiX90z/F0jsFB3SQkw:oPji0AcvaB0zj0yjoB2
TLSH
T1DA859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 22d9e410614921df61228d98b0a9ab4568715b794c263462f4c10325fd21a554
MD5 e20601b66b087d0a16973b50e12e7e49
SHA1 4cdc4b13f4146611a5bbad6fa4c89fea8a4095b1
SHA512 7becad4b1f62dcff55e1d97e605c8385279321b1729f54e2571785e569317dd165bc2a0a6a587bf05151634329dc8bcf9a01ac80a3b482ff14308554b27c2866
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyu+atr0zAiX90z/F0jsFB3SQkB:M/ezSC6vUzPvxHjyTaB0zj0yjoB2
TLSH
T149755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 23156ecac5a3e08576819feadf0ea92ba5c749d2b8e608459b952562331d06c0
MD5 0621ceb8f1b49e422db08789fcffd0c6
SHA1 8eb786add68048131fa4f67f9633b774a0acf978
SHA512 e0e5a8a8ce903648348d1da3be403de987b42e1c78f98d1f92bfae5412bb1dcd96890df297dfe691a79d37583f50414e74ef3720f6baf256e5f6a584eb383387
SSDEEP 24576:9VbqPb88hv/l+61atr0zAiX90z/F0jsFB3SQk8:9VO88hXl+AaB0zj0yjoB2
TLSH
T18255AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8a38cbf7eda3061360f07398e896ee195bf2063ca87b9cd7a5e46407376fc1e8
MD5 b848624786bcc65f4a7867524e85781f
SHA1 29a13f0ecdd43181fabccf6d7bad938e6d6e0244
SHA512 3a6a8f5141092b3970f5a704522b19be76e71f7581651c402753ddf64d90d6c26c6b6beec6bccade6e7f049a7e4ce119012243aa590e37a174d50afc7f413640
SSDEEP 12288:XRIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:XRIatr0zAiX90z/F0jsFB3SQkW
TLSH
T1E845230B340E80F2CDC32B3566989C4B1AB99EB065E2AF45E1D13F4F9D3C2C696656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 66de74f8ecd3f5b3a7827d37df5507bc99b066b130bfa02193431a1428494073
MD5 95b7ef831886c3fff3afd02ab4009136
SHA1 77dea3713503704f2037a7fc6fbf9ec87a7579b7
SHA512 cdfce3df682ef8dd2f03378369cfa7cc2ffa05c3d1b1650833c274d486731890aacd402cbd3ecf2ae437e20a9d2400e318622d313a8d3c3ef97e4078f6b2a9df
SSDEEP 12288:reBNUbTVO86UNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:rJIUNatr0zAiX90z/F0jsFB3SQk7
TLSH
T12B65DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b0f60253341cf50140a489d8bd9771785be3ec35b1f0a64a587f58087fc819e4
MD5 0f7f2aa39e2fa73dc64a5754faebcbf0
SHA1 2c9e73b97cc78748e7d5a56927f80920603db757
SHA512 42e9e091f87ee0b02fc2cef9f601e6cdf7bcbf3ea9c9ee8933a45fe3fd9194c78d471b3313a42e3bc1e16e106da06cacc84edd1832cafdfd3654a26b578e0167
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:bQvGAdlCEL8c/yRNw5C5B2Yyjl
TLSH
T14E267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 43d20e4ef7e224f4a05b60b6c193a09978486e91ee72fe2b81dd38659bbabbef
MD5 3cb43c9813b594b3f64cce190204d544
SHA1 2a431e6ce9b1518ae96435d602f2ea48f38ce426
SHA512 00ea61e8edd5cd14176054cb200b5f88cd0eb33ee297d9efb26c1fd170250db7f034e4cebd9f26c856c7f43abac91eeebd86599e00388953e75485216ede5a0c
SSDEEP 12288:VAwSfxL/2Dc34DLLmt0LDQewsAj/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkH9:2dewsAj/atr0zAiX90z/F0jsFB3SQkl
TLSH
T15375E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e99336bb7c95b79d64c3201c8e57c740fd8cc0269a2645f1cd40d6a0a27b6c59
MD5 62c15963fffb6c7ed8170ed863a432c9
SHA1 913cbcc72a048cffd1036ad2ba9c99109b56904b
SHA512 12621b26a8f6413f7861acb434e1dcecb79abafd17f694b1121366958dd70d2cf574f386c2a061960d09fb9d99f7656f70b3c51e3bf12f9caa09f4c2bf5b3084
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHaZ:YUEtQevvqc2W1cpV2EI32c
TLSH
T117474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3ebf4c6f898f1ba8bbe1db51d5a09d0bae5d7c4a0976ae174944eaad426d7245
MD5 af1695435030bbff0d81c97d62b0098e
SHA1 7607cf9551691bfed578355a9fba83628304d43a
SHA512 b95734804465a8d34c8a7e8639d79201a9160614e97396ea8be1567d0f216a785753033348d72b142ab9eafb9ad7272c92c487f47fadb96dd6a762a7b1a5b08d
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zfaB0zj0yjoB2:KoqtVjnm1B2Yyjl
TLSH
T14ED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 711877df73124eba837a145c8304e237e0e4043c7a174099fd7eb88c2cc0f797
MD5 f5d19bf1990fbd95e21ca99425eff9de
SHA1 2fa304c0f75a9bc042ebfa71c6361c73760c10e2
SHA512 6092b33e4316ce658bb653ad11e306460517e29ed63dc6b9efc277c6a20f9029b03347678beb6a34790b16be0b153f7dc79ff423fe789f7379faf2eb9b1354fe
SSDEEP 24576:xAhGLJIFoiwtA5l7S53Satr0zAiX90z/F0jsFB3SQk+:xAMyFoiq5CaB0zj0yjoB2
TLSH
T16E359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 59c6a0572b8561d0ed890cbad0a47298ccaaaafb4550e3f2a66aaa83792d7f7e
MD5 76963395733c9b4863a03a3d2ab3a8d5
SHA1 184335fd0178169ecd651ddd1bf0317bf7ba6113
SHA512 8b2ad028bce8a45ec2d4bad3bbaecf55055b4aa00586d7b75399fd294814ea53f6531fa5bff6f94377580a2b89597fa136f32c184b3723c54c19af2d08edd6fc
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:qwuoOWzatr0zAiX90z/F0jsFB3SQku
TLSH
T11965F14A32A90CF9E9A342388657C536F7F2BC112A61DB1F1360CA5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7426d5f92a5c94561b509c9035c36a91181ded1abc4e22dd523f5c57732d7db1
MD5 796a9cb74a764edc560a74bf98a41b45
SHA1 670a9dca59e9cb7fcc4e6b15bafa5d133eb5cd73
SHA512 19a53a6824e978608d02aebf5a21da9f3e1652470da416667174422c567f5a54309d5057c1551a0366c062f2c2a731f46c8908fb339dc87261d1d7a3f899a5dc
SSDEEP 12288:uBZ1IyPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:oZu0atr0zAiX90z/F0jsFB3SQkk
TLSH
T14255124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4b4b05edf484d6e655b51b18fc417bed66c3440bbdbac3e81c2c207ec6d2aca5
MD5 3bde24a3495751d696fa600dff27f4b2
SHA1 d312732789cf360c38ccc0dc47c0794844f9e92c
SHA512 39bb78e03899fdaf8825d7d582032d631786b21760c309648e650ec4a8200c0757303670e9edef297b22753b95e583a882dc55d0679267a9210ad998aacad57e
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:lQRQyi36YOcPQLvw2gAf+PN34B2Yyjl
TLSH
T17D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 847e2133d8bc0e854755a76446c756367cf38442f7795f06b37da2a51d99526a
MD5 ca2b66ef1c556522e1ad77e1227090d2
SHA1 c456729116731730be80a580f2699ed5fcd5e44e
SHA512 11da8e0f00108bb214ec209f7ca77db034867bf4167a5469f01fb50ab8ffd89a403f251a905515f44f98f66af879b3abbd52f50b54da885fdb908e460011d8ad
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:fQRQyi36YOcPQLvw2gAf+PN34B2Yyjl
TLSH
T14B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8e6f8ef10cffaab9e2e4104deee130d355b85db6ab85be7ed7ea68b5e8723bae
MD5 a2858421a6fb734409101f5ef0215541
SHA1 c2fc4aac5ea2857e15322876f2037df5332e879f
SHA512 72c0d26aa2a1b45dc9d5fd89a224ca16afe4567849ce5ed7c63d3f18be0d072b19837f04c6e2c65360de7d8163bf2859dc444b8e8c57bf73edc6787b733c50f5
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0katr0zAiX90z/Fn:X68Qg55nhheWu7PNU3/vaB0zj0yjoB2
TLSH
T17EB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e76fe52b36306e1385048dcba59e481876807f68db1482d43dcaeb12f1f15983
MD5 cb319609609d78a63edb160b848beee9
SHA1 4a7c5e1a1584cdcef7bfbc811c50deddeb838d0f
SHA512 f2df4c85b1ec589fe738d36e41a75a92353584e7b66f7b6582e65dec14d5e093c22d6d755a0cc141d3d563dedae17ebf2721712911211a1510d054983f7f989d
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:py5112gYy5azzVvL69nLKnhZHB2Yyjl
TLSH
T198167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d34bb044cb0212871e0dc87f76de6a6541d48b5ff755853932256a05d4732c9e
MD5 d78da0f455dfc7b8d657aa63986e654d
SHA1 0138f37195320147c3365f823720cb0dfcb78f4b
SHA512 29eb9f895d04cfcadf89230ec5cb4b30f74b6880f6396a981e076148f6aa89a02f0f48dac19760f928add3b7d0379dd6a4afe682c1f9fa3966c541de0b801663
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMaB0zj0yjoB2:gu6JmVxd2dDB2Yyjl
TLSH
T195D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0b035aa0cb7d03ab50e01481b86489d57c77263ff0ae7b355f38eaefdd375443
MD5 56883ebf6e14f36dfb3e6eb44d04194f
SHA1 5cc9e1531faa72f960ad93049dcc2b9a0baff364
SHA512 18ff39cfddfccdf59fa5be23dff97aeb14651160f7f21dc2fba2a05f84a8f1173a2a05b36b5cff29ed07532e0e0d52c2907c405ffb39e7615a9261284e4c3bde
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xtaB0zj0yjoB2:LmifPbR1B2Yyjl
TLSH
T1D0B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e8bb462f29b3311680e3f58241abe27cf13eaeb2ee2780265cff526203547c0b
MD5 82c128945ee5f801d7c288fcf31627c1
SHA1 c78a278710fd9ac0849128d9e8e24073386219c9
SHA512 2148c341cc271a0a9caa0aa31ad6f0f15bf2e956ebf8658eed97a5c8eb53c8a20d7f51e3251d2bfdbbcecc3bcf14f74282cc76f2bf40d05f56f344bbdba3b926
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHq0aB0zj0yjoB2:U5dKTi61rB2Yyjl
TLSH
T159C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0992e11a044ae6d51bb8ba9342ba6927c083bb2998a661d458de90a5a861481e
MD5 f463966526b5f7cac11a56999f868ba9
SHA1 ab68312a9cb7a1ab57c918aa5ffd731bd1bb5d9d
SHA512 9ad13bfd86145228deb37d24d213d711528524de7c82bd0832a7c65332d78bf794875a3408555ef58452da775c7a2c6856fcf2211e416c37a0d6a9cdc8a0ec0c
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wZaB0zj0yjoB2:DX2iyphhB2Yyjl
TLSH
T19895BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 55ac807e864bbcc12af868b1853a6ffbe16750458594b659616905d3830c3efe
MD5 cf6b65266b44faab6b240c0b09269cb9
SHA1 385abaf5dcb6af42f80ec094e59e8838f02fb139
SHA512 b6a26841bda6f9be4f5e180ce5171efa3e3f93c450dc83ca45244e56b9eb8c38880747b59eaca6e84119d438ca456d13f467b02daca50e65cd755b09b3e1aadc
SSDEEP 12288:OAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:OAatr0zAiX90z/F0jsFB3SQkX
TLSH
T1E945230B341F80F3C8831B355688984B1AB95EB4B2D36B95F2953F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 bdcf6b8e1c73f00a032627e17d36467e2f08024f32deebe3b2f915bb5f59a977
MD5 3baa6ef1c83fa5f06f7c1fdc3e410670
SHA1 f7613ad3effcc8707e3fb9ca205fa30270a8db02
SHA512 43a1e1963ba74c37469497e28e5ae561fc344cdc9e85a0b6aa2526c248263902e97165703c310d8538179b0aedf0198153b202ec70eb88fc3e3028dcaa7862fd
SSDEEP 12288:C7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:C7atr0zAiX90z/F0jsFB3SQkX
TLSH
T14045230B341F80F3C8831B355688984B1A795EB076E36B95B2D53F0FDE382C71665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8649e6a2798a08a795ae861b23b29bc8aacfc452f2ad2bd49e30d2ad9108df4c
MD5 183c6aa16e9801d418a90c7222a16d5f
SHA1 1aa69109d54f34e4ab81e9768a4405edcef881be
SHA512 e406c5f5b4a1e90ff7153c74504ae4a6515cd2360d77356bf7cad2e055506fc194403eaf2cd61c10816c58c262017ae65e6a692b89866fc5ccef5495eff42c6b
SSDEEP 12288:alUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:alatr0zAiX90z/F0jsFB3SQkU
TLSH
T1E345230B381F80F3C8C31B355248984B1AB95EB476D36B95F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ba3f0779ce18f94b8b8ed0cae7ef9e88eca6e5df91036e3b92d3210ff20c3851
MD5 100757f3508e0eb88531bdcb4fffb47f
SHA1 b397a46c8ef2c690013cd5aeeb559fd0c1ac562a
SHA512 caa178ce3eee9fb25c8a1d1b1a5f353ba7c01ecbfd1a32cfea8f3d9e60fa76c94866b69bcfede1a0b54e993cbed30bff0f043741d935be46048abb3418369cc3
SSDEEP 12288:2VyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:Hatr0zAiX90z/F0jsFB3SQkH
TLSH
T10045230B351F40F2C89397398654884696B9BDB0A3F3AB9FA2413E0F5E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ef2791ade78c265145ffecbef82b62ef0db2e2ece90564f93c5b9c718d202586
MD5 2cc327cacc39eee1d50d1948cd488c69
SHA1 2c3ac55c9cb9de032199a714bd4bc424a26e37b8
SHA512 6393b04bca0bfa533ffa85c4f8e46871fcd3855c4850eca428687579a59949263f4f418f5513a44c03dcc107f1d39c742edb5c47430b090c48ca6f890aa3faaa
SSDEEP 12288:G6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:G6atr0zAiX90z/F0jsFB3SQkC
TLSH
T1B145230B341F80F3C8831B355648988B1AB95EB476D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 58a5c8d2c89edf229b225393dcd30d69feb955598a3f928f08ea58b5359eb044
MD5 255c82ea00be84a7c20119e30de51dac
SHA1 6747dd27e8505d79f196fad6015e4f75a474fbc1
SHA512 0511e14ac7b831c13b59545c8faa4e300f6f7ef849ffe19f5ceffd76a7ef7fd4cd1a9cf972f3088e2c9968793c98a91f8f669f4326a9a529474a61cfcea1fac1
SSDEEP 12288:c3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:c3atr0zAiX90z/F0jsFB3SQkm
TLSH
T1D645230B341F80F3C8831B355684984B1A795EB476D36B85B2D53F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 601bf3f4e830e3b619194ec8ab20b85eb092d5b091623986b5c58034776db864
MD5 e754f7c761ab4a86ea8d2a629579ee6e
SHA1 2a01d4ec0a660b166b9a0a2c266ac26aacae5575
SHA512 11eba5d0d4f1c64be14147e457a0a887b133f729f93d90928f81895e8f34d8d244e949d84bcdde250854ddc3b7e823bb403a02885a8035c36539e52576093ea2
SSDEEP 12288:UjUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:Ujatr0zAiX90z/F0jsFB3SQku
TLSH
T1A745230B341F80F3C88317355644984B1AB95EB4B6E3AB85F2957F0FEE382C72525AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1dba42fb67f59d771947c212d4192ff68f1a19b48e33909e03d9b81a6d515c23
MD5 a99f17337b1bd640deba3ade27dd7a50
SHA1 c0b2d3f830ff0dc9fd7b74b690ad7e1c46bd6555
SHA512 2c850889d5d023fe0bc6014aa2a4ed23c6959065c18e1bac5a43f1a901c715e179aeec23077433dbcce8ff48c1cc74d33b6d6d32cbf08bca61afe87cb7968215
SSDEEP 24576:uZMSzFVSObatr0zAiX90z/F0jsFB3SQkc:uZMSzfHaB0zj0yjoB2
TLSH
T1E665019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f79f998b2ad46ad457ef1cb82ec4650e520d1000d80668a6d456e1fc2db09b49
MD5 c2f45b70a89acb6d78c25592f4108ed5
SHA1 b3982db595c12405ec68b66fc5866c17adb8fcb2
SHA512 a6850e71d77400934ded017ac1de7e08dc6ea71ecea36fa84c84ea8a1d273afbeb20f46335b969dfa0b545441bf57708f318453ae8f7b65cbce7b8aa5e140aeb
SSDEEP 12288:bEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:bEatr0zAiX90z/F0jsFB3SQk5
TLSH
T1A545230B341F80F3C8831B355648984B1AB95EB472D36B86F2953F0FDE386C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 084b97809a8d45d906e57aeed3d9408a07d54305e12f25e6323a08a4ea32bd4b
MD5 267ad7294f1efbce1b952414ed5ffba5
SHA1 00787a72449a409b5056a52397775612e155ceb9
SHA512 afb1026a37dc98c9c60cd19236a142c42fc5409d6cf0f7aa29af4388bfe34861ff0f73d90295726ebe15c7bceafaf5be20ad0c915fe376f308ac6b04cdbde897
SSDEEP 12288:3YUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:3Yatr0zAiX90z/F0jsFB3SQk5
TLSH
T16945230B341F80F3C88317355684984B1AB95FB4B2D36B86F2957F0FAE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6437b1cfb56586e9e483b0c242de5bcc4ab0e957e797df58e41429c50183741e
MD5 c661a00cfcff35fe7b33bfdc37cd695f
SHA1 7ef7f5f3d3e9341b7932400df1e3cab8079341c1
SHA512 e0168d8bce5063377d8f607eed6bb44b18ac7a85d543e5bb8abec9dea8b93ba73201870d3cc09feb47e4601cde1fc9b69d9637e2ecaaf778f5c87ad1a3f2f3fc
SSDEEP 12288:1yPz5L8PUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:czyPatr0zAiX90z/F0jsFB3SQkw
TLSH
T107551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e6801c85a1b8ab375d59070c23a554fad56e0c1c2add4c82203955140750063c
MD5 45ce8bbce5a7a2a64aa2c4c3ec45aec1
SHA1 5751c51f37730a3051f8b116301cde4bdc68ee4f
SHA512 24c14625077fd8ec249ba43f8091ef77f2af34bdf98bb3ff26749ea3ace5a10012bba16fc44b1572ea10c708495f100d11d7d5d7b42adde6a6d743684f54ed54
SSDEEP 12288:vEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:vEatr0zAiX90z/F0jsFB3SQkG
TLSH
T1F745230B341F80F2C8831B355688988B5AB95EB476D36B85F2D53F0FDE382C716256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 26ccadd2ef22751e0fa5fe9a7b69ec3f32d447b009ae188e4c66a9c4a765fc8c
MD5 972a205a514d3f99e4ebaa3228c2903f
SHA1 b0a007e1fa76c1b174bd9ccba574b2840b4a1f4a
SHA512 73aa0258fbbbc58a398c62daf6d005ede4363d039d6e8dc50ece12c73ec44ebe83f7a4f85c5fc1f32cfc03dffc515c05be4864eb4f5196b63fed97a750c6a5e1
SSDEEP 12288:9EUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:9Eatr0zAiX90z/F0jsFB3SQkG
TLSH
T18945230B381F80F3C8831B355648984B1AB95EB476D36B85F2D63F0F9E382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1e80e4d8b92c8a05bd6cf31e3e8581b9a5cad88ed3c2c3dc96b1ad85cf15f925
MD5 5b2713af4dcfd2834054e0152ca13231
SHA1 4bf486dd0d1dd4723a32de57b1247c390ad2adbe
SHA512 0dc4feffdb0735a825550c2bb6c247c1ddd14534d880eef1db5bd3d2f37fd10c0b93cf8482fa9e7b0810a8a3d4c8ffbe8725a39f95b655bd5331548b6262af43
SSDEEP 12288:0yPz5L8PUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:tzyPatr0zAiX90z/F0jsFB3SQk0
TLSH
T183551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7a74e14df1ad1d5ea7df0cee6c678c545c7792b5892a0a3d406065ab81ea2aa2
MD5 b7f67a086ca6120569466acc83db6978
SHA1 5fd7bfa69cd3736c8926f6b790ec11e33f9241ad
SHA512 c38239dd5a156768f6455333f457c00e310d25389f6b0a1486b0fc8f492568c02f669fd273ed7218997bf53da3674c10ef38144a8dad779a417f60823c5cbebd
SSDEEP 24576:xTHaLl3z0zDVatr0zAiX90z/F0jsFB3SQkA:xT6Llj+aB0zj0yjoB2
TLSH
T19A650199735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b1c8fa18f4a60dc0b9c4da953a296750958e387ff76a674349e4d7212d39ad03
MD5 69e7533a28b5b3b46260d607d22898e5
SHA1 64ded8dae09ef1c4562b41913a0eb00cbf451ea0
SHA512 e578914118392606c12f17e403f437ff5644130a02a85e581dc2f4e8aa5c82c624c5f8d23e243211b30e353073dad43ba668096018a863516f045325b946d52e
SSDEEP 24576:O37d9CHKy7GZxatr0zAiX90z/F0jsFB3SQkV:Q7d9CHKyaHaB0zj0yjoB2
TLSH
T1ED75CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 032c37d27755ba4259f0a649209f6910b4123daa1d02a0cd949b89f88517ba5b
MD5 c4b11d1e40359b26b48e33a6a8f90dd7
SHA1 4bfd047b1bbe93705da92d7361bd86a3b3a267d1
SHA512 add7c49e94a688dddb4078da7418a082dade7fc62fa7db19037d626064590e3029fca500bec95a29e5bdb6bf6771f4d714ad85f7317a4efc556c5cbb40e0f07c
SSDEEP 12288:5FUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:5Fatr0zAiX90z/F0jsFB3SQkA
TLSH
T1FD45230B381F80F3C8831B355248984B1AB95EB476D36B95F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cbee24d94d287abd2c67f494b17b4bf105a54e8c28e18f8267d96eb81e92953a
MD5 3ff1b0f02de2fa0fafa9d69f96c73476
SHA1 007d0117b21ec2929ce7afe299e2c61bc4c2a063
SHA512 49b3eefb9ca1d5e61298c42414fffeeb19e65ed0544a823cecdab9edc7ecf3d60da405a10419147ec39c9630835fe15d6af049506ab5e491bc5d9dd8c7127d34
SSDEEP 12288:1vUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:1vatr0zAiX90z/F0jsFB3SQko
TLSH
T1CF45230B341F80F3C88317755688884B1AB95EB4B2E36B95F2D13E0F9E3C6C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6f348bbe7c868e2eb9babce931caabc982c6b5b6aa286f181738bd40b23ba018
MD5 6452f045e1479c26b976003398cab6ed
SHA1 0f4db8214bbafe8e1e3d58f657c3a1e6e7424b9b
SHA512 a3aa90dea3e1374bb9ae2db087d178641a7d101b80de4834482b67237aca2eb2331c4704bd1d61b233710065aced6f035a15a12701eba514224942c5dda06781
SSDEEP 12288:4mUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:4matr0zAiX90z/F0jsFB3SQk+
TLSH
T1E845230B341F80F2C8831B355648984B1AB95EB472D3AB86F2D63F0F9E3C6C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3c4fbf86fa8c8f7ea2b5e82991a882fa70885b7f7d17ee60a52fb7a7d0fe3449
MD5 43321ffd02e99572b6aebda14b6d5f2d
SHA1 a3dca0be27c3e44e69dabe1bd1f8e4a0bac7985c
SHA512 4f5e488f63593d536b8ce88913659a288b332fba955124fac23df354be7fdda231580e39eb679698026429b762fdc736f9825e0730d2efdd7dc0196b4ba7ddf9
SSDEEP 12288:zEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:zEatr0zAiX90z/F0jsFB3SQk+
TLSH
T1AB45230B341F80F2C8831B355648984B1AB95EB476D3AB86F2D53F0FDE386C716256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9c851d684ff5b390b2fc23d30d88250651b249f0590a8d9c1370f5c53e58a65e
MD5 2f9e16058775ab6bd1c0bd033cba46fd
SHA1 480723a7a9d07023df4aecbc5574bfbca611f663
SHA512 029e439a776399db6f232f4494cf458313a6db41529a04486423d941847ee43c6e9bc7c868492475399209677923dee4ac8c67098b0be1007f9f94ffa049bb6d
SSDEEP 12288:WFUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:WFatr0zAiX90z/F0jsFB3SQkD
TLSH
T1C645230B341F80F3C8831B355648988B1AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 870cb32bfd5cf9cd69a0a11dd02380965493a4514e542ac05608e0173cc5c730
MD5 bd350b700ef106759f4e13c3a37c2faa
SHA1 d3cd868960ca029e8a5f4d8e7b36887718824dcf
SHA512 7e4c26b446a14619a31c877db1546b8319d4476117b11ff86d28523d6aae8beffac06d5cb0fa1333b18d5c822eddb1fcbed775584694c690ce840f6da2a7ade5
SSDEEP 12288:cMUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:cMatr0zAiX90z/F0jsFB3SQkv
TLSH
T12045230B381F80F2C8831B755684884B1ABD5EB4B2D3AB95F2923F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 72770c9723cb568d39e900c40893c2d585d4061ae82f7b7b8312466c872483ff
MD5 846d4495fb1615070e4e9cddd1bf3efd
SHA1 e0041f445d75a489eedc5a59be3f9034fc17d84a
SHA512 a904e2746d58ada3a36719af3ae4a83775730a751c567b7fea96ea218cbd3e6b354b17cef7d2a7ad5b6d61acdb67e662e9d55c67f01662bdd450ddadee62a0d9
SSDEEP 12288:86UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:86atr0zAiX90z/F0jsFB3SQky
TLSH
T1AD45230B381F80F3C8831B355644988B1AB95EB476D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 2c9fbefa7a941de676edd36187dbb067ac1a8f6f4feb843e56232d594dabdff7
MD5 e56ec7c7d075aed6fd9d5cfb401883b1
SHA1 5f1ce461238813a02bfe56bcef16de4c1d346be9
SHA512 a13e0fda989f06256ae674942f191fb24eed26acd3b595c992aaf2057aac321bc81de2f1cfbd790ac0b62165b9c063bdb204668fa7ebb0e192ee576392c0f591
SSDEEP 24576:Wfwvok9RX6wkyAIoatr0zAiX90z/F0jsFB3SQk7:aMnYIoaB0zj0yjoB2
TLSH
T1F085D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 63e22c338c88d42e9d84504c2d5191af571067b95113b6b60bece57d282fdc77
MD5 967a560b7aab85ab6a01012b6471a1f8
SHA1 8e21a71d1c719d568d435aeab50b962916ad5272
SHA512 658a82b7a16710d0c4c26c985b1ab6f9251f9a617d52bc65d53cb77f31b2f759254bf85d1d32675ed91c82dfa813fc9462de6d0cbdfc82fe76e9deccacde2eb9
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05aB0zj0yjoB2:fySzPYB2Yyjl
TLSH
T12C066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3e04bb6c51c03373a499f1adbddff85e4842077b4a1335161821b27d152f6eca
MD5 35feb272d48764031824b5d7c9491b8f
SHA1 362de4c0f24ab6ed7370428f1be107faee29321c
SHA512 7d43a2ad6113a347a4ed974f44a3f9c38add9e414565fe9e154454a1b0fbdde14bcb8660b732b4a486ca90fead6d62777b3e801431e6163366dac7e2500e22f3
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYratr0zAiX90z/F0jsFB3SQkF:k47JUQj1irIhCnDHUPfF/JaB0zj0yjos
TLSH
T18E65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 eae7c3e7e80d075dd7b373c3af0ca7276400029d776716ce81839f20e0ae964a
MD5 9632a17d39ef4bde9b6ac7f73e099c00
SHA1 62ebfccf816231069792e8600489beb0dccb9250
SHA512 fe72d5363c54c11cc31776a723d0418bddf4133cc66aabaa421f3288e73653ddfc3bf9ba7857839787e813acee9243f494326e171e2fc679eea16828a63cab1e
SSDEEP 12288:bNsf0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8p:Y0atr0zAiX90z/F0jsFB3SQkO
TLSH
T11555F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 737d6da628fc3ee5200642830d7ba6ecdb322fe980c4eab449f9a9d45b2e1f4f
MD5 ae5eb9b3bf75656927d3b1956100dd63
SHA1 778d64c463e50d38371609f55aea7151a9412614
SHA512 1e26ac154a61ece57be5592429f46358ed6cacf7bc55257d6c67c23630e66ecafbe357d276de76801fdec6ebcd0478a030138de8d00ee29956053099917d37bb
SSDEEP 12288:UjbEcy5oFxQD96EZM/3zWlX9h8sLO1dj3ajkXw/Gvzq:U0cBbO9hqS/l8LajP/G2
TLSH
T1DD453950762BD75FC6AD40326E32D6CCAB707C01EE456B0772C8873FC576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a26b73c9af44db228ce45c4eb3c15d7865e82651e71dd917a9595a1b9ecb6f8f
MD5 ea62fec9247ab9c7ce6e72830c1aae71
SHA1 9055798b0b07a4bf64fcaebf9449ec3a0c5f9eb2
SHA512 36dd5737ac4c000b5a2700b98cd5dea0050835670dfc5ad183bcc0fc5e171ed0bb09418cdc36279593da002f25bb7b45cdefe82170adabe155eb6720019c555c
SSDEEP 12288:CgLY7WbEZ6EZeERaEz8ll6EYb8UzGzawGEkt+:w3D7untUrt+
TLSH
T11365E841A537E38FD1FB6032032A9B4DAB64EC0277056F2677C8453AD86A765B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 805dd8ba6befed7661a37f6f07aff9ddfebf28f223108029cf0e97d982f9da5f
MD5 3fe0ead0272f27241098a54cf7c14ab1
SHA1 5a512842f6511b7ac5ec6b4a961f3aed31cc571d
SHA512 737ff7302f99d1456ec5a6a49103f9aba68d8fc12805f924d63d1a09480f15660820ad800fb9a12eefb955922fb31f8a5530fe683915169ea81e8d04589dd2db
SSDEEP 12288:2M78UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:z8atr0zAiX90z/F0jsFB3SQk5
TLSH
T124452307351E80F2D8E32B3416588806267EBA746BD29AC7F1413F4F9D386C65E75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 74a10825a65f8d987b2a9779ec73edd5b67f5e5609a03f60d92a4b6552eaabbc
MD5 9e9257a04903535c373097bdcc92d191
SHA1 2cf13a05c318220333eb41e5fbce7b774650e261
SHA512 85f1c2fb0a7eb6312ba3f3338dcc376d49d274a42fdc24860f2fde429ccb62b3668a57cf331bd0fa934610a7eb4dfa3c22572e3e5190a27e279942354394c32a
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bY+atr0zAiX90z/F0jsFB3SQkL:tgb4mBIBhGFraB0zj0yjoB2
TLSH
T1C665AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9ea1fbce5ffc4bf8b4b9f3f9b081fe4db2a2143bd005f1915858486b2c107540
MD5 a0d484c00299793161ef9abeac5b86fa
SHA1 f2688b57bf60a02964b686bdbc79ef36a71af27f
SHA512 343d54ddb8a1761360b2b76667fce00fbee11facd6d3215fdf6eb5b666d4e7311058883dcf397f7b0554e7faff2782710df802dcfba4c594a7c3c6fe6f1ab14e
SSDEEP 24576:rG88u8FpJqH1bzria7/mbatr0zAiX90z/F0jsFB3SQkP:q7ZFPqVea7/GaB0zj0yjoB2
TLSH
T15A85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 90660d4e753a0c86a8b793a4ff9d186eadc5b6833a2ee5081d373b7bbb0df0f9
MD5 46f02f39e651215b2cb582bb66f758e4
SHA1 e605ff5e03851b14dcee8662c048b7264895d72b
SHA512 15c601078ea8dee49a1ab0441c819a37dd4406b98474473a984a5d3a2840e2eb975ab71888dcc0a5d86e6b80141641d7b75113ed7f5bc88d27d403b3911d8255
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3aB0zj0yjoB2:HG05lO43bvB2Yyjl
TLSH
T11AD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 530d7c95be0e39b7ffc38d2d4352d0e199d4fa55bbd8c69c1254cef42348bd51
MD5 c1bdd4a26318e03dd7583ef6c73724ef
SHA1 4b00e0e5fbeb0014aa7503825030e663b21c48a2
SHA512 c0832cd54fa113c5cce4c0ee58c6fc723c9548db1d4f673777eef29a86f80f4803328e9149faca039f8ae6e309a96ff2cc576719a04515ca4feeb09c890ccd9d
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidn5atr0zAiX90z/F0jsFB3SQkV:Fa5POZ3+Jt2pasx2+mvaB0zj0yjoB2
TLSH
T1D065BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 eb47ac433777e2a9489fe5c1e5af6f4a266b5f89cda30ddbcfb958cc563b857c
MD5 11e118fdedca4160327ebec20544e970
SHA1 5beb9eb730e8622491eb67a20aee8fd1d7667bdd
SHA512 97c006e9119fce385ec5fd5e9fafd4f8a78557618488043733c7b0a824afc967a38693287759e8d4ccdad0cddc2bd73d1bb002401033814bec081a2f22022f82
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkTatr0zAiX90z/F0jsFB3SQkj:xNc/zEOVHFmaB0zj0yjoB2
TLSH
T13B858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 02f710568c55f3c0b71e0c3331824fe92e161e3c53047b630862b1fcf7986303
MD5 7a2fd67c6911d0102201ab57a1b617df
SHA1 5d9f38c44726c9359b467a8a6a3c9af59d701419
SHA512 a6ee0e49e0cb96613ee171a51b8b6f675a8f79d50ab144904605ca79876b86363bba913c572bc76471d26bcd9ae39e48f3ef46eedb8d0ec24ff93bc43d12723c
SSDEEP 24576:z8kNvNnaFeYhJNtmZBmQatr0zAiX90z/F0jsFB3SQk3:z8MwBtOmQaB0zj0yjoB2
TLSH
T14355BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f864c7a0711e7b9df62d26494ef92872e89eb993e743ffcf89edc5c7e42bdcd3
MD5 082f9b96a771453f0daa1053bc637ceb
SHA1 e766726c4f259404e67d7283ce0a2220601e0fbe
SHA512 a81259cbaeda27d374a397075a43854d9765e565880fa836888049c7aedc5e2e3e808283c02bb70d9ac35ea1b00ebec5d7f6543b3a5c421928f3f97cf1b3e8c0
SSDEEP 12288:yHvUrBFrEjwaQHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:yPUr+NQHatr0zAiX90z/F0jsFB3SQkN
TLSH
T12A65E11F22AD18E5E677A17D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 df2ffc9819d008cb2bf2bcc52487b827b6c967732cbb3378f4542f44a6e79c99
MD5 bd3b9f0c0ef527e7abea3439f4245196
SHA1 31bb09ec3e0a6c4686647ce25403f1b6913760a8
SHA512 92c06512652ab46ce7104b32d395d46f28ee93d9e1ab9003767f28da6d42e694c7095694aa72adb9279518c88f7959413087a4f6e76c147a428a18544882eeb8
SSDEEP 24576:bD3FHshBIYQgAgatr0zAiX90z/F0jsFB3SQkx:bDVHeBIAAgaB0zj0yjoB2
TLSH
T17175E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-1-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1052-7-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1052-0-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/1052-8-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1052-30-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/1052-22-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1864-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1864-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1864-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1864-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1928-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1928-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1928-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1928-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1928-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2252-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2252-323-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2252-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2252-117-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2252-111-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2252-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2492-51-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/2492-61-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/2492-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2492-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2492-57-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/2628-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2628-94-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2628-89-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2628-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2856-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2856-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2856-31-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2856-32-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2856-24-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3828-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3828-145-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3828-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3828-143-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3828-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4272-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4272-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4272-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4272-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4272-338-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4272-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4304-78-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4304-315-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4304-84-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4304-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4396-293-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4396-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4396-72-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4396-70-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5448-322-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5448-125-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5448-131-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5448-123-0x0000000140000000-0x000000014027D000-memory.dmp

Download