6fe1a06baedeb5f3a73fa6617a5b7598ded93507571301c1974cc42c814e6c02

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260810-exewhaar2v
SHA256 6fe1a06baedeb5f3a73fa6617a5b7598ded93507571301c1974cc42c814e6c02
MD5 9a1dcf540e4b9573e0c4295481e97fdf
SHA1 61d2d4d7b06d16ad20e045e04c1da18e5707a06a
SHA512 1d17fab4582eb367e0f37ad651512043ad11d624a45cb75d257f6cee6dac39e87795a54879ba9c9ac83a79c3edee36ee2fd844c12fb18672b8fd6d490e981003
SSDEEP 49152:eQdP9wBQI+/sKCM6Gt084hwcEIm4QlhEha/c1AWpMSEHs8/2TxUBaB0zj0yjoB2:eWsIMqloB2Yyjl
TLSH
T1DA267B1BE6B940F5C0B6E1798A579617FAB27819873297CB4790470A5F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2076	elevation_service.exe
2216	elevation_service.exe
5892	OSE.EXE
396	PerceptionSimulationService.exe
2508	perfhost.exe
3204	ReFsDedupSvc.exe
5980	SensorDataService.exe
1232	ssh-agent.exe
3172	AgentService.exe
2156	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\392c38b683806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-10_041901_4628-1760.log	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e0206687f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a8c90a687f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051ce8e677f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078e394a97f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000675b98687f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0bc6f677f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cdfba677f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2216	elevation_service.exe
2216	elevation_service.exe
2216	elevation_service.exe
2216	elevation_service.exe
2216	elevation_service.exe
2216	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4628	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2076	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3172	AgentService.exe
Token: 33	2156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeBackupPrivilege	3204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3204	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2076	elevation_service.exe
Token: SeDebugPrivilege	2216	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4704	4628	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2156 wrote to memory of 3516	2156	SearchIndexer.exe	101
PID 2156 wrote to memory of 5424	2156	SearchIndexer.exe	102
PID 2156 wrote to memory of 2648	2156	SearchIndexer.exe	103
PID 2156 wrote to memory of 5064	2156	SearchIndexer.exe	104
PID 2156 wrote to memory of 1840	2156	SearchIndexer.exe	108
PID 2156 wrote to memory of 5776	2156	SearchIndexer.exe	109
PID 2156 wrote to memory of 3556	2156	SearchIndexer.exe	110

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9a1dcf540e4b9573e0c4295481e97fdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4628
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4628" "1376" "1320" "1380" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bf7531b43f877eddade607576772a0bfa4698047f28a60bf5ceadda3a90f40b5
MD5 96069df6fdce523f524121be7d2a3ef7
SHA1 ef98239362106ab02f57abfb3aee12a5f6529410
SHA512 66c2a256a7d1612333fc40cda17c0c44f2d9ce916638f86780c0fde9d964bb0a3542f78a0fe935a0ce176aab082f7c51248298eb4044c2e405d5071c0e9d2730
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7aB0zj0yjoB2:K3q6HjBVB2Yyjl
TLSH
T102D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 162f2572d3127f9df7b9b74eb10d640479b175c40d1a334b96bb151047b801f0
MD5 09aeaacce897c0357737541b1dfda843
SHA1 b38a0872f443ad1df1a5e58d6c839ecb710e0b56
SHA512 34fae6aa5667e71e320db87c1961744ffe534a5b5803bbb4133d1a8d1c2e036b9d0b51226feaaf682a448df418c7c7931c6a0df3caab3aa1eeee3e3e2398f6ad
SSDEEP 24576:WXYfDtczAmatr0zAiX90z/F0jsFB3SQkw:VtcdaB0zj0yjoB2
TLSH
T13365022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 38217a42bc3de184132729d2575d9e55b6787a1476079f5f62fee42c493220cd
MD5 eddefb467a590a290e6c7709fc708686
SHA1 9112f34dd3ba983e3726e849957900d1b4e2f86d
SHA512 26731c7b379a5b552894a02156255a9c4939423ac51fdfd1bebd2c3350c6de1455375e99f7265cbf56d489437e7060c723dca73f28a7218b8c40252abf091120
SSDEEP 24576:A0Le5ji0hmxirMtatr0zAiX90z/F0jsFB3SQkb:APji0AcOaB0zj0yjoB2
TLSH
T180859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d3e8d36828802e857182e5482a8e94aa22fbb83358fc3da88cfe020a5056c262
MD5 a82e007acfa7b419848a97ccacbae286
SHA1 dfc37ebbd81217429ec2349b1927b4fe247a8084
SHA512 a05e931d685afd13da7ae8941c99acf8a3a76ba780e3fc7613b0aa03c6c9579567cead70c134160f3dc145ca2e2ceec69bd409498d7674acd128d5bd4e2e0f8f
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWE6q8wyuzatr0zAiX90z/F0jsFB3SQkI:p/ezSC6vUzPvxHjyCaB0zj0yjoB2
TLSH
T15C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1e82506563e0f3bdff56a373426c476cf8ad01dde3b86e9df6eb567b1094fa41
MD5 a91e59b9abf5aa0b318b009f0627018f
SHA1 ad595f51060ccb3711da245757d6cd6b52fc7252
SHA512 8cca3753caf76e00e5dae0a63460701976323cce8b3dc05f67a4bb8a0475d4ae8887b20f1d27ff29651a0d3de20dcd0f70d4749847b77f18288be87d78161d52
SSDEEP 24576:NVbqPb88hv/l+6watr0zAiX90z/F0jsFB3SQkY:NVO88hXl+haB0zj0yjoB2
TLSH
T10155AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6c5484a93bb6fc46e230858a6052bc916897b88609804cbf02b4d78f807745a3
MD5 45a39bdc58d845695403bcc1fac64bae
SHA1 8a228ff09d1569baba42aa5606a6582f7bf5be77
SHA512 d4d67a3c820065f96a57d69b5e445b14d42c92165f66e0cae52c1b1d3ce685f8d8edf250abaecbf18a94a00e18fe278f1590b4c6639b7b24cd6672b5cafca921
SSDEEP 12288:CRpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:CRpatr0zAiX90z/F0jsFB3SQkz
TLSH
T17445230B340E80F2CDC31B3566989C4B1AB99EB065E2AF85E1D13F4F9D3C1C696656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2b5fb9afd535eeaaf3fbd0f802a0cd9330d52c540bf828dc019a988b0f6c1413
MD5 8e78e98fe9b51ae23b971e857ef9e017
SHA1 5d2be5dbfcfa0fb9212e010a84844f6021d2f623
SHA512 f680b0beabc1caa459b271fca5409b24baf58bfe5ed8ecf3a6cfae1aecef871e50855ce195d05e7b9f9b9338e7884829ba27b969f54fca86f0fbc6f31031db8f
SSDEEP 12288:OeBNUbTVO86UIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:OJIUIatr0zAiX90z/F0jsFB3SQkz
TLSH
T1EF65DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBE165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 44a2efd89ddf0393ae41cb7e09eb83c5898a53e59c94ac4b3ea9b8a50ddad42d
MD5 dade4dd81e3c56155b1d7047a508362b
SHA1 3df79ee7c9da2ff6adbce89243829b27e245978f
SHA512 c6e8ec3a95a206a00b7b8175949d2f0d45fb93f07bcf83e6c6c80be05cd3367027a0e1799392162fea5f80a6f6b7c99d3c2aca0408c2d8caa52c79e64e8aa095
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:+QvGAdlCEL8c/yRNw5COB2Yyjl
TLSH
T188267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f430c628773d0a998482029932ae871f3e1e6847e508dade52a9d65bc04ccaaa
MD5 a2276e0aab62952e237acfc7acd4be90
SHA1 6adcacf8a84934344fad7fa359ac1b602a699220
SHA512 ae67fbb751c0a06a0b261257dcb45602be12c87aad794985fa7aaeb892fd60b611b64183abafb89030a0df78faa3093bcff2cc527db5c0e54db0777c743b3ceb
SSDEEP 12288:GAwSfxL/2Dc34DLLmt0LDQewsAjeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHE:bdewsAjeatr0zAiX90z/F0jsFB3SQk8
TLSH
T1AF75E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ece38a72dc209754026651d97c9b5152ccb58e4b117078144a35f19f4129ca1c
MD5 ac5a23f5b48d73b090eb2c2aa736a2b1
SHA1 a963e9aa8963c39dbb3e7fafdf49f22aabc20b77
SHA512 85e9ad47d86da3ca9500bb4c397d1ad41861dfba941e7884374fd87819678a5fb9674c985886276c798470aebdb054666c4274b91d61da58f9634ad2f07dfe8a
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRZ:0UEtQevvqc2W1cpV2EI32D
TLSH
T108474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c7d935d568702e1488b6fc5f27dc1540bc5065b41a2062b26c10e6b5b53a2927
MD5 97cd67e59402c285f654923527ac5f36
SHA1 8d7352204a8ed9c612bb03edd327b3b74a51ff29
SHA512 dcb113a4debc01c53aabdd66438dc1d0f5553671747a9d8d9dd904f1a7c448a5d26dd9c352e519ca4516476254570583482922eef1e2a57a17544135b7cdff07
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/z+aB0zj0yjoB2:toqtVjnmaB2Yyjl
TLSH
T133D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 64a8f179401430137fc33e4b48bc83ecbf5e6d84877bff66600b69f3cc02cdb2
MD5 3f942acfe53116635394fe5ab95c1f16
SHA1 8ffbd15a53451b858d19b9a5fc3dd5aadb384877
SHA512 dd2ac9c99d3b8eef41b9d3c2c4a247614bca32349c044e29c9e229fda568543ab0760b75de39655c5a4f5967034cae481bda3d5244d1db2994da5f888ab16591
SSDEEP 24576:4AhGLJIFoiwtA5l7S53Hatr0zAiX90z/F0jsFB3SQkH:4AMyFoiq53aB0zj0yjoB2
TLSH
T135359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4cdb3add68a95adc305f608f76a63c4e577040935cc614a5594c4325cf46b385
MD5 b3ed96701f9671e614e1d3f56c18bba7
SHA1 1f0a3ab3501bb4c5b5afff3db407900fb0dd1c93
SHA512 5a4c296cd339c4c0bbafdab5ed98ec18feea87cfdea42a96d515088c0b94c399a120a6e3d9a4fe74849aa74a4d2521d05984d3d47afb55004acb9682b68001a7
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+CTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:JwuoOWiatr0zAiX90z/F0jsFB3SQkT
TLSH
T13F65F14A32A90CF9E9A342388597C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 616a890c224711b32267bd3e46e9ba785611d3a9a982f99e98a9a8d7a6870e46
MD5 8547018e6a22825e8fdfd6c8fc6306bf
SHA1 ad68a9ce0fb1879137b81cb9fc26dfadf39ce94a
SHA512 b85b52020665927799cf80bfcc728c6b691cde248874aa6e7b49e1df70e0d310c398686cd8b861ecaeab4ed5d928a9ae78849cb2997b5a4325b316e7ca97b804
SSDEEP 12288:LBZ1IyuUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:lZulatr0zAiX90z/F0jsFB3SQkX
TLSH
T1E155124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b59bd1e7c7c45d897daeb07f7c99ce7ad55b290daea5122999060c2adb87ce4e
MD5 c927696dece3d42cc5c46b79071ad567
SHA1 490d5ef9b919c143981f548ad87d2f1ea4ab0e1f
SHA512 b5ea32f44089391acb23a234e9c98157874698053498a4f44e234d963ab31435fe9dead4a1ddf5e3eb9181775201c6a0b2c5db6b542fb6d7a78f3aceeba7efc0
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:LQRQyi36YOcPQLvw2gAf+PN3TB2Yyjl
TLSH
T12B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 87549d23bb4dc5631ef989decc59c5470c0dcdc861989b18291768bd7deb782a
MD5 e0bbe9cbcdc233e863a667c9be779b53
SHA1 dac7f0cf84e523dc0ff57981fd9335a4b9642603
SHA512 29f6ed72bd25440ec537bdce1f46af5c0a010d84c5df2eef3261b6fe54895ffefa51fb919e8de401b8aa1ecd152409e0a26d6245475b8569efb6c45b5fbe6087
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:QQRQyi36YOcPQLvw2gAf+PN3TB2Yyjl
TLSH
T1B5667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5ccc606fc5effb4cb62d7d40c756041f0d39f94b13ce1024cf6252b1b165da3e
MD5 d4134e8ae40b7236ee418e6842d6a55b
SHA1 3a27163ce350cfa591b4fc1ab98e1b7bfbc18b1d
SHA512 cb74c3b0e3222b22a47cd6a683f4d3aa4a3bd58b61b2beee96ab47322f98304d8003cc424b71bb321837f27cd852088bbaf761bda6f3925f92fdee87c1ce38de
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Vatr0zAiX90z/Fg:z68Qg55nhheWu7PNU3/OaB0zj0yjoB2
TLSH
T182B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f58bdcbc079dc581bcca50db7e7b046002752a1f367ece2a10fe65ad71468e32
MD5 549a16d943078d8943ba26708d24c4d8
SHA1 7194c009f083dec460333160dfd3780b8123ee73
SHA512 fd10c0e5607a02b8a4f987a14f005b1b28e8bc1852b062e06250d218a4a8d3b7d90e23feb687849b61ecde0a6126711aade43e08dee53aaf27c6456a50b1a55f
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:Py5112gYy5azzVvL69nLKnhZwB2Yyjl
TLSH
T1FB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4cf884ffc868910b6e2087a6abdc25fdc1d74370b37508f1fc8efd53e637ebb1
MD5 09c1f9c217b26d6f13e85b7251b0a62c
SHA1 97e4ddb859e1ffb36ad40df605fb90e2748330cf
SHA512 a221d3fd8fec1476c1caad37af9d034badeb101adda82576b8489123677932808f96dd4ada1db46be4449497d2c5edccf17b03a8603faa3fe46ac853f1551e15
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWaB0zj0yjoB2:Ru6JmVxd2dhB2Yyjl
TLSH
T193D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 440c0901a321e5fb44b7cb1dcec18164bd4edc9c1a0989a22f8845603e81d42b
MD5 2b979e4221d4004dd0a10a925909be3f
SHA1 9191cc842f83d1ac48d450c21e36743d9f967ab5
SHA512 ae0150e0697c74a364779c7591d5e0d35a1ae179794cb101b1a1b53baec116e3da8917a19f6f8e035e041cebdab511b3c79fea059c2e6dcfa29da0045727a306
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xoaB0zj0yjoB2:DmifPbRaB2Yyjl
TLSH
T132B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 29eb2c164d681c8fcfa57b9ca8c8b88fc1acc625d5d930964183a973aedaed06
MD5 350175fdab9f821111682ac96b8c13ba
SHA1 0ce8ba7d72dc029c0f92fb174fe74fce1e52f6f6
SHA512 0e0acd784a62f9bc57825f65d1af9691d4f49680117c13366c767356d3138ef1c56efe80f528602905fd8caadc9754bf498e81b6c42219144517956d05a2034f
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqlaB0zj0yjoB2:H5dKTi61UB2Yyjl
TLSH
T12BC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 62e029840336e2c7d5077a9e6ea64a3933ea7e41fb2543fc17c642b49f0c9062
MD5 ef9eb49ffd5270565e1dd33910ad6f06
SHA1 1aaaa3c8ec0b35a5bf5ec0c294fbb5f9b1d50513
SHA512 2c4636d895b9cb20216cfc9e9c248a65531f0b0cf6a5937b45c9145bf68d63085eaa6667f36bfc0e225c2095014ce7111219955c14891914f0c37f5e36897317
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wEaB0zj0yjoB2:3X2iyphWB2Yyjl
TLSH
T11C95BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c924f8a8d95b5084b542699828c0c2a6691f65877280d7768fdd47ccdb4605e5
MD5 0abb1a4a8a6d2a83103f6baf26fcc2f9
SHA1 2a7e68e868080c8ee8f3a261ee528c640d9f5d5e
SHA512 61e6d25adafdbe7a9b18f7c001362cb67434595d099bf662a06476e500d75aac86f8f8b0737cc5260a57d84062340795db193d77c7e5a7e8b73075e1fd6fb163
SSDEEP 12288:5hUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:5hatr0zAiX90z/F0jsFB3SQk1
TLSH
T18845230B341F80F3C8C31B355688984B1AB95EB4B6D36B85B2953F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 633f559887e2542613b146b3a8f475276ab6c0764e12b25c3a6657d860ca581e
MD5 5944f87fb69fbe777104b9d7f8779384
SHA1 b53dc70160ac4f5b726d333948e54ed750fccf67
SHA512 180d121b27455a4329468a9a96dd5db81b62569703988fa6b014ac9beb49b721d91ea48d9c08a021d72a2dc74b38f3ee68b6fa1bfd8e2b616aebc02c9b39f63c
SSDEEP 12288:HqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:Hqatr0zAiX90z/F0jsFB3SQk1
TLSH
T10645230B341F80F3C8831B355684988B1AB95EB476D36B85B2D53F0FDE3C2C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e2f9b8b6117f1ed5c3946327f0668fcdc96bf1be5517db22d250d307e6dc82fb
MD5 b43fa98008495950a9bf47409a534600
SHA1 dd23859399f593c3ef022559259a29a40f97f08f
SHA512 a1b7dffab8fa3eb96047e517620f6b8367b820ebbeb256ecdd3878fe1b1772895b6df3a400f4b585971d6720c7de313184fb69241c26e49ac980d6248807d39a
SSDEEP 12288:pgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:pgatr0zAiX90z/F0jsFB3SQkI
TLSH
T19245230B341F80F3C8C31B355284988B5AB95EB476D36B85F2D53E0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 48164da1cf452598afddfe1a3d2b45ef6467060530010bc9783f6763049984d4
MD5 d319dd4bc84eaa95aff2d7da3a577661
SHA1 25eec57fe441be44bf5aa9fc1ccfbcc68f7eace5
SHA512 5dc45fd6041e982b75da68b10b45a9f09f7e5b93dea3a3ea1492aa0bb3e3a0a941a61abf9b5710e3fd64d4e567649b2d7464ff4a913a54c34a162b967cad076a
SSDEEP 12288:+VnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:uatr0zAiX90z/F0jsFB3SQkz
TLSH
T15645230B351F40F2C89397358694884696B5BDB4A3F3AB9FA2413E0F4E343C56934BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 952934d1dfcd2659abafa8c15e29212dfdf749e034378d69022b1604e0ee347f
MD5 04b14a81b57d547a0fcd40067ace2631
SHA1 bb29772e8238286774c77d42c67e0406db4df210
SHA512 f1197055561a19c7b3415eb66c258078596e46405a3d74303de10863853cd01cd3d966bd5adb320d00421266897b0693d26bd9858dbca40e32d0d27785bdae75
SSDEEP 12288:lPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:lPatr0zAiX90z/F0jsFB3SQkI
TLSH
T1CB45230B341F80F3C8831B355684988B1AB95EB476D36B86F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f67842f64f782598edd67badb9cc7e46e835139a88727951fe2630a5895a0557
MD5 617f3f5319f18f312d9c11a36629d520
SHA1 6606ffa4fa46e255d83067984c610887561add88
SHA512 9acef31d4b5d2b835d3046f1c771880b944dc6acc2be45e8693890f747f1c9ebf803163a6203d7725153f742f3b8d23d4d21f07ffb7b26f65d293190e0f17d22
SSDEEP 12288:NWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:NWatr0zAiX90z/F0jsFB3SQkw
TLSH
T17A45230B341F80F3C8831B355684988B1AB95FB476E36B85B2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 84b1f5ded3adae09fe1a533b26f297d228d7ff4d01a8eb8681b117a7085c85ae
MD5 2de733674779d9a962b7a8d77d896141
SHA1 48c4acdbd189897df838233aaced195eb1c206bd
SHA512 c30aecf0d54d43da3334e7771fdb4581852d7aca9e3c6c4b6c2ae7e87abd46f507920fbcccea00b5048b97d1a1f2980a5203c8e1ffbb74e106bb97c15376f133
SSDEEP 12288:0SUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:0Satr0zAiX90z/F0jsFB3SQkI
TLSH
T12245230B341F80F3C88317355644984B0AB95FB4B6E3AB86F2957F0F9E3C2C625656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bddd582596fc0c26608cbcc3b734121fefbff7dc17e9bd373053ceb39d1bf409
MD5 fe2e6f5e5793d7ad4efc13e7adf0b04f
SHA1 4a4ab6c832d2fc8ee4f56bf2469d5aeba61613e2
SHA512 b5c521a1c8f69028b8c5a04a3993b088a95f4e20385cc8fd7ee5887e79bfc69117f290c989022a954ba4410283c947ed9183f1fe0eaa47d9f2749b706bebd38c
SSDEEP 24576:IZMSzFVSOKatr0zAiX90z/F0jsFB3SQkG:IZMSzfmaB0zj0yjoB2
TLSH
T1B365019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 71098884b1ae3e7bab9702fe123a3f5a528aeed8bca496063cb5c322d2d441e9
MD5 e8d76d119b8b35742f84eb0a2843cb56
SHA1 07e69f9086fc4c899a9cd58c369b8a69d98e5b42
SHA512 aa85ad5733967a7ad1cda64b7d6cb6da1ebb01d334b51bb09e23029d2358ec1343bc2cfb21c07b31d46634139430a1049fb309512c4f287506825eb7a8070186
SSDEEP 12288:L1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:L1atr0zAiX90z/F0jsFB3SQkE
TLSH
T19F45230B341F80F3C8831B355688988B1AB95EB472D36B85F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 30f10729033feb96bc065bb864ed2305def21de56089bcdc031a567d2d75e7b3
MD5 bdf26b50a9c009323519c8f976afb161
SHA1 7350c8176301d6043d0e483a6168c5356dd0d133
SHA512 70f9210d8eb17943dadf6f5d714e5739eeaa026f3dcbbcbd8087e446b14ea6c4f8607f90638f169a3f3060e6c876010b7943057f4b5585c4bf5dfbd8bdecd50f
SSDEEP 12288:65UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8p:65atr0zAiX90z/F0jsFB3SQkc
TLSH
T10545230B341F80F3C8831B355684988B1AB95FB476D3AB85F2953F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4d2968cb00166e6e8be51e75f016016d8dd1aa63b34eb1e0db5c40f27da3a32e
MD5 a09309d65cc0402a2bec27b38d51e6dc
SHA1 d5e462504abfba4eb8b6b7b657d8b74545159be8
SHA512 b7af22af25da06c14edbc322913b566175792725b44ede17a3d9dc3e8d037a236ee9545833d2bc57c184134b69bd44098ef76eae6ee7394a5ba932807c087788
SSDEEP 12288:LyPz5L8uUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:mzyuatr0zAiX90z/F0jsFB3SQki
TLSH
T1FD551207326620F9C4639239C9911906F776783117A19FAF53A02B7B2F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 49bbe951c36bb3a7dbc997ae8f3735a4d9a37b24d1fce0a4b98239e030f277ce
MD5 e1627cb6a7a6458fcb25b56587aef3a6
SHA1 d8e3009e1b8db76d7c5a5f006c09cd765e2d9972
SHA512 feeeb42990171028f680138d70589e5b804fc554171dc5dd96816ea09fd7a25b3adabd4ea540aec547d6e3bef8533595541cb1dc36d84d150dee21762bfe0ef8
SSDEEP 12288:K1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:K1atr0zAiX90z/F0jsFB3SQke
TLSH
T1FF45230B341F80F3C8831B355684988B5AB95EB472D36B85F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e6695dd2f2f1ba17aa3b3403395ecbd612cc7d51471418c5dbcf92117665e3f4
MD5 d53448158f2daf347f1d5bc0cf7373a7
SHA1 7faa4224a8359dbf0967262c09b58062e00efcaf
SHA512 192c192e62b065166c08656a78f94a7e74e6e70985975ae78fc8a881208d8509905c5f511d51708f4f7d7181d5318f09727145f13709f0fb8cf4c2203286d529
SSDEEP 12288:j1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:j1atr0zAiX90z/F0jsFB3SQke
TLSH
T1EA45230B341F80F3C8831B355648988B5AB95EB472D3AB85F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 02cabb357867fbba298d9cef79c805ed373d67153362710dd7c15ada3fb0dcd0
MD5 edcad88c8a40a2a35118a14469ab7ce4
SHA1 48ced602713c6c37dcb3a7f861719f5934b3e6f4
SHA512 fbd0bb5b6fefc530634a3fe611fcd2194f72540e9cc92ecac841d501cb729b1615dde5e21cba290e1ec52699b76fec76ea099512610785d40b7c2fcae16f0e56
SSDEEP 12288:IyPz5L8uUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:Jzyuatr0zAiX90z/F0jsFB3SQkg
TLSH
T1CE551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 44f98d332d2066f38f1e1233b654b79e3953ab3abb10bd1ec4653b2744f79177
MD5 e490ccbd77be043619f446cf6dbcfb41
SHA1 5a7d52f9cfcb5d73f05e8fe7393fdc5fdec05c7d
SHA512 a97c6c1c7659a563956ff80822db053433d5c2f1172be7dbc61ce55b760d6cf5b2d82bef817e4b81a480c3422feb569a4e7fdd622733caefabc460f2a6f0a40f
SSDEEP 24576:dTHaLl3z0zDQatr0zAiX90z/F0jsFB3SQkm:dT6LljzaB0zj0yjoB2
TLSH
T103650195735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1a02bbd1ba321c30bbe5bfcd11fa978ce59b42cd1e9c4cf69503f0bd995058e3
MD5 b137b7a18cd18c1a1b5ff6ad3d76ce69
SHA1 7ab4ce5419dac9addae70d525e1ca3e5139e4f93
SHA512 0e49177a3a107bb88686118b0b1a7ded438f555f704774fe0473fbde5631c246dd2f04aea93868fa2029794ffdef0013b2278e5e2ebbbea9e52dfe85bc5fcb76
SSDEEP 24576:h37d9CHKy7GZ8atr0zAiX90z/F0jsFB3SQkI:R7d9CHKyamaB0zj0yjoB2
TLSH
T1C075CF91F3E810E5F0B39A3589754512DAB67CA91B71DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 045180e00971f1003f60883894a697584704f51202248254adb29e75d08acd48
MD5 7c2c2047de54bfe156aa360e66094c54
SHA1 d03045bb74bbf492493ae3b76a83192859d03b98
SHA512 29b16d32c63e4ad03db23f0b7d25e25e2f5383b93f539cf1077202bfb3c9834f8b19149a92ff25fab8442d19222547a00fb5f9c50cb14e6cffd91fee387551fc
SSDEEP 12288:DAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:DAatr0zAiX90z/F0jsFB3SQkH
TLSH
T1CF45230B341F80F3C8831B355248988B5AB95EB476D36B85F2D53F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 124f1ba04abcaf719b6247ec63814a5078b3bf9d5e013809667cdc7e0eca980a
MD5 28227cb896ce0b2bb62d6e6b47b74761
SHA1 34faf5aaa43fc99538026db4dc1380b639b4a65b
SHA512 92af4d503bbf4021679b762cc7477970ac42b69c15464bd69e0658feccd3fa406dfa24a5f3448ac778eb95cfa989cf9b35cff3a0717e74813315990f078703eb
SSDEEP 12288:fOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:fOatr0zAiX90z/F0jsFB3SQk/
TLSH
T1E145230B341F80F3C88317755688984B1AB95FB472E3AB85F2D13E0F9E3C1C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 06dff0f774488cb13f1935072de3776f9d76b2602a826c17db1730dee5105384
MD5 507f0c5adeb2d94c5b117f3699240888
SHA1 41a335940f6d7c610415ad9e64cb2b758a3fe05c
SHA512 6027607f088046a22f4bcd1c614ae272dbfda319511dc5cb5404fa45df3ca1c6c9896af65b10f7821a835d657efdcc699afb9d8646534c2cce0a4fea5b34711a
SSDEEP 12288:v7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:v7atr0zAiX90z/F0jsFB3SQkW
TLSH
T13645230B341F80F3C8831B355684988B5AB95EB472D3AB86F2953F0F9E3C2C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 85b7692f2838da5b657c55f344acb9b402e320c0954dab4c587486d8482e0590
MD5 6165b5cd09744f33487346c70e9e0802
SHA1 0728b9bd7c8c6d2d46777466a5d93cda8e7f1b82
SHA512 5bab8346b427e93a3472a360d0a8d9a5f110df7e82c7dcf63c729906ec48a1dcf46d2d88046b0023a7b43148eebc7e38eb1f33aa2f1be3790e3cbf012f7426d1
SSDEEP 12288:N1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:N1atr0zAiX90z/F0jsFB3SQkW
TLSH
T17645230B341F80F3C8831B355684988B1AB95EB476D3AB85F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b749ad28d4c0b0b47808d223816b8b79dda1dbaec45b4f547566dd733fc634f4
MD5 166408d9edd9b0870881156a2d37bf37
SHA1 a7501817e730bdadb6440280d45d72a12a5e2e8b
SHA512 1a041c4fe6b88a63a56f50b29f45528dfb9cdc48e0226f89d447c42526d81271074d51995c3077761ca5b7257b332c1b4fd23cba91af4bf096367fcec96426e7
SSDEEP 12288:vAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:vAatr0zAiX90z/F0jsFB3SQkp
TLSH
T13F45230B341F80F3C8C31B355648988B1AB95EB476D3AB85F2D53F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 60e2d424da1b96cc4e4ed5970383896a9d55efbe96a7d31948a97fbe567b064d
MD5 4f3f3bcdab31353d44b12e66a1b0daae
SHA1 95b27d27164e1f686deb24212c88bde71fa4fcb7
SHA512 7d46130b251784bcebd0e847e37efda800d24f35266ef7b72352fbf9f89f7cb436bb547bf16a184fcfbcda0eae22419d94df6f1ff04c2d7be08d418acc9c9fae
SSDEEP 12288:ndUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:ndatr0zAiX90z/F0jsFB3SQkF
TLSH
T10845230B381F80F2C8831B755684984B0AB95FB472D3AB85F2913F0F9E3C2C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 660436b7d09f898e1f916632bfa02cdfe095e3177eba556f498f095a0138c171
MD5 adddd839d26460dac9175de8e8a9652b
SHA1 1ce1323ee5c7281a5121edb376fa12dee2f0df39
SHA512 6611a24295a708814f0adebe4ddbb3a5012aea9036f6253276897df21bef8a64e1eeab7a69549cbdf8b1994f2215af5ece82af6f05ce5cfc7b4226319720942b
SSDEEP 12288:yPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:yPatr0zAiX90z/F0jsFB3SQkf
TLSH
T17D45230B341F80F3C8831B355684988B1AB95EB476D36B86F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-10_041901_4628-1760.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-10_041901_4628-1760.log
Size 1KB
SHA256 41d11cf99d8b30c1be6ae45c3a18baa02166a1e6ba0094eb05834a6b6bf26682
MD5 03072211d46d05135d3d266255f57216
SHA1 b2ce2d978d6532d7614282b475b1d5581fa417a4
SHA512 951c162748cf07599b62a172c752e3ae1ef31610e0526ae7f7876e5636bc6bf27139e02a2a435876cef38a2e88f6454aad28f3c3a2f36b3a8878a076cc3deb3e
TLSH
T1BF21D3153BD80A06FFFB9AC299F61583AE3A38952830C64D00A4534F4932F41EEB432B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 aa038e64b15c3ba02e8578a103c6d2a8b4a742119dec814f66dc8e4d667cd6ce
MD5 3ad2e46331d83ffd985f7dd4492b9dc6
SHA1 21ddea52ce189e823b2993feeafe845eeb9143b2
SHA512 533b12da7c4094b62720781ffca467fa7700581e2e0749f4c8c6c2cfa2a20f42721b660141d845e1fddc42730ad0e5e9d612de39bd4fa42dfe98264e3af3b5a6
SSDEEP 24576:/fwvok9RX6wkyAIJatr0zAiX90z/F0jsFB3SQko:ZMnYIJaB0zj0yjoB2
TLSH
T18085D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0a46a302f5248845e6e1e2bdcdd41a5eaffb2964c61130e07f7c19b40e8d2ad5
MD5 9f1d87ad8016476d856f5d7915e6e896
SHA1 3131b42d4a9f41da50aca41841afd468b6a62c40
SHA512 c6ae2769d375e05697d326bd3a28655ecb0a257a9e532bc3d1f17b42eb7ad76dfd37fcd30beac2678c4fc8ebfc9ad5cf424cb338a4916facfe5c46cedb9c9dc7
SSDEEP 49152:nYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kaB0zj0yjoB2:DySzPzB2Yyjl
TLSH
T163066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 97915b0a69de33f118136ad3bf9312456058c8d2c4ba203f85da82a12f056f66
MD5 64b21d5a235e07210a0471fabcc0f39a
SHA1 4b7dd930301c12a8fb5bbbe0d33aaa91f2691c03
SHA512 55b5d7a91f85b6c40f90ce88fe68b2646831eac3c6899483a2a88c3cae98d1e8c904733a0b538e69a7fa6cb6ab9d4c160b0d7297fcba933502f7f56ccaaea4be
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYaatr0zAiX90z/F0jsFB3SQko:H47JUQj1irIhCnDHUPfF/0aB0zj0yjos
TLSH
T14565AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5289bc73c5daea02d2e4ddc4ecddfa0c99adcd12fb3afc4ff74d9e6616d0f227
MD5 64b449dde8e496f0ae07eb47104cb37a
SHA1 e164f87edd00924347fe4dda9b386b047ec9ad95
SHA512 e71b6e143d452ca14ca7050f1c0aea43496e1718eaf3131bb5ddd1a321c56793dcf6cfaaa41a7957287b5a2591bc06a9a7d0f17966eb2027489d51bc20c3b11c
SSDEEP 12288:4NsflUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:Zlatr0zAiX90z/F0jsFB3SQks
TLSH
T10255F00AE25802E5C0AE6239C7544A41B7777C6493E2D7CB62D0FA3E1F396C15DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 290d2663e33dccf38ef1de03df83d158653f8a4d8fc462d3c917d8f040f80b5a
MD5 4f1ed7de162c94b98ddb8c4add1bb519
SHA1 f4c8289c1bb8baad89667702a583d15b3d18fefe
SHA512 bb0feafb5f14c44375bd065090037b2ea06e6e3d3cc799bbbcf397f09792c29f32308b5f0331353719758c9fa6f05e81c804a043a05580eda0ecc55da953ed35
SSDEEP 12288:Daq3U3fsUFnJ93qQXbn+sIzVR9/82QYTZyo1mGEwKy:Da0UPsU0zVR9/8lYTZ51mGEx
TLSH
T1F7351840766AD75FC6AD40321E33D1CCAB707D41EE05AB1372C8973EC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 b6c4d9db5af05daab3f2e19e7fe2cbc106c7c590f171dd925b2a7f7e2bdd67c2
MD5 6651c54ef67735178643d6debadea4df
SHA1 5b3823b3a7d119318f2bf7dbebee937fff13d730
SHA512 5d68288640a4ffe315830891e7db18769fd6f4dc0d63701a192533625b8cee426ebac552f21e1ee30e1cd391813141948c1568e295b622b0aaa6f4b5ca8ffb79
SSDEEP 6144:vG2hggPGPbmPcW4gRai493qQdbn+MTpcbVtMxAcbVtMxU98b4ily2MGEHWzLKUin:5obIcWZRs93qQdbn+ly2p/6Vp
TLSH
T18265C8816437A38FD1FB6031072AAB4CA764DC57B7095F2673C9457AC82BB21A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6d167a10c698b5fb72ef1fd5c389f5fb694f1ec7be0a2643143c03277e024305
MD5 e4f660f8202380b22ad8bf56600b1798
SHA1 5cb6f478922f1f39d4a319ecc26397ab21209854
SHA512 6a5dddf2deaabd8319f9184ffbaa222e1249c5fffafe6d11f05199edd7b1866b8ef37a068b656d682061eb221b05a5df28c5a75b3d7d1251dd555cf4d61d5407
SSDEEP 12288:zM7NUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:YNatr0zAiX90z/F0jsFB3SQkx
TLSH
T11B452307351E80F2D8E31B3416588806267EBA746BD29AC7F1813F4F9D386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4903b6ce7be7d2b2ec6e7a8a31d61389e3a0cdd59f6a63b7a44f359bc53bcbb7
MD5 14f0fa7eabffb3ebe6e5e5972e459d60
SHA1 d5b9e93eb8fbb5df576ed6a3c6d5880a5214a3d0
SHA512 3880e34f83f69ff03f15db7b9c9a127ef9f2b24bde2ba9abd960b99d348d47e0481de68bcbb97b212efeffe06070260c7a32cb42ff467096477dfb6ba0a9a673
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYzatr0zAiX90z/F0jsFB3SQki:zgb4mBIBhGFaaB0zj0yjoB2
TLSH
T12065AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 23db3447261d8113067c3a45d6fed5ed33df1e8f48896f5faf3bdc5a714f2ded
MD5 143be7b74dcad73e1c6336d343c7fdd0
SHA1 05198a6ebd945d44646d4aa09b666f2c7a86f4a6
SHA512 81c879827cd4373f364964bddd6fdf1479be79615653a58ab26b774e75cbf7d30e33c0607b9b245e8a93b0b658dc1f6d471bfdee7885acd9362cda680a160a2e
SSDEEP 24576:ZG88u8FpJqH1bzria7/mKatr0zAiX90z/F0jsFB3SQkq:M7ZFPqVea7/baB0zj0yjoB2
TLSH
T1F985016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9784c2df28600acc06688117454ec39d2a9da6991b4b32a199cb37d020b7d1be
MD5 37a712da414f70b64579c298e5126a9b
SHA1 96ffd491b89a03f4e907f567f306351570a3110c
SHA512 287265f485870ebe1b8f6de1edaeac02dfacbe21ccc734ef36e3847351b31f4a6754308b5430044540bcdce1c0a3096198aa364db2729f5794a469918776cc7d
SSDEEP 12288:mHvUrBFrEjwaQmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:mPUr+NQmatr0zAiX90z/F0jsFB3SQkv
TLSH
T17B65E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f2d7ddf37175156385d631f865567142384a4f3ad73d90fab41860b8a62d196a
MD5 550335147d0d5e7e497a8f890e13598a
SHA1 42bd39f3470dbc1bcab45f9ede313e3621c80533
SHA512 8ff59550287e5498f5eed4fe81df5f72155bef1267fdb68a07d7158ca8d49aa46a4428b95e3722bd17fc930482a46c98fe39ccd042127ecb8b50ff9ca860b379
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWaB0zj0yjoB2:FG05lO43bYB2Yyjl
TLSH
T184D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 79586a348a01c267871abe1df15d3911394e003e9e7dfac92820a854ce644bf7
MD5 45ba6dab3999149f7ac09bb1b78b287b
SHA1 5f04578421de96e2aff00109e7d459a5ae34ffaa
SHA512 4fa470a267024859ed803d9d2b4950a1f292ed97c0c8bba58e5e4e62b128e8d88f6d1708486df87d191214e4babc35e5bf18ae87c9796d8b943fca364487cd28
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnkatr0zAiX90z/F0jsFB3SQkr:5a5POZ3+Jt2pasx2+mOaB0zj0yjoB2
TLSH
T1E165BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5ae4f25f77b06ebaaeb9a18eb4a2e32dc6442ece07d6eaba276989414a934e09
MD5 7fcf9ddb7011f5ae7279196eb5be0e53
SHA1 9df2bf778b225cea08a08b6cb9c83c57724a3990
SHA512 bd4ae4e4dd35b341402cb99345cdadbd910c316db64be9c91ff5e8433c3919817dc3fdcc0e10ce0c3bb86f1d7fd150ee6555b19aafb800870022926c24122292
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkCatr0zAiX90z/F0jsFB3SQkF:NNc/zEOVHF7aB0zj0yjoB2
TLSH
T1DC858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f5a74bb8bf5b9bd48fff4c7a5156a4b1fe50dcc2976ff15dcbd8fe6052035cda
MD5 eb29bad8a022d878af256f29e7a72a67
SHA1 5cc67fdad2f65dddd3741236314ce0bb08105b5f
SHA512 77183d5e75d20c53ac95e9d8094de60c274bb0b37b0f403340824b6c839318d70607f7ec739222fd0fa344a0fde41377bb7aadfbc5d65bcc28befd3b5cf3108e
SSDEEP 24576:I8kNvNnaFeYhJNtmZBm6atr0zAiX90z/F0jsFB3SQkI:I8MwBtOm6aB0zj0yjoB2
TLSH
T19455BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 69c90ef3ed6c0fd71fda773edd303d4f1c30acbf0cfceca187924a8fe8b5cd0d
MD5 5a58180b5b7fccb955434db31e633e29
SHA1 2e400973372d508c9e70d636a63bd694275a2221
SHA512 2af44d1a3298c205bdda7d904d2f8ffc9b7304b20e7e204f9aa354ed383cc9dd4438e02a1dd8be417d62c0fe31560eacfb49c264eeac28fd092edc1565441900
SSDEEP 24576:GD3FHshBIYQgABatr0zAiX90z/F0jsFB3SQkV:GDVHeBIAABaB0zj0yjoB2
TLSH
T1E475E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-292-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/396-62-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/396-68-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/396-60-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1232-115-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1232-109-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1232-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1232-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2076-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2076-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2076-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2076-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2076-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2156-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2156-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2156-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2156-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2216-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2216-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2216-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2216-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2508-78-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/2508-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2508-73-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/2508-72-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3172-128-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3172-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-126-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3204-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3204-322-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3204-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3204-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3204-83-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3204-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4628-39-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4628-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4628-8-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/4628-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4628-45-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/5892-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5892-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5892-49-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5892-231-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5980-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5980-306-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5980-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5980-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5980-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5980-101-0x0000000000720000-0x0000000000780000-memory.dmp

Download