52e5baf3809355a647065a6dfa78bf360d9d341f62c0eb5881afeede72137dde

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260810-t2cn9sshnc
SHA256 52e5baf3809355a647065a6dfa78bf360d9d341f62c0eb5881afeede72137dde
MD5 237b93ee844b1dcc5a86781db18bc7f4
SHA1 24b559b48d5d156fcc2e468f0e99e8d1caf219e0
SHA512 fd87413a4c724fad82d457a0c9b5100ecb40d0ea06372f9d418850cafd378605ece5b74410bb252304040a82b3195a2d147eaf2dbd9869d014f257e3de78e856
SSDEEP 49152:y0V8tmfJCiulRM6Cm3caC0npmZNkj8A5cfi6jQCw2OzKTG55gew4ZPzwFI/wOif7:MCJxAUdqYtH
TLSH
T129167C0BE7B940E4C4BBD13D8A579657FAB27849877197CB07A0861A4F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4260	elevation_service.exe
4688	maintenanceservice.exe
5732	OSE.EXE
4484	PerceptionSimulationService.exe
5668	perfhost.exe
3332	ReFsDedupSvc.exe
4224	SensorDataService.exe
5128	ssh-agent.exe
3668	AgentService.exe
4112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\398c4a73e05f6396.bin	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	OSE.EXE
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-10.1632.4532.2.aodl	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e5d0530e628dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a2528efe528dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9c0cdefe528dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027fc0fefe528dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000524e8d30e628dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d0b7cefe528dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4260	elevation_service.exe
4260	elevation_service.exe
4260	elevation_service.exe
4260	elevation_service.exe
4260	elevation_service.exe
4260	elevation_service.exe
4260	elevation_service.exe
5732	OSE.EXE
5732	OSE.EXE
5732	OSE.EXE
5732	OSE.EXE
5732	OSE.EXE
5732	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4532	2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4260	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3668	AgentService.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: 33	4112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeDebugPrivilege	4260	elevation_service.exe
Token: SeDebugPrivilege	5732	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1884	4112	SearchIndexer.exe	100
PID 4112 wrote to memory of 5420	4112	SearchIndexer.exe	101
PID 4112 wrote to memory of 988	4112	SearchIndexer.exe	102
PID 4112 wrote to memory of 2000	4112	SearchIndexer.exe	103
PID 4112 wrote to memory of 1436	4112	SearchIndexer.exe	105
PID 4112 wrote to memory of 2436	4112	SearchIndexer.exe	106
PID 4112 wrote to memory of 4668	4112	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_237b93ee844b1dcc5a86781db18bc7f4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5668

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4224

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2000
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d383207268d63189d13cc99b35781eaf4c9ff2d14295d7a7db65dae52985a399
MD5 1f264efd96abe3ff1ccda4e37b9c9932
SHA1 c248507e33b0fdb9f2e0c3805616316f665fe290
SHA512 8b178b92a5f4ab1736d4f8684d91764dadcb602d732a438eb81d7cf1d86ce155155fe11e756e9e3104af57673800dca52d3b7a533bf9f509a5885d8f31fac02e
SSDEEP 49152:Qb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnL4ZPzwFI/wOifnzH:63q6tjBtYtH
TLSH
T13FD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 84f895667af6887cb390dcddd8554f73235921fd8ca1370fc5442089149f005f
MD5 314ef385a6a0111fc2fea3292427d4f6
SHA1 b00cb26bda7d0b70b508ac469c34d9a6c555ab83
SHA512 d0422b77dee871f6636f06a3277eee4a207c74a85ca39dcb7d4d79be9f82e650f432486415098304c007faf024aee83f9099b61658dc8f8109aac817fe394917
SSDEEP 12288:M1XLsswWkxy2lRq2czAmcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:6XYfDtczAPM3tBZPzwFa7/wOifnz20
TLSH
T13205F128B3E109F9ED67827DC8A28501DB33B8954760E78B03B4953A1F736C85D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b7fc99a59ffe654abc4f0f8134c49f3865144a9c793a57759ab1698ad8b7a1e6
MD5 600c8f8a1fa12bc1b4fadb03c4389600
SHA1 3835cd083c914e573fc1897b0b817e4ca03521e7
SHA512 6e7daa642226609fbb6ebb6c8c4317c3a150f76cbb28cf56cc5aa8aa432546fd78cb293f604a2f92ba688b1c834f7f24c0ee7c084c74b5510644aade513a7eb6
SSDEEP 24576:w0Le5ji0hmxnrMMM3tBZPzwFa7/wOifnz20:wPji0Axh4ZPzwFI/wOifnzH
TLSH
T19535AE16F6748371D073C0B9C5D2A68AEE71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d80c3e9403409dd1de587572496aa9493cf34173e65dbf8492419eb208c78a15
MD5 700ea99c6ae4739fec10d3e0cd5db212
SHA1 00f66ff5141b7c65adbe59ada6636e0f2834bb70
SHA512 49a0e228caa5f0ccf1a6cd2dcc25fb54706bb4e0a44e3ef7031f75e28c3e04042cc1ed1ab54ba5e08da2728f76c4fb0e720525b89d6d6bb19ef31be72d6f649a
SSDEEP 24576:Ha7/ezSC6vUyDZaqgrvWx6q8wyuaM3tBZPzwFa7/wOifnz20:K/ezSC6vURPvMHjy94ZPzwFI/wOifnzH
TLSH
T172755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3920cd238c136e552d47b445be91a661475acdb7b2ca58182a9762c0a97c9de1
MD5 d53a22c4b8221b868c2351f842e18daf
SHA1 60c23b32fab9de62157f7b97f05bebf9e3a26c42
SHA512 1d1cca8208d1b7fec55ec6b055f5f0b75431483cbb2c1833736fb480de974fe7e6fd76f78e4bc0390f1f1156d463d4f715bfe7a4bd000e15e661d0512201290f
SSDEEP 24576:sVbqPb88hv/lV7DM3tBZPzwFa7/wOifnz20:sVO88hXlV34ZPzwFI/wOifnzH
TLSH
T16F559E66F6748331D073C0BAC5D3AA9AEE3234415B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 dbb7100f925e9014e9b2b7ee3b634b7458152fc12c746b89ef2d1dd6f8c98f45
MD5 3e9df8c65c5819db125c8a7005c43e08
SHA1 c0eb025d98fe19fa1c06674702e883e09fc89c9a
SHA512 50dc7844c0ff1ebb72eb5f2c9b28d7edb48f82ddf8255d00fcdeda8254cbd0dc7a95e0246116d5337c1217ee5789394a10b01bd89ca34db76f492b194a39d82e
SSDEEP 12288:AGbcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:AGQM3tBZPzwFa7/wOifnz20
TLSH
T14BC42382D79286E1DF561B7521E7E6028B19ACC85610A31F5FB2303F5EFBD46C0161AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fddfd9849f7a2feef8aa3de6e30eb16577d2ac4f8932d09f6b865d05abff2788
MD5 2b17e3ca36b585b249c939d93e836a6b
SHA1 052aa4b622b714f210b4b5bd6e8f759d74260417
SHA512 2bd32246e620044d59eeab94bc24aef4b6c66a3cf1176122be2f20472372310b6689624a9e7c602bb66230a5ea1bb794c11cff90896d0809e8d1e5aa15aeb5d8
SSDEEP 12288:meBNUbTVO86UScM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:mJIUbM3tBZPzwFa7/wOifnz20
TLSH
T18A05CF7BEE28FCE2C67A4DB95692C700D76278704B22A3CBD175820EDE235D14D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6f8ed9525d987e7349733e775e18529fab8ccf3e273a3227889fa31c2b8b8db6
MD5 c5fb4be21f6f40ff318c296719050609
SHA1 2b5e898b4fcdab65e663042dc1864db99c3399c3
SHA512 0ff72cda561e75f62f54408a33a930f74d11720ab6743bc37dda9de7df9eb563554d377d0c018e230d35ffce14ceec7c0889b1fc1a0e2c7f11f1ee978a4e979d
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THl:+QvGAdlCEL8c/pRNw5CDYtH
TLSH
T1E7267C656BF880F5E1A7E138897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 24db8570d04b6e75e02762cfd5579c6a8b4e93d0998f79be6f29d56a9f981cfa
MD5 d836ec73b2bcd000a3aba557ee92b444
SHA1 53e8930054ce511bb143d776f318262289285a60
SHA512 81a96b3f30d7ca643c0d14e95a443c26eacf47ebe8a09b7453844ab3d3fc019fe394a9dc0bff607897a93b8d5eda0528786c71ca00888aa843edfb2f2740361f
SSDEEP 12288:pAwSfxL/2Dc3xDLLmt0LDQewsAjAcM3tegtociOPyazluRF4KM7GAwOifEWDNRV+:awewsAjRM3tBZPzwFa7/wOifnz20
TLSH
T1E915E031FB75E032C77B0DB61B66C706142CB9604B612AC3E3F8499E59706D22376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8e4f7db5851a0838b674f88baaf3ab002be9de1fd79c78d1f8f63250262798da
MD5 52f990eca0441c67dfde81549fc97e93
SHA1 d34b9c1ec43c2ab5b8136f15f6c8ea9fb7211b2f
SHA512 b63e85fe0890146afc13dcf2a4d263a5d41d363889d10df955a6bd18cf0e967dae51bcfd487a608dc3ea2ee537c851a347ee931fd4093d34e402c276b3b003bf
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH2:9UEtQevvqc2W1cpV29I32
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 38335f0d58ea0e0ea9fddabea610333ac3ba085731ba93393fa4fb1409e991f6
MD5 62e76b0cc84cdfe9deb479fb70be734b
SHA1 e6469e3627c4d6ab49ec92f7a0c2c68b342db7af
SHA512 0531e448f59a9c4bf5a2e970232d2b5f763cbcb5fc1945231b16dd019c6709180d48f27b83521f50980dfa2cddadc35fb8d04746120d44e32a0f2f4b04b7abbe
SSDEEP 49152:oCbRquA/m2yL5zifFiV+XenmE3/zx4ZPzwFI/wOifnzH:BoqHVjnm3YtH
TLSH
T1C2D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 878eb267378feddec8c492fd6538e7646e27b5054f7c8b5b2c0b9b70266e7642
MD5 103935c4cb2dabd8f9eed5e9c7db2cfc
SHA1 1ffa778b62910a75f4332b8f1b123f2865e9f8a1
SHA512 f42cb5967a6ffb53540a4c119b04e969928b9e5c2ebc047df8ec8462378105b89d0ec38269d05898edc31ba934c83908259618516d671ee55e67673c6193870c
SSDEEP 24576:IAhGLmIFoiwtA5l7S53GM3tBZPzwFa7/wOifnz20:IAM1Foiq5W4ZPzwFI/wOifnzH
TLSH
T121359D81E7F945D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6903b457d7971a8cec09131abc7afa08ec671788e7034e72944a7ba498f12621
MD5 d6fb28255d8080dbaa959adf48ea2fa6
SHA1 79f3296f04b7a868e99ff1178c37cd8f7cc935d6
SHA512 a981a4a39e7f5f584efa73d5f6378719bd06b56e13283ade9dcdc2d07654c27dedbb37f68b29731dae9b974538bdd56588c4c52c43cf66f5b0ad6a6f13a9e933
SSDEEP 12288:Vmw5HEjsChNOBFgl0WDm+CFcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92go:QwuXOWdM3tBZPzwFa7/wOifnz20
TLSH
T1D305F14673E50CF9EA6786398597C132E7B2BC412A21D71F1770C22B6F77251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7c7396c3cc8f90018ae71cc6a1eca247c7a0d2185d2f1c40ea5f3b009383c056
MD5 594c7dca9fc06e648711e66570d7c472
SHA1 0f78430d770edaadc1c15cc00c7edb64e589d0e1
SHA512 93983e8d1eeacfa88da3e4d0ee43ed7f9c5edcc6f36f7b44a78d45d72504c49b58c7b605c2a0deab821acf768be1949c1c5fe446da948894fee3bb6431c952d7
SSDEEP 12288:/bZ1IyQcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:TZuEM3tBZPzwFa7/wOifnz20
TLSH
T176E4128A33E121F5DBA3567D88E29605C7627896233153CF1A71413A2FB3EC28D39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 937343b883924a7dabbcd10d8edafc4d6c4a460713fd6a20a1f9d48b65e482ae
MD5 0dc60663a296880d7b84d0ba6ffdc4f8
SHA1 a6dd07bdf6524400bec105f11f05e22f48853c0c
SHA512 07bbc997be9936cbc34a53e2de2ce6d37f6101ef7a4dcab3dd707e7bf7eaf334a8edccd20914f6452f1f88b3137e4fc41999bcfa5088bac2fb09be773636f007
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UB:MQRQyi36YOcPuLvw2gAf+PN3IYtH
TLSH
T142667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 10a747a1ef586f0ab2c19009222b42312915cd2a0a1d67494be7a910f7c7eaae
MD5 b96e5932eb99c171218d77f538baca27
SHA1 802e8d4b17a0026dab1cd8a88aab5161e58393e2
SHA512 597aa9e99b470d4fba0c3a172532bfd0ffc9176a24400c4e43f44cf3f9b2208b7da77a03104bbc20b6730a93ee4fbb4448559b6c761439b9d1b8effb2324b004
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UB:YQRQyi36YOcPuLvw2gAf+PN3IYtH
TLSH
T15A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b09be626017b4a8a6a1c8ac7d8726b02720d7e98a9be6b813d79fb8814579021
MD5 588ba09af6822e939aa423e54e7aaa78
SHA1 c435b063ff10fd10a485636b890dd0fffa64132f
SHA512 d330ace4770b2dfeccadc48dea1dfa66278fa7f5fb57dd043d7601b4f38c604db335adb822b0f82549a76e1836bedd700b87f2aa99bda5ac794e05cdda9335a2
SSDEEP 49152:868Qg55nhxeWu7PNU3/h4ZPzwFI/wOifnzH:2thGRc/OYtH
TLSH
T1C8B54A33B2F200A9C44DE1769F4A972196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7e8a01d446d15a6e2173012d19cd5bd6a0c73a012fff38483cdafa5467ac05f7
MD5 e05b9ff1d33424a87ccff7cad56f3b7f
SHA1 db4429891800c9f86bc0b258ee63180fb0e0fc28
SHA512 d7bfa6522f5c3252fe619e8af06bb7add433e949d279848a010b78588c9998be8c350c19b79de8e6def3cc6f607682022c76bf20a5f610fa1b1972ecf45eaa30
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:zy5112gYy5azzVvD69nLKnhZ9YtH
TLSH
T161167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b00a6e280ac6fb78892ceaa4f0e478e11e7921df632c1c64dc8ac3b5b889bcbc
MD5 85e95a33bf0c82786981563100a55837
SHA1 4b6c2ae60da56aba32193c4625384b6aa8fdcfbe
SHA512 3031eea258806bc6e8e6a629ee98bc95e043685185725024a1bb29f76d8688cfa7551fc773dd3523f9041fc8fe2605f9b32cc8863c92d118f41915c710caa5d0
SSDEEP 49152:SB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gls4ZPzwFI/wOifnzH:gu6JmQxd2dRYtH
TLSH
T1BAD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f953dc1c0305737efe5f6acacad44a282277ece593aa81c5ad86dfddd0c49426
MD5 9ed3e79079a846ed7b0074e971ff9e5d
SHA1 da9f124f5ab8872158e77684376e7be37fcdf21a
SHA512 bb0a68803303cd7f779df536a9c180ccdf671ab73584dd4d87f87554a1e11111e3ce0a4a367e9cf67a60bfcdf4574ba5283fa0c4bc46ef754b33a1a386c188e0
SSDEEP 49152:+1hpsNoJpF1A6yU44CwH7R4x74ZPzwFI/wOifnzH:+mifPVR3YtH
TLSH
T146B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 82c3c20a830fd7f05aa09f106190924da230b2622c17c8a68d8b18decf3a9992
MD5 56cbb4be3c0635c31e67336d9a359455
SHA1 41be50ff691089bed16e2dd082461ac8b121028a
SHA512 ed5c2ead59f07d4d2b79dd4d6d7239c71c969fc5e97900750d35aaae601378e0b75e2f4204872b2699717dda43b43409d19300587f641146613bd929e4de7fbb
SSDEEP 49152:0SuZQIY0Be2KIRVtOnks6NMHqE4ZPzwFI/wOifnzH:m5dKOi615YtH
TLSH
T1C6C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0b51e3eeff9c60e97720ad3b817f8a4a541dd4925291051fd72b6e4fc82fdec2
MD5 119b06d21a0175c6e8ae47df46b4aa3d
SHA1 c31aef0bc5ac1ef286084d1cde1c5f3b1e2025a4
SHA512 5221fd4795e6fa8900ed49d9c7aab8b3204fbf02996b23a6b1cb0688413772cbdab13b8818af19d5105f124f49b0a35d93a2e069ac2d3dcf57912a90469c0820
SSDEEP 49152:3htSn8EApI0figGgiDn0AP5wP4ZPzwFI/wOifnzH:mX2i/phbYtH
TLSH
T15C95BE13F2D901E8D05ED178C7468632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ff505ddaaaf51fce969b819a3da82e20829beec65c2a05fb67f3b7590ec3eb56
MD5 e693c5b5fdc9830883f12690a19c228d
SHA1 22b510201dd46ef07df4f83c244613b63464e764
SHA512 2dce0e476cdbf87a4ef48c116c207500a174774095fa916cae855fa9eec087b7ec479b1d01a0e2fbd2f2c4dbacad6bd05613774364a94f3bafe58d490a604cbc
SSDEEP 12288:RjcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:RIM3tBZPzwFa7/wOifnz20
TLSH
T144C42381E7938BE2DF015BB551D7A3018B0D6CC9A611635F2BB2103B6FF7D46801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8edeedfab70963dd3374ec0a0fc8f170212b0841e3471dd823a49969a1f94e82
MD5 bfa4789c5500b2db965d233b169840d3
SHA1 760f3af9e75fba06df6275c6c605f923c6b1e179
SHA512 e5b9a5006f9b50f6427a68a67439d6296f234584c3f2a029e5a3cc40b3c25337f8f2ef28091e1db9a7c7d4cb5151b504a62d4f3d0c5a32329c05791cc6bef29f
SSDEEP 12288:S0cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:SlM3tBZPzwFa7/wOifnz20
TLSH
T179C42381E7934BE2DF015BB551D793018B0CACC9A621635F6BB2103B6BF7D4A801A5FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 71948f0b24828966e0aeaef4519a61b234b0c067d5347747002c2ada0cc975bd
MD5 b5711da58ca7484ed32ea6f7354f68b0
SHA1 d7749ced7a96ff34dbea97b11b4fdc3f8e9628a0
SHA512 ab6667097cc64033eb1518c588e793e463d428546eb8b76ad442f51d6e722f2666b5881f9de040292542efe98bfe0dc900c987d1fba33f81aad7814424ffb7b2
SSDEEP 12288:r6cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:rTM3tBZPzwFa7/wOifnz20
TLSH
T111C42381E7938BE2DF015BB551D793018B1CA8C9A611635F6FB2103B6FF7D4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 168cee3994967b84b63f9616f2aeb01df293632591c0e1f500d50cc2e864eed2
MD5 44844a62ef467ac64d93e135be1c0df2
SHA1 f34802cc764b5b29dadedb6c3f7ad0f26e148009
SHA512 cd774e1a6365e5e2537356ce6883630075f5da3e6ba21d1fb3992075fcbda43a0db49d5c7a63f81913b237ff4f46029dd463e3c72504cd0d574b4b7be8222009
SSDEEP 12288:CVxcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:NM3tBZPzwFa7/wOifnz20
TLSH
T110D42341A7A746D1DF12977981E3D201C769BCD8A331639F6B72003F1FF3E858425AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3ea5a02ec017905bca6bb1336868841dd909789a84da6cf0d903a8ebd569e5e3
MD5 c56569edff943ec3a99eb75e47dafede
SHA1 203dc5ab326a3455cf01c8b10e9d8e4a326bcd46
SHA512 dcf3970bc48c64e833070d1b23ad258b19a80d646068ba9829d4c80e1773123bcd1d3a6d07258eb50af264d4a680b25e48295917c709d86b91b1816c055312fa
SSDEEP 12288:kpcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:kOM3tBZPzwFa7/wOifnz20
TLSH
T1ADC42381E79387E2DF011BB551D793018B1D6CC9A621625F6BB2103B6FFBD4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 adb41a7ed9b359701dc455b266bf4747cec2552c5cc41231f458e53c39cede9e
MD5 17399668ddb0bad53ecd7d68b98fe658
SHA1 290ce5fd5d9db5f9b87132c9b3f6c0364271ee9e
SHA512 4fba698a8a78723971bebe951af777b4e5bc52c7e4cb36518c9ee83283c2ddb6ec7302524b8db32c472399e0844639edeb7b2fb6492a8bff972f0bf9b0e1cf7e
SSDEEP 12288:WocM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:WpM3tBZPzwFa7/wOifnz20
TLSH
T1C3C42381E7934BE2DF015BB551D793018B0DACC9A621635F6BB2103B6BF7D4680194FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 61075e5b5341343e3a603721c8fb20f22de49e28bd183c3598549d4509d066f6
MD5 5c729ee6210e2107c2f4ba28dd8e591e
SHA1 ca23a18d0f92dcd7049e4da6e0326d52a2efe274
SHA512 2ea6b2cb628605019f32663cf952d68901f941c9f1cd426451c7bf110a2226702506e1997b128ae4b90aa04f576b92a7b2559440ac40e6436ceb16e0f3187398
SSDEEP 12288:UMcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:UtM3tBZPzwFa7/wOifnz20
TLSH
T1A8C42381E7934BE2DF011BB551D7A3018B0DACC9A621635F6BB2503B6BFBD4680194FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 471eca9eb140efe2e4ea195e09b9c4297ab59a7142dd74274a48cca3f1e4a54f
MD5 40dac5da6ba33e0133a8fa3b49c2f0de
SHA1 0168525fe99f73645f4b8c1f4cbf8e2d3f24d941
SHA512 90d7e79ae66053c262e0a6278eee11e648fe4cf3406ce04d869f04f188a5eb2add63435e766ea9ec3ea763f638505fe009aa083c840da5d12a9488638d3eb9cd
SSDEEP 12288:oiZwbNzzFEoS2cPvyUcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:rZMJzFVSOFM3tBZPzwFa7/wOifnz20
TLSH
T1EB050195B39118F4ED63823EC9668906D7B27C590770C21F17B4322B5F737A14C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8178645e8b8cae88cb073da3b60ae8e53f032a2e9967458a090c1916fc46021e
MD5 33dfdd1755332ba6298b17523d35bf8d
SHA1 f4e70156943aa3699d3b23113e58038c72e61904
SHA512 550c6fc2484ce3297c54e5bc6b03076d474ea97034e9e51ceff9aabbae6916d7d5ed7371f6381310459dbb8424a2505ca1f087196e5d3c3957012393248032cd
SSDEEP 12288:LvcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:L0M3tBZPzwFa7/wOifnz20
TLSH
T173C42381E7934AE1DF011BB951D793018B0CACC9A611635F6FB6103B6FFBD4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f60b3f68b1cbc2f1c4b4b13810757461ac9e1589c2520a993ae31745081594c8
MD5 f5f5173eb13f44fe01f63160a2914792
SHA1 fa831336beca994e8b1c7437e748523af76f5452
SHA512 d1da7e32c7f775e959eb6bf8a2a0505ce71b516091dca67c2a86d88d991de5e8eb4250bc5c9628725ad9ad6ccce1ff11042e3d1fe86a1b899d62c47c9a231213
SSDEEP 12288:ZrcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ZAM3tBZPzwFa7/wOifnz20
TLSH
T124C42382E7934BE1DF011BB951D393058B0CACC9A611635F6BB2103B6BFBD4A80194FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 758b2fa9d408fd05fe3683acd680bb0431444bb73795c52cc20953856fd55c4f
MD5 e1b221ebe15f136f940d489f4404d8ab
SHA1 a61e8ece43643ab07511acb214db62f895f8fe71
SHA512 009d8c26fd1579d1d191eb9404fe17343e8453e5e3a14fe4c52bf87c2e3a1efc0fb5c7bfceb5a8a8f741c16bd90a801769508ae9b76ab193ae45b6293d6ffbf5
SSDEEP 12288:KyPz5L8QcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:XzyBM3tBZPzwFa7/wOifnz20
TLSH
T1D5F4124773A221F9D626833984A35A02E775B875472097AF17B0023B2F77AD18D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b479e379a2d9d3510055f15c6b573f67f2c71e3c828ba601f931b822a34c5571
MD5 0b177927839ebae83cf030937f1d569b
SHA1 dd92aedae0d49058a127a4eb21234aa2c7758349
SHA512 9d92b141197b7627f6f498b9fb1908b61f9cf08c2895bb7683a1ffe3ddc315385bdadae3286564a1225109aec6bb315f1ee3b1ce932d031a303589c9d0e0379d
SSDEEP 12288:TvcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:T0M3tBZPzwFa7/wOifnz20
TLSH
T119C42385E7934AE1DF011BB951D793018B1CACC9A611635F6FB2103B6FFBD4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4392a3b3759d3703a31ff3272240c6cfa0cc8cc1493b19f13a8ff53d0d81c601
MD5 845dfe7d9abb3fdc3c849f45564475e3
SHA1 66ecd7626919ae839a2c9e5f8bf28523c6ec81e2
SHA512 2b92bef3d74fcd735fdfcbbb14079b207bcd4baf94d96055357faaffb0c07ae9fe51082effd0905456f223219f2221fe6121cc998a6fa425a252c1eb7b773ea3
SSDEEP 12288:YvcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:Y0M3tBZPzwFa7/wOifnz20
TLSH
T116C42381E7934AE1DF011BB951D797058B0CACC9A611635F6FB2103B6FFBD4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 28c94343d061e7f581363a2a29214b1123d4f0c1ed380756ae21b0f7937949d3
MD5 5001cea50c807dc3e1dfa9d78d4ac986
SHA1 5631e64ea528983df3705387c03168b9c90c41dd
SHA512 f82b2bebb0c0573bb11efb8680b787c4db1404fcf4aeda1b2affbf380a044a7c48672451d335b1eaf9e902145759209ac2c02c664888e5f90639b8d905e16793
SSDEEP 12288:8yPz5L8QcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:lzyBM3tBZPzwFa7/wOifnz20
TLSH
T1AEF4124773A221F9D626833984A35A02E775B875472097AF17B0023B2F77AD18D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 de5930e3c42d771df7550dcfadbb8158ab2753d725feb501da08a39320a83ab9
MD5 aca5079d002bc10b12de97a18a216c0f
SHA1 bdc58cc5d12639753bdfe85e8a6ca805fd8ac3ae
SHA512 39ca89f50936e76df9c71859cf4ad3bc7bddebdd8ceca99813e5cb26d8cef95a977f8e93b62af91eff0f3d959ded2292dcd103b9c0f120ac67f932655ccd0e97
SSDEEP 24576:YTuaLl3z0zDjM3tBZPzwFa7/wOifnz20:YTdLlja4ZPzwFI/wOifnzH
TLSH
T130050195B39018F8DD67823EC9668906C7B27C5A0770C61F17B4322B5F737914C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 570a7a18e39bc718eedd5db30bbfc14eec479e18876755ff193ab1283862499b
MD5 58c6affef53be680773c570298820176
SHA1 faf559cd9f2657a6500477f756901d884483ae4b
SHA512 e2cbcc49f98d929e33f9cb29fcdd8e16544d108309b273ca52599b9ca79b86167af8c8bf65bca1f00db8cc7665cd69437354109dbfd8022a01210aa709ed257e
SSDEEP 24576:I3xd9CHKy7GZnM3tBZPzwFa7/wOifnz20:Sxd9CHKyaZ4ZPzwFI/wOifnzH
TLSH
T1F725CF90F3E414E4F1B79A3589769511CAB67C9A1B31DA8F03A4252A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9ccea896793d1fa115bdb3da3831e373d45aaf14e73db49f50d7a8f3f2bfc192
MD5 bb8284aed76afbddd93300c415fab346
SHA1 303fe1dc63f6e176469c08fcc80ca715f4f4c52f
SHA512 6e256df7fcc57ab401c9c4c6db8d777bababa4337ae97a99fc06b635646f6bee0b4f358bf59e0a50cdd1aa48665a561ab4c24172f6513d774f3f09c8b898cdea
SSDEEP 12288:WacM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:WzM3tBZPzwFa7/wOifnz20
TLSH
T179C42381E7938BE1DF011BB551D7A3018B1D68C9A621635F6FB2103B6FF7D4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e7c60bdbc83d36881299ab4f93edcc0921c542a031d09d24e3fec373854f7e8b
MD5 f8b43b4fb6d01699a5a2cda9b2bc9620
SHA1 5875a9bb7839cd41ba315fc8697c7061d0a7c8e1
SHA512 c182dab966d2428d563b41ba55f09656183344b7863f0f6737084bd8ca8946583d156ef5217fdb110198232131fc2074287f4cea08c9db2e27fb324d7c083de3
SSDEEP 12288:ZwcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ZhM3tBZPzwFa7/wOifnz20
TLSH
T140C42381E7934BE2DF055BB651E793018B0C6CC9A621635F6BB2103B6FFBD4680164BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a0ad698d6907b8245eaf6a6abba1e312a2b24d54d2ea8fa0d6fa51254a46c02e
MD5 569c2e396b10c8cb7c5801a76d2b61e8
SHA1 e9ba79d49cb1a195c52fa9b1b4a72e5311e5c5ac
SHA512 0940fac47049014597ac0fbe76ddf3346c333dfa1b2bb612d70f07950d4c9e97932fcb9911469c646275eab7a77e50ce921cce6c1ad7302befa49bc059531ff5
SSDEEP 12288:7dcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:7CM3tBZPzwFa7/wOifnz20
TLSH
T129C42381E7934BE1DF011BB951D793018B1CA8C9A611635F6BB2103B6FFBD4A801A4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 1c7ffe7129b1d2288ef2ae191717343028949c81286eba11ffd630f76c81b941
MD5 af530ce5a7b93d45a0c02971bbcb8bbe
SHA1 3a7a9a98e5724c1d9c27e3c4eb2f5aa9553620de
SHA512 85f9839fd063b90a8c3c60279d84382c762201d7bb59e305b2e196d00dbd88685607493bf2ad3e64958b6d6c8548254f3b4e5b05ed2fc9ed9479523d0d831be0
SSDEEP 12288:MvcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:M0M3tBZPzwFa7/wOifnz20
TLSH
T196C42381E7934BE1DF011BB951D797018B0CA8C9A611635F6FB2103B6FFBD4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 b70e52ba1cf91a37ff80d1381537587a10c772f2a1231d3dd1aedfae96d06b5a
MD5 f5baac88d9333509ba8115b68f979fc4
SHA1 59f1005b6e120a43fdda0ce10e5a076e650d2823
SHA512 23875fe7167b4c14dba38f9dfb237da6fdcdf66015c925c709297bd5a19df9f38f9df9612b4d8282936c75173bc235d6e271450c306071da65e5d0145ac38675
SSDEEP 12288:xacM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:xzM3tBZPzwFa7/wOifnz20
TLSH
T138C42381E7934BE2DF011BB551D793018B0C68C9A611635F6FB2103B6FF7D46801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a4a1a7f483f5cc5363c5edbd6aff06fa3f134b0579d93829f44e1d04c5c693f1
MD5 3cfa87317821eb3860271034277ac50d
SHA1 9226dc726cfce32aa700aab0f0658725e824217d
SHA512 aeea012a7f44b5f3fcc057a2f0b5581f80440a9990e1a42b0c9d18785687ad83eadd798b6a803d3329b18e94c20760852ea5ab9fe03cbcff5bf02c9c4363c58c
SSDEEP 12288:FncM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:FcM3tBZPzwFa7/wOifnz20
TLSH
T1FAC42381E7934BE1DF015BB651D797018B0CACC9A612635F6F72103B6FFBD4A801A4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 70ea0998aa4c289931c400e20f84bd960f295061f2f1611b2dc6791c3fe5c60f
MD5 af2579b438642f777df18731c57ed725
SHA1 79687979053e21a1d73a2cc8c7714a7280f2bdfb
SHA512 ebe22574d3bd1eb1fe5b988d71f09e5683c4d7a4c530e6ce2261cbba8f4ff9bb438f8e220ed23a97180a134a2f72260023c8ed3467e88a528a7af37cd73c1d20
SSDEEP 12288:bpcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:bOM3tBZPzwFa7/wOifnz20
TLSH
T1CAC42381E7938BE2DF011BB551D793018B1D6CC9A611635F6BB2103B6FFBD4A801A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 7900189e23c39056c06af2c27ddf2d3c218840ec5304e716f73e0f8baf693d36
MD5 526befc8389497f3c3ec37c9f50373a5
SHA1 12c3eb413894677bca8d5507a67a1885a04d6f50
SHA512 35ceeb55ae47f719fec5651a7eeb3d8869ccd4a71bbb28976452dac85e94a6fd4b1f39510ba0a3a9039150cd306dd097b515e1bee13a65890403f2d4375a62f0
SSDEEP 24576:ffwvOk9RX6wkyAIwM3tBZPzwFa7/wOifnz20:vMnYIw4ZPzwFI/wOifnzH
TLSH
T1C335D029EBD844E5E177923C89F3460AF6B178591B31C2CF12AA536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 25fcf06851f669b0383780bd48a3719dd3de0e679cee9bf164d8a92e43a0f0ae
MD5 73b0d0d6d9bf912e71c86a2c9f404f74
SHA1 a771c6f3c0a82c303fd4ae8f85e8adac9f2b5281
SHA512 a58f81d06defd2476337ccc7849d93a4330921d0f79af8a55d01693f6b1bb626637a7a39c2345fee298369877ee63998cf46fb3509393171cb03744d3e1fc08b
SSDEEP 49152:iYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0v4ZPzwFI/wOiD:yySzPoYtH
TLSH
T1FE067C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 55f4ed884e5f24579ef8d4f87bd95c2ea08c42cc85801a2acade2e394bf56d64
MD5 19bbdffdaea8c314e6cbfa84ae178e08
SHA1 eb19fedd1fd2f7d8a44803718a844c3ab0f66d84
SHA512 f32cf617b0cf4616b746ce53dbf790d280f74d93f59270ea58b651cc41a3b1c4c2b9cf046ccdd964767eb909e1f1c185ef1bb0c459e8e241b9118bbe86fa5e4b
SSDEEP 24576:S47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY1M3tBZPzwFa7/wOifnz20:S47JUQjairIhCnDHUPfF/f4ZPzwFI/wt
TLSH
T10865AE1EA3EC01E5E1BA927885558A1AEA71742D1F31C6CF2270437D6F63ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 017a44a46e516113a46c30e444f64e44840a93c3af438090334dd8dea69fd1ff
MD5 625623b1fa46884fbb617c31ee80105f
SHA1 0b0041b4237f7efe4c3426a567a16f0133e387c9
SHA512 4959ba08d9dfb10d6de16ecfcf4e821a2246d81f98c8c17a4a08a701ba43e04eed6be20dd5da0177a6956afd6270258d3491e906b7aefd7ec43072bc44dea276
SSDEEP 12288:qksffcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:wEM3tBZPzwFa7/wOifnz20
TLSH
T1CEE4F149D29402E8C56E6279C7968601F3277C6583E1E3CF57E0F03E1FB6A818DEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 55014a0bc4b6271d9126b16b436a3e2a2592e09c5dc7a44d20e502cdad87d26b
MD5 c9be454726a494d9df2c97d500e63304
SHA1 22d02bf100a36c01b909e9ec8a413ff584964eb4
SHA512 ced83e43105a728cc75d87905f8a6c11a65a9199bd0df1d00657f67996252a3e7d063b4c01107a6c055540a39b3ffa3965782787d62d7e4b078857f8376ea0db
SSDEEP 12288:g6ft+pU3f7eMzndZADHKELSR0hC06pTs5YvIfjOuZ3f:g6F2UPpsC5QyIfjHt
TLSH
T109253810766ADB5FC5AD80321E33C1CCAB707D01EE059B0772C8972FD576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 ffa9aab1744c53ae8379aec4d1e8dd1c85eedfc24e97e8c600f97f3760543c44
MD5 cb4a40bc6591e77857a33adb29243883
SHA1 aa8da5e63acf8375094077c1e30c17ff1d6faad6
SHA512 d9a8baa06bfc9e538ac5941e49659c1eabc5c3fc61d6f0d2c9495ec9942c2a2b010e4585ea0db31571e6b0374753d21d578747bed4cdd3c2aa34b2c876350fd2
SSDEEP 24576:EQTlMOlD2ATEv5c0sqxTAM94Mo9pDc4GlbMJCQ3LwquNg:EyZN2YM5c0sqxTAM94Mo9pDc4GlbAj33
TLSH
T18A55C7816537E3CFD0FB6132072A9B4CA764EC0673495F26B3C4453ED82AB65A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 04653de9a04c89ab05ac4060f4c7795ddd47477d607137c633c907d1bf0cd6ef
MD5 ad4a80673220693823b4c70997cca500
SHA1 0c7d0a730e85e703217ffc8255c23cbc435706de
SHA512 f3a9eb995e1b2f4dd7b330336af1048590e8a5c4987861258be97d5b96f075dd4ee9f34a8d3fb6031f3f36cff5dccef2ac032a537687785fd3f07bd3c7fb0421
SSDEEP 12288:Hz7XcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:nsM3tBZPzwFa7/wOifnz20
TLSH
T1EED42352E3968AD1EF251B7410DBD211470DB8D85B10A2CF7A72103F6AF7DC688355AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5b593afce1f91113467cde67809f6fde52f0f5209516fe4ce50275b55a1a96f5
MD5 53c75eb188ef53420d43300367f11fec
SHA1 7e9582a221714ccd041775aca62fa8cff7881b07
SHA512 86dc8f3e317b70e24a2ceaed7a28d4e1aab0aba97c1f3c9ea4f13ddfdb1639e48d3e0cfabf50835e4fe0192ba7d32ba931bf4f69824f0f9dec9b2b91901c9377
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYaM3tBZPzwFa7/wOifnz20:7gb4mBIBhGF14ZPzwFI/wOifnzH
TLSH
T1EC65AE1E22E802F5E1F9D2B89DAB4417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 21c632a660e15df15c05e7cdf195109c8d1770de1143ce05ea44db48cb4c6b8d
MD5 f9f0557bd58fa6bf706de58628da1473
SHA1 c39c765155a6ce5171b9dc87e1ad643281af0fab
SHA512 26eab15503e15c99da4335a408ed7854449faef3eb6c64f7c73e6b27b1e29fb858b789d9b195759f071412c0bbc7aa2205041022400de98e6ec8f7708d262bcb
SSDEEP 24576:UG88u8FpJqH1nzria7/mFM3tBZPzwFa7/wOifnz20:n7ZFPqV6a7/i4ZPzwFI/wOifnzH
TLSH
T11F35F165B7E102F1D477D13889874663F6B2B4250324EBDF07A88A661F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 aaf91a11628c18b2a5b92c27418b2531737116aee0debba5710fd8977468416e
MD5 81c1561c56e109f1095b45357eaa29ad
SHA1 ce2d45980066582b928365324577382db3e855ed
SHA512 ebde0e53556af46403c3e148417ff14cedebc38428b919ee74b96e24f158adb6b9b24605e7db7713b7a3549889dfa2781f5d05677f182a0a4e61f634639f2af6
SSDEEP 12288:1HvUrBFrEjwaQ4cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:1PUr+NQZM3tBZPzwFa7/wOifnz20
TLSH
T15805F11F62E918E5E776A17D85838709E771B8621311A2CF02E1813F5F67ED8AC3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4fced4a5bec3d0e9e3cff7830752299cb5f3f2b116b5f3992753b43f5fb48450
MD5 a9b1c46d2592e4ada8e77e63960d7488
SHA1 5da19fc5e665f1fd2d35694ea86d9b3376a067e1
SHA512 921128f6fc3b0c44a29fb5cd3a76ac50ccedf2b7231304f630f02f3362f842d9bdd707d32d30b0ab6734090d130fa257fbc0947efbb4a49f9e63c8a74d453d0d
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjp4ZPzwFI/wOifnzH:QG05lO43b1YtH
TLSH
T1C2D5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4affea7a2e53224faa70e6cc91debb69cb22256c9f2195ba7434de14271f5e2f
MD5 ef792064f6b6c4b6b0c1de597d799897
SHA1 23aa883dc4a47b9e48b00de3dd4fc7de28de627b
SHA512 03ad751c1b5309b9e5425baf1d3f64f24cb4a60ef84ca0881f0d2bee882ee2d917a9f240c72f47f758615a7598fd11e0e51800e4ab5ffcd696458cd7913145cd
SSDEEP 24576:Kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnvM3tBZPzwFa7/wOifnz20:Ca5POZ3hJt2pasx2+mh4ZPzwFI/wOif7
TLSH
T1A765BF5EA7F801D5D679D17DC583861AE5B1342153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f9ba0f12a3945179d75b802d352cbc490e266bdb34d375fa3ae816a055c31d8d
MD5 1f6e0a2003c363cc7c395a6216a6cc28
SHA1 00a6a9f80e9dd2f6d64776c3c498ae9d66179da0
SHA512 5bab12614e9b7259266ee5bccf2a468f6aa3bf899062f8937a3fc926999c5a350f5eb59ca55f30d0ffede45e49242768376959b68607aa1ee4560a28d59b3df7
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7Fk9M3tBZPzwFa7/wOifnz20:7Nc/zEOVHFC4ZPzwFI/wOifnzH
TLSH
T14E857B1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cc9f9d6b4da02fd807750fc9d34b609cc2e740c588c0efbea9b9987d40f12746
MD5 0aa4f4ca96f7bb927fe68390b35e0428
SHA1 bb6fa12c9f9881cb65f4c09e11e792176e00bff2
SHA512 b4b6ee0fc18a7ab8d011cc77a241270068b24dfcfdfc23de85fdc9414dfe02d7f24266afacbde57026ff792192187a53fedf5b2dafeb01c6815c93d1bc285641
SSDEEP 24576:E3kNvNnaFeYhJNtmZBmIM3tBZPzwFa7/wOifnz20:E3MwBtOmI4ZPzwFI/wOifnzH
TLSH
T1DB55AF6EB6F846E4D1FAC6B58D238512EA727461073293CB5390C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 572f7a28ecf85a81e8594b7ec4b3a0c4774173fb86b05b214092c294a4a65d79
MD5 edf5cc3168ff3c4ee4d5632f4c6616d4
SHA1 465ae147393d44ee5d5258cb720b64b72a500d07
SHA512 0f73f06e25aca3facfa041a0fa6a36f06c5f29e5d8eabc1311c6b47f6b7e85987b60d131083f18dc74cb10b0cac18632764db2115eb7f06195bac5f93631750a
SSDEEP 24576:ID3FHshBIYQgAoM3tBZPzwFa7/wOifnz20:IDVHeBIAAo4ZPzwFI/wOifnzH
TLSH
T10525E17DE79D04E4D57BC2BCC6A38606E77138A9032266CB06D0817A1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3332-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3332-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3332-326-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3332-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3332-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3332-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3668-132-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3668-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3668-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3668-134-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3668-126-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4112-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4112-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4112-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4112-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4224-106-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4224-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4224-311-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4224-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4224-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4224-100-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4260-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4260-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4260-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4260-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4484-73-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4484-292-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4484-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4484-67-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4532-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4532-9-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4532-0-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4532-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4532-32-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4532-35-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4688-120-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4688-48-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/4688-59-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/4688-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4688-40-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/5128-121-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5128-310-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5128-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5128-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5668-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5668-83-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5668-306-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5668-78-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5732-51-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5732-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5732-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5732-269-0x0000000140000000-0x00000001400CF000-memory.dmp

Download