68b8428e705472f0dbe3f0f10da8e7a668898fc70f3547e5f1504ed40f0c68f4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260811-thg5msgr81
SHA256 68b8428e705472f0dbe3f0f10da8e7a668898fc70f3547e5f1504ed40f0c68f4
MD5 08625a782fb5060d92b0c438d1af493c
SHA1 c24a0978467432bf1168596474f23952348ed127
SHA512 37f93fc5df9b5c355692729d937d8c511c226ecad38f28c84e6a8732c2a8649df8dd67561e1c02f408ac5bb946cc007f97b7c54feb76ee27d6fbe7d108aa3e1c
SSDEEP 49152:b4VlZuN4fQE+27ItYZuOfVZBx8hrywGVW/NcCn0W7p4jU9dsTd3LaB0zj0yjoB2:bDsPi1fVB2Yyjl
TLSH
T1ED267A1BE6B940E5C0B7E1798A579617FAB27819873297DB4790470A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2204	elevation_service.exe
4728	elevation_service.exe
4664	maintenanceservice.exe
4808	OSE.EXE
2480	PerceptionSimulationService.exe
4272	perfhost.exe
4500	ReFsDedupSvc.exe
5452	SensorDataService.exe
1028	ssh-agent.exe
4668	AgentService.exe
2460	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\70c6820fe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-11_160326_3672-4684.log	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-08-11.1603.3672.1.aodl	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b38f48faaa29dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000642d8a3bab29dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000406bbd3bab29dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c14960faaa29dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ec4c3faaa29dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013bcbafaaa29dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2204	elevation_service.exe
2204	elevation_service.exe
2204	elevation_service.exe
2204	elevation_service.exe
2204	elevation_service.exe
2204	elevation_service.exe
2204	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3672	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2204	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4668	AgentService.exe
Token: 33	2460	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2460	SearchIndexer.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2204	elevation_service.exe
Token: SeDebugPrivilege	4728	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2624	3672	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 2460 wrote to memory of 4472	2460	SearchIndexer.exe	102
PID 2460 wrote to memory of 728	2460	SearchIndexer.exe	103
PID 2460 wrote to memory of 5576	2460	SearchIndexer.exe	104
PID 2460 wrote to memory of 5648	2460	SearchIndexer.exe	105
PID 2460 wrote to memory of 3380	2460	SearchIndexer.exe	109
PID 2460 wrote to memory of 5868	2460	SearchIndexer.exe	110
PID 2460 wrote to memory of 3464	2460	SearchIndexer.exe	111

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_08625a782fb5060d92b0c438d1af493c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3672
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3672" "1800" "1660" "1796" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4664

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2480

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4272

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 873b85701a85bc5012f904c2df72fa84a3d962906ca5963ca9dfe88a0287463b
MD5 6fccaeda863ce57ab2dd759dd3cd345e
SHA1 7e264626ef79336f2073caac9f8b01a84a2850e2
SHA512 142d43d00d3d9e94cee3ba11be06aa0a73a2e03e0ad4a74a0dd7500e6ba8d3400eee30a2eb3caa2e7b2cb4e26220e3de0a71aefbd0f039ea659d154beaaa8bae
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuaB0zj0yjoB2:33q6HjBSB2Yyjl
TLSH
T107D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a355fa2cfe07120851808dc8122d912a1fb657a5984c9e57ee553766b24f940c
MD5 5432e082dc3a74eed9c00b9d569d0ecd
SHA1 08cc6b87bfa97a50f655a5d24ca390e90658f4e8
SHA512 473890e60d02d7a39b3e7abfd31486034b562caecdc3fb2c25cf8aa858a6ab062fa3b30ca705d44f4e102f998c42497ed4fe922f1c63a48fcc2fe0231bd84355
SSDEEP 24576:DXYfDtczAjatr0zAiX90z/F0jsFB3SQkS:GtccaB0zj0yjoB2
TLSH
T11A650229779504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 30704e100eb2a2bfd47463cc3f0164ff6c72f7889ee1fd16c7934aee546cfceb
MD5 b385aed3a4b20c66c1badfcf30a46124
SHA1 4eb8b89a25616afa76dc999598d79fac11e02e69
SHA512 95dd5f970e62787ab7274cab52841f71f7f0c2898640fa726b929bdfa42803624937c894c4b9170debda9fbdec76cf2b1abfd83bda6bffc53d28baecdda01add
SSDEEP 24576:O0Le5ji0hmxirMdatr0zAiX90z/F0jsFB3SQkf:OPji0AceaB0zj0yjoB2
TLSH
T171859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bfdbeb0899d3645da52ffdb3bfcdb7d7b802c02dc0f2b25394e1d907a0198293
MD5 05d8f8c3d169e373c1af33155d5b3995
SHA1 b4adc808ae5313da517c9f83d137100d578f4687
SHA512 5d95da24850a6c3a4bce5fc0233a16e7e8fd0e9e375d4311b51f0f512da64467519408e2d9561fb67a9a778c3da694cea07329c943d5b7d6ddde4edc2c94205c
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyufatr0zAiX90z/F0jsFB3SQkB:d/ezSC6vUzPvxHjyyaB0zj0yjoB2
TLSH
T14C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c3cd1382752e3f27944c3c84767cac0de069e57a93d256236f92e2e0dcda8076
MD5 3747f67fcf29b51ce9e3453b615ff9bc
SHA1 95b49f2872e6c226d48cfa9e23a4c8e84a57c220
SHA512 ce8c80cb5b1ef7a89e6a517bdd6c1df673fcf3e9a64f641bf2eac50b183d9107c4e38391ce6322d2365b844ca5d5400e8823fa454dec54e8f8535407038e1ce7
SSDEEP 24576:DVbqPb88hv/l+6Eatr0zAiX90z/F0jsFB3SQkQ:DVO88hXl+RaB0zj0yjoB2
TLSH
T1D155AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fbafef961766d09267cf0ba0a38186b6ac373602c0e456f65f0988648597748e
MD5 d0fae98647512815a28b2e1cd60c8f5e
SHA1 0e09dbc70e579db7b515b3c96698e3551eaa2c42
SHA512 32c2a3c81ee54b1d4679ccd213b68d546bd5ab2536043ae3fb0950a28312cbc5a8966cb234cef5e9cb77e606d969f73e9b8f4039ba883d33d864a81e065009e9
SSDEEP 12288:zRZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:zRZatr0zAiX90z/F0jsFB3SQkk
TLSH
T1F945230B340E80F2CDC32B3566989C4B1ABA9EB065E2AF85E1913F4F9D3C1C6D5656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3063aecd10148242493197deece81f1701e5f10223a5bf4da17c96532423323e
MD5 24856a837de30f83b0b50751c4cf01fd
SHA1 dfffcd1745da6ec7e6d6292d4b2fcd15112c4fb3
SHA512 ad07fd08d4447b81618ad25bfa09d2cf28d42f6bcf902e1e190a018424293ff7623078fb04e1c142b843ceeb3e67c7c28dd45f2028a7913af2b13113f5a06336
SSDEEP 12288:/eBNUbTVO86UcUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:/JIUcatr0zAiX90z/F0jsFB3SQki
TLSH
T15465DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b0e7e222193d21bf4e9c9e7c9aa897f428f78f515ed4c803ba462882061325fc
MD5 912523bff532146a65e993558f2af8dc
SHA1 f12cbd056486316c9fb2e462128bfc53f4c75d8a
SHA512 e7309b46c6e0a725d046e2d52af54fb6c540b2c6275fb2e7edc7802e3781e18cc5ba5381023c4f012f867a32d9eec04617d87d26e0c232971929001483cefce9
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:CQvGAdlCEL8c/yRNw5CCB2Yyjl
TLSH
T156267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 304f4c8ffd57ea57c724758bebde5bfac268243572b67c1f56f140f3fa25aee9
MD5 e27c8b9186c0445c2e60a2fa816a6e2a
SHA1 a70004f7d73e7754a1921c0cc8a9a0f702639224
SHA512 54baae69800ed9bf5d7830da111bae5b222c47f39edfed1ea4e7a044b8f9eecb799353c6ecec524a19e2d8c3f1e0b492f6ed37fe6df56a478a79b9d824b4993d
SSDEEP 12288:TAwSfxL/2Dc34DLLmt0LDQewsAjOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkH7:MdewsAjOatr0zAiX90z/F0jsFB3SQkj
TLSH
T19D75E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fa284dda78a260a38939def759d89d059089269ffc0dc2017e17da98246a05e5
MD5 71a83b02c2393dfeb3eb58e68c25b9ea
SHA1 1249b3aa612feff9e47c0507d2392a5b2c6b5b53
SHA512 8c1b76b206d1157cfa1c608fc11e9a2c80576aa7efe7beb71c5eee681922afe822a26a83705b7931782595f8e3a96f152c6ffd2b348fffa659f7fe935c9bd9ee
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBZ:dUEtQevvqc2W1cpV2EI32T
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c599d9562973e3b62356ce42921a3974490a9628b8ee03289d0ac5228c27a346
MD5 350ba374dada5b7ea08bce48f709a42a
SHA1 a23055f851af7d6ae0f406d3503bc34ef57b1523
SHA512 47da3875e27dccfb5352fd21342a0bdac9ec2c4ed123f97796e94f6787fb157d7548904b15c00e4c6c2cf6e45a70ab466c9dc3accf3e3f5256a3400950dd76bf
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zuaB0zj0yjoB2:EoqtVjnmeB2Yyjl
TLSH
T1BED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ec1b3839eb164d86fc6931609f83fcb5213fa9ed1c7ecb6235fe06720afd70d
MD5 06512541c80405193a762329bbe19eef
SHA1 562b20535ee87bf31b2d32e4c84171c66a21c046
SHA512 510f149158ba9ed6977538b4b340b5c2f5ea73913fca44ff40f6490a5edc9931634cb83eb8d3971525e43780f7214794a19b7f8935a853dee49ebfdd6ae37315
SSDEEP 24576:KAhGLJIFoiwtA5l7S53zatr0zAiX90z/F0jsFB3SQkg:KAMyFoiq5DaB0zj0yjoB2
TLSH
T18F359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6a6c59ff66dd91c971e33b9b03a916f8798ec87637a397bd2d67f92ce0b2ff5a
MD5 571389528a55d64ab05c1883d984ed7c
SHA1 2a893726534bb42e268ffb33784dcbdbeba5c624
SHA512 91fbff7d224d42c8b512efb12c075eec2d26eeea16325aec73be601ab23d9b0a72c645daf008f7788d7b718f0f871341840e20a83712760f4bd327f3f8768ef1
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+CsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:TwuoOWJatr0zAiX90z/F0jsFB3SQka
TLSH
T1A165F14A36A90CF9E9A342388587C536E7F2BC112A61DB1F1360CB5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4afa708f8b9d8271201ef789e6ebd275bb5b780691acc6d7943ee76f9b600895
MD5 33fe3d53c0e63fdccddf14589e964080
SHA1 733039ed0c4fcd9f5d5579b1c89ee7b8031f734d
SHA512 662340573ced85b14c54db15ad23db9a6c71a1b3e852bcbc0a9de64b34edb7d2098336f286956d713a6a2d9543e19731e476730c9512fe078fd8d3aebdbecaba
SSDEEP 12288:qBZ1Iy+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:kZu1atr0zAiX90z/F0jsFB3SQkP
TLSH
T1C155124B32A960F6D5D3523CC9E44906D7B2786123B283CF12607B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e65abfcb4774d5583063246c83b8cd887812df581e7db97e09f2a35af7e57b4d
MD5 731fbf843bbc94dc445099945b1af910
SHA1 292a4c508f3b0579b4fb908b2c3849f5866bbbed
SHA512 75450eafa714acc46e5e30487f10ef346ed2f035e945e2253739f72a7be8be2d2c96a317d608a4bbd3288ad89ca069e2d47fb13188cb25998f168f8efbd7df57
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:WQRQyi36YOcPQLvw2gAf+PN3vB2Yyjl
TLSH
T153667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4ebd2d54320794a3f99b81376599cd658f1bcff132d4e6dec2b0b47cc267f03b
MD5 d5bb4403995ad7c341465f72465fc41b
SHA1 38b559bf005ae74733ce19df0cbfcd1fefba6bb1
SHA512 836dd03f6c79d34b967af764a22c37f9fb5d26e3dbd0b4a52587c7a7f7aea28426465222b99aaebdb9de556c90f19f8db8ff62b459ead36d9f37600dfac68118
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:EQRQyi36YOcPQLvw2gAf+PN3vB2Yyjl
TLSH
T1AC667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a39766b5dc2dcb046408b928a044085f8ef775b29bf0f390ccceb3a6822a6d0
MD5 2ccf69acf3ba6e043151688d08b99f36
SHA1 6d75caf8f3418ddeb782c8642351176e8541ed46
SHA512 2c4841356b0b8c217acaa475e1911980bb0d1a0cce82b4c7d7f87f9f65c7bc5e298afb32521a23cbd675f333dbe8d4dbc6d6194289c2982e6045bf10f6b19b7c
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Fatr0zAiX90z/FL:A68Qg55nhheWu7PNU3/eaB0zj0yjoB2
TLSH
T1EEB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5604ce8149146ddcbe54cbf736cd4d527062971fa5862b8a810eb03f266522c2
MD5 fff86d5f2a5a113d85b93d91c063b01e
SHA1 f632ee2ebcd6e81d3879255e35746aad93a1bc24
SHA512 8cd45dfcbc086ec09600d6a127c7bce4efadf597af428de7ec3b0f05767053a6b487283811bf70bc6a9f55e3501cfdc1ea2d498849e6e85d857f9a76f806adc6
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Jy5112gYy5azzVvL69nLKnhZgB2Yyjl
TLSH
T142167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5e97428ed4463eb25b5aa09481e705ffb1212783623c857999f7d75d69679619
MD5 90e083503d9ba0e1b63116b7601d086c
SHA1 06360137582131a2e75659a2ca1c1e2cae837fb6
SHA512 9c4a1596e806914c6e786f16624c6818d4e7dc3dd6ae4273574500bdeb78cee0859d9ced6965a6789fc1a936d7e76c84380d5c8c8b57ece5c5860d20dcd7d2c3
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzaB0zj0yjoB2:Xu6JmVxd2d+B2Yyjl
TLSH
T1F2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2c79c0963e25dbc43da893a7dfa7f6fe6d047a24dbd5ba2e8a462f34a7e88ff8
MD5 bf6299602e014f6099cc3c217fbf6fb8
SHA1 ef908fca12ebc40dc276445fd6004e7a43bd479a
SHA512 4b70aa6f593eae674e72ed1a8a6c667698838bed13f5d9624ae80fd5e1d642e4b543aa9f86b8231666ce0b5d74077eb44c4e13e44b0cb48f3af32f9a97606581
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4x8aB0zj0yjoB2:rmifPbReB2Yyjl
TLSH
T1A2B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cef0bdc761927d09ba961b213095dca8ffd96ccc30f4ffd16a7be745a4af65de
MD5 820597783a634fcb1b9ce4c209b0c841
SHA1 bca4c1bcd29fe8da610911aa9e6db9c1661a3685
SHA512 c769b279682793c2fcb47acb22e611bbc40dec1d10582e3fbc5a7e1aedcecc4a1e2e34f51ff055087fd8c753dd37e1b00056a5c848c3872adab9bbd7b7753f8c
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHq1aB0zj0yjoB2:A5dKTi61kB2Yyjl
TLSH
T18BC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fa14b4755af0f3ca42ac05bb28d402da2fcba2eeb09884d888b46756f130ef5e
MD5 0d120f20aad1b0087a9917890daf1339
SHA1 c184f0b817b0ddf9e37540d46b635274ef3aaf64
SHA512 8f2e6f09f9c3aaf2452bad48c489c81b9ba9a9f4dcbaa5d078b0e8679f3e225966e908b7062d2116b296640860a596555473bd8c0e882497832b48485c5a552f
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wYaB0zj0yjoB2:sX2iyphKB2Yyjl
TLSH
T1CD95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cb16a293e0ef31ded00b71ced17e2196e29825107c9a3267ae1a3f19e3ab2f5c
MD5 4fcb92d0066fa57746bed64f1b3b75c5
SHA1 e9c288291a91b5e644a780d8bb7528d27f1a9730
SHA512 8b8d7a01c4e53aded02020fb4aaf2b10c724ba2fa67f94a6473570aa2ee25402a530e8e4318f77ac7f49a0449cf952e91974b9b8c6df5114505643f4cad06908
SSDEEP 12288:cRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:cRatr0zAiX90z/F0jsFB3SQkb
TLSH
T18045230B341F80F3C8831B355688984B1AB95EB4B6E36B85F2953F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e9ee4061e7482eb9c56527b791dbc4199f431d78e014c72179506c1d3d4d3a76
MD5 7c000334d07e2530af66d3cbdd539d7f
SHA1 4456feec4fb8ef912a7a68b49b0c29ffca1c9437
SHA512 a7ffb77f787c627f4463e1dfebe826e805333193d4a1c9e99ed97e35404750c4e99e1187813fcd40684c538e7d709b61c6474ef1f37aea112e98654c4569c62c
SSDEEP 12288:D6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:D6atr0zAiX90z/F0jsFB3SQkH
TLSH
T1D145230B341F80F3C8831B355684988B1A795EB476E36B85F2953F0FDE382C71665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dc64b8c2c5d230d5fdfc75d2e0fc598e8a09ed6259da26d4c9198330a1adae0f
MD5 e74ad6820a96dd377e8ff2a2ed87439b
SHA1 925aead589a0462fca95c0a70711962d2c5ca993
SHA512 b13e92bbfd2b4cbc93f7f34b491da2d5549ef8c0ef65c9cf6d63228960ae804413f8db36774b93e71094dc2271f180da1467d35e94835da68a8588af69d72850
SSDEEP 12288:qUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:qUatr0zAiX90z/F0jsFB3SQkH
TLSH
T11845230B381F80F3C8C31B355244988B5AB95EB476D36B86F2953F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7820ac896a9f598cf6d59e01863f0d22f79366bfda956fb6824243104af4edb3
MD5 c57dbfa9525e3cf5aa136d19063e4ce5
SHA1 7d9a740d088f760a49a74b5840782a48765468e3
SHA512 fbebf5bed71847406500415ef1862a9e97b6106ee8ffd689174ddc17e4bee33cfe0b77c3a8db7c0dd236abc28c52ac270715960f572ff173192b7d995c79a693
SSDEEP 12288:PVTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:patr0zAiX90z/F0jsFB3SQkm
TLSH
T14045230B351E40F2C89397358694884B96B5BDB4A3F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7dac3a2245ae10c72dff51e0d9e383e9ad174875465631a9e62ae3fb76ec878e
MD5 c8a6bc8b3e96b125ac73c1a8c7f3c8c5
SHA1 14bb4f63169e233d1d2b60fc43afddbb7511d278
SHA512 7e3c17b60cb74fed561f55ea2da0b4e3dd9112eda8074a754ec1659591f811ab7083366911d36bfa0dc1e7dede4f9bafd443288855f2d9c590d2a9088b59a9c2
SSDEEP 12288:H7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8C:H7atr0zAiX90z/F0jsFB3SQkj
TLSH
T1C845230B341F80F3C8831B355644988B1AB95EB476D3AB85F2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b62ea60cce85d22e26cb58ad85c1427a50e197ba235c7e0b9e0b6366a1e38449
MD5 ab6f559e59de888582b6226d60d4e247
SHA1 3f55c44ceb6417e1c4586a560edc855f61734e2d
SHA512 b14f91b355e3b8736d0d6aebf9f8519167cdc98a014e6ea79ec93d46e487afc31c8c2e1347ffe19db239e170b3b481f36f8c8f1e9f26599b6bf6e92cb1696c33
SSDEEP 12288:zmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:zmatr0zAiX90z/F0jsFB3SQkC
TLSH
T18545230B341F80F3C88317355684988B1A795FB476D3AB85F2953F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 58706174a4c404047074552567751a2642b544b568a9aee0acea94b6fd4181b3
MD5 b01d3ddf44c823a4730dbf3b6db62c37
SHA1 ef7e1e38f10adce466d40cf9af9267c15312f9c6
SHA512 90123cdb71888796cf665c93192e98bfd38bee76505384bc2d13ac2cfc46ed8ff92bb7c11d7618ce4ba8a08691475b09e6c23769887427959b29fa8c76db0cda
SSDEEP 12288:qiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:qiatr0zAiX90z/F0jsFB3SQk6
TLSH
T16945230B341F40F3C88317355644984B1AB95FB4B6E3AB85F2953F0FEE382C62565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 650ed70c4c27a5aa3edeca2e702b110275049966d0ed1888f760306d231645d8
MD5 103eaae13b061ef5b2407b64b0b2bcdd
SHA1 6f72b19f569c6bb3913513c7893ae5a259ec0389
SHA512 2f62e8724ff3f1aaa3b9b99b2eac076631ea4308231cb0e8cefb24cde8d8c9193e07b0e23939554cd206e8b6c37d5b533d85e0187c63fea3bf9bbd263b091264
SSDEEP 24576:aZMSzFVSOaatr0zAiX90z/F0jsFB3SQkU:aZMSzfWaB0zj0yjoB2
TLSH
T1F365019A735018F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 66ef528c75da2d8c5bbee4b9c9fefb03b5e67fc67cb258e728eddefdc61398a1
MD5 372004ab9248c2a805bf130a73d31c7f
SHA1 49efb552f2fc530e24125a0ab0fff8b9b71dcd8c
SHA512 9ef1a1e82f1d6b50cc567fe4932de33548657dcea3bf5746ee4a674ce9eeeb096678d31ef27e12afb920c9fb5e0623a26b85e48da6ce05ecd2a63c41652c836d
SSDEEP 12288:qlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:qlatr0zAiX90z/F0jsFB3SQkA
TLSH
T1B545230B341F80F3C8831B355648988B5AB95EB472D3AB85F2953F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b86ff0aca0ac05bbe2cc7227aa55d51cb1da28a0c4f1e8fc26e83cce9a0c7b7e
MD5 b11a3be7b921f9f4359de1aea7952c95
SHA1 375efab7d55525b7ef74f47e30300d9767a5b8ab
SHA512 38285ebcd638cfa95484cf495e6b37e375cd63d8da2d9ea56a117c1030b41de2efc63d723ca8830bbf24de2e490393c0fd34d74d70c49995153d2aa21bc0306d
SSDEEP 12288:JJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:JJatr0zAiX90z/F0jsFB3SQkA
TLSH
T16A45230B341F80F3C88317355684984B1AB95FB476D3AB85F2953F0FAE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 025322d87191d1641c2ecefcbe423548510feb6c59eccc19cd13cbd6546916e8
MD5 a061287257f4be526f0a86f266b73625
SHA1 22d273774d725b093dc9bde4f1bf418d3956d51b
SHA512 20818fb5677a5d77dd55d594643d1e663f365ef2c2bbb7c82809f3a2ca86e781cb797def15efba5d682a93878a722446b7d24b1609a34abcc21f4390b76b786b
SSDEEP 12288:VyPz5L8+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:8zy+atr0zAiX90z/F0jsFB3SQkZ
TLSH
T15F551207326620F9C4639238C9911906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f800d65dcca42a3ddbc1b9df92f5429336bbca53cf6d12acc9ca693acdbee78a
MD5 3265a9f23d5d19494d4d9abde8fc7718
SHA1 e2b98584922125c99435ea8656e15e47b935830c
SHA512 d8a584bc1b458131f74c4b5f19b35c3788145b8227dc838a3d135ed4117923038a027c8445189af5296639795c3c8469032af3a3339bdc1916c4191b4745906d
SSDEEP 12288:GlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:Glatr0zAiX90z/F0jsFB3SQkr
TLSH
T1BA45230B341F80F3C8831B355648988B5AB95EB472D3AB85F2953F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 61cc7967c056007c620ecebf59e2a271e987b04ad35ea5694c734e235df2f5e4
MD5 d32db0d2d35a3aa357dab570d5cb650a
SHA1 43491601efa24e22dac725b73eafcfde0ef2cb45
SHA512 357b081dd8450930faccc4271e203cdb07ec17262e4b7195125feb165cb1fd3d605ce84aa596a60f2715ebd23759423a2c1e22c1e5ee0c8ac4ee265998a25519
SSDEEP 12288:+lUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:+latr0zAiX90z/F0jsFB3SQks
TLSH
T15545230B341F40F3C8831B355648988B5AB95EB472D3AB85F2963F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 14357878280c7a6251fb9ef684ff1140900c4fc0902163ba15d4fad415ebb24b
MD5 54a6dfa8b2bb2f5614cb0060f3e5a5ed
SHA1 34cc031273733de4a89714f42f2f7bf6829d751e
SHA512 8e78887fff6c1f4a9fe202dae1ef8a31006293918240da2f71575f2a7bd3948c83dd93bc83e3f64e06d668ea67bbd03d3793cdfb5d790b9d94ee011acca9ab03
SSDEEP 12288:LyPz5L8+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:mzy+atr0zAiX90z/F0jsFB3SQky
TLSH
T1FA551207326630F9C4639238C9901906F776B83117A19F9F53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 efec48783a98428ec777edccef983c00292653e409f413588aa29d95825d2121
MD5 4461fbe27fefa83971644919fd270ca9
SHA1 91cdda98ae787e584425053c632c7d35afed5267
SHA512 3820b9ce822cc1d00ba8ad5ca1c37464bf22073e5e1983f121b0bf0b890e08ea487829fc3a49084cf5ef802d01873d0fa80536a0934787c60a8afd4479398432
SSDEEP 24576:NTHaLl3z0zDkatr0zAiX90z/F0jsFB3SQke:NT6LljfaB0zj0yjoB2
TLSH
T172650199735018F5DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a3ccfb196814c34e9a676ce08e89cb3c594a887f3035e8d3f1ac4112be3d18fe
MD5 7fc202532bcfb13fe37d3e8575d16a0a
SHA1 7e72e87c5ebfd4d832d569d481158850dddd640f
SHA512 469447af613dec99b6e96e5024b87279d2442f297193920734a39d4d1311b68a55612ac8a284b25bd3145c188900b86fa04f8fcf1c27a0149ed9cc3045e1b4ec
SSDEEP 24576:037d9CHKy7GZwatr0zAiX90z/F0jsFB3SQkA:+7d9CHKyaWaB0zj0yjoB2
TLSH
T10575CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5b3a76730d81fa8219dcd2240af75cf95775b495c4ef2234cc91144c7fa627d3
MD5 96d7cd96f5c575f71cd71357c38e66cf
SHA1 99f17ff4300dda5bec10284fa8f0e2190691c552
SHA512 3bad8096c9a5fa47d62d1c2e4382394e08d73f3b3cf9b56de15e50aefda801ca53900da60418f971e03febb8b867fd4a45d0b9f259ddba76a6f5afb95d50efbf
SSDEEP 12288:E0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:E0atr0zAiX90z/F0jsFB3SQku
TLSH
T1BC45230B341F80F3C8831B355648988B1AB95EB476D3AB85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f6055eee161cc7a4c58fa6b0347cf27297c000384c342210c5bbe75b2603f35f
MD5 832683d8a2f13108383016a422badca7
SHA1 5f358e5808dfacedfb51795ed314a40b7d327846
SHA512 0c991c085c028f4c335db226c9be8b8e41d166e816fe9a62c2bb6682f3305f794e7d5372064ff2d4af16abcbd4a79235e27ee447b624e5337026f43cf1ce59b2
SSDEEP 12288:aeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:aeatr0zAiX90z/F0jsFB3SQk8
TLSH
T1DC45230B381F80F3C88317755698884B1AB95FB472E3AB85F2D53E0F9E3C1C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a626835ae518c2930567f5f092c0b9738746e0477cedc171f42b36fea1ca1c29
MD5 7e7b15e4fbc17bb47b83cb2c33ea83c5
SHA1 8ea07380858801a24439dc434e1994fd17f84554
SHA512 1c7074e0a0cfb838abb3857f3569059a32bc25a84f4d97c5cf49511030420a7ed6a6e5590bed15a56ad874c4e98584eca8cb6ba9d971dae3cea99a0585cb60ed
SSDEEP 12288:zHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:zHatr0zAiX90z/F0jsFB3SQkI
TLSH
T1E645230B341F80F3C8831B355648988B5AB95EB472D3AB86F2963F0FDE3C1C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 07fffb492ac76b3fa9e0bff36c9f512e1fbfc955ed194a31b6eee083e7ced6e0
MD5 6751b992745e6aa92f0562766b0f5681
SHA1 e18de6fd25d8781b056bc996e7a291971fbd1d5d
SHA512 c51272f3aede6231aa2c23dce6e5bbcbdc01a8b2c1998a7c96a9884b0271dccb138204c9479acad15258f8c415026071fbe538947b5e965806b22166f7821162
SSDEEP 12288:SlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:Slatr0zAiX90z/F0jsFB3SQkI
TLSH
T1A045230B341F80F3C8831B355648988B1AB95EB476D3AB85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 503655839bcebbf2b235a81c99654714cf155598a9e9224b353e022ea155281d
MD5 a55c31b0a8ccbbedc71c5b6b190f92d4
SHA1 4f3f0918c8573bc02f3ca148f430a6199019d618
SHA512 95d6aab9137f068cae92ac34897e54dc28ceaedb5c986d74631e24f8b99c3f7660d7273568c1e021ad7e86db9230e14aed2ec18d315dfdbd08d1b41bed1d5a3b
SSDEEP 12288:G0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:G0atr0zAiX90z/F0jsFB3SQkj
TLSH
T1D045230B341F80F3C8831B355648988B1AB95EB476D36B85F2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a5eca9994ebd4876110b83e974f6163f643f2108fba4a0759ae6e288452d7dd6
MD5 962753e9edd21a142f7f334e5b7ca092
SHA1 e7848d2a4bd81ea04aebe56d282975d6ef5f9296
SHA512 0dfa6f7372e30112bb5389fd9eba257fe0362ca6a1223d6b0ac792f8ec07660d0492cf162f80896e647d8bbda206ebf574ea99308d5c3ad76711df06076dd94a
SSDEEP 12288:jtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:jtatr0zAiX90z/F0jsFB3SQkH
TLSH
T11F45230B381F40F2C8831B755688884B5AB95FB472D3AB85F2963F0FDE382C715659DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 98262ab00a4f291d9ffd033dccecfa08ca7aa41c5e81ad721a5468957c4e1ea4
MD5 618403eaaa1f419920aba7beacc08302
SHA1 49e0eb06257a2d2d23f40863d3460f7d3eda2412
SHA512 ebc4ef6450bb98e648a90f0e5ad19118a22983c0b4bb025e98b3d24cca62d3642b492bb9d1d25c5957c46abbe3eb4cda126965908c8f54911764425be305f8e9
SSDEEP 12288:h7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:h7atr0zAiX90z/F0jsFB3SQkT
TLSH
T13745230B381F80F3C8831B355644988B1AB95EB476D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d8a8ebad8764e39e4f447bbaedeaf7cc8c52aa696a4bb2c05e07b14d7a61c9c9
MD5 4dfe190cad5b521ead9c22e94ed7dcb6
SHA1 2f3228b19a29a3793173b9eed6e57408310997a5
SHA512 d081cb5856792c2c016f78c8f8a967004cdf48215c25ff5fab673c3a74e822773c40f7b374e3a729e85dd3e5c094fc112d8992f3437c9559312531e65774d6ba
SSDEEP 24576:Qfwvok9RX6wkyAI5atr0zAiX90z/F0jsFB3SQk4:YMnYI5aB0zj0yjoB2
TLSH
T10C85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9f8cca90990e6dfb7a1f45b4618ca9cbe40900f774b2949ecfd7a9574b78ade5
MD5 9c62e49b98fd153e7be20293e3ffcbd2
SHA1 df6cdce76bfaffabe088227f826d73130a4dbf50
SHA512 dde1acc7dd2a03e791f0e28b70f54545f7f1e46d009e1a26adac3942e178e43330f2d1c9c4c084aba1e6a83c6dc5f309882ba7d660e6d640f5675f80aa1036bb
SSDEEP 49152:pYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04aB0zj0yjoB2:RySzPPB2Yyjl
TLSH
T11E066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 90fa3ee168a98a16bca8a767875bfd66893816424ef4fa01a3ac4733cee57e6f
MD5 dd328b68588cf4c3205a7b4db1110386
SHA1 ccde3aa28454b870202f3b9f2cb6b93ca4a5c0ba
SHA512 c82e940a0c184e7ec23da2ea21b1cee316499b1453887c40f961b8d59705bad0258f4617f0645983254ca3e5fa55b27dc06a9ddbfbdb9a4881ac7e4a082e941d
SSDEEP 24576:647Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYKatr0zAiX90z/F0jsFB3SQkh:647JUQj1irIhCnDHUPfF/oaB0zj0yjos
TLSH
T13C65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF22B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7aff686c69d30da4a661404415f3720771e55327850f993ab8cb3f6494d6b6c8
MD5 b638895c40c3297a2fdaa7e5b81a6d50
SHA1 0f222e93c0b415c99c1d556d1d41cdf350bc1534
SHA512 912214f1bc5531763e5aeb9a00a4c2523dde0fe79cf2fd8e98bad30ad38f051fa4277ffb7da68873a9d0e725509a8e56de2dee6c55b7c19c350b40ebf0299085
SSDEEP 12288:fNsf1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:81atr0zAiX90z/F0jsFB3SQk6
TLSH
T17A55F00AE25801E5C0AE6235C7544A42B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 6e7e4f091f725f22d4f56eeac310ff59b9453f7946050a5945b2e0a348861c22
MD5 5732a933aa122db92ab9b9642f89ab98
SHA1 5167e18f7a394875265b2725f09b6bca8a69614c
SHA512 53fff0636f377e4df9243d6b81c20fe0202d0c70501c696aa54becedb499e5a57ea149a2fb4833da61b15370d7555beba91e843522386f40224a3ec176735f4b
SSDEEP 12288:KsU/+iU3faSeNSvrQ/Ql3oTeacZJP33EF:KsQpUPaxu3I3cZJHE
TLSH
T1B5251750766AC75FC6A940321E32C1CCAB707D41FE05AB0372C8973FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3d999cfa55b84fe6d20514f421fb2ce931cdfc69a4b3a5915bde424fabe76424
MD5 d17dcdf28ededb09713e1e4a7b86050c
SHA1 5830e0e0adfaf6c7538d9820610f1f7dbfbc99aa
SHA512 b2f315469e48d589f462e26da0b084d48f74dfbe48627f553ffa446008207381ab116d766cdb2ef4d1432c8e4cbc99c58fe77a03eb330f78e058248a2425bac2
SSDEEP 6144:nG9DBwOrjATUjBBjyyNFTowU8H26tMxAoMlA26tMxeaSgE5kuy9cUio4PFXG:GwTU9BjyyNFTowZj1cy9cUio4NXG
TLSH
T15B65D8815437A3CFC1FA6032072A9B4CAB64AC0673496F26B3C4457ED82BB2575B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e9d607f61e0fedad0ed8f6cab9cf30f7df516394f9c31fd40ea019ef12823ecb
MD5 59a01eba55acf55ef7f8556c6698f584
SHA1 f7cb27a36f3d80ed74db9efa2be013e703b53b08
SHA512 ed1e45cdb52c6ea8e49087fc96939634319655ca8e44ce62f3e10ed5c99a9b62a9bb70fc66c27304553eeca005bfe946edf6f60fd73019d8a628ef69d2f53d91
SSDEEP 12288:aM79UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:X9atr0zAiX90z/F0jsFB3SQk8
TLSH
T15B452307351E80F2DCA32B3452588806267EBA746BD29AC7F1413F4F9D386C65E75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 54303ea35eb96792f7af921a76466e7f25bcaf84890965415a79b662a45cd5e7
MD5 1732d4902aebee0eacebbb8c0ff892ea
SHA1 1e90abd3939d148a687b20a7cc7ffcbd3b1e9544
SHA512 e56081f483803560e7936db7294fbb5981e02f92e7180e61af22f062a364d1ad53c9669dcdf229056b7a6f7ccaa4e8d4357eeb202d1f56a7db5cb2a4c4383d27
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYfatr0zAiX90z/F0jsFB3SQkF:ngb4mBIBhGFKaB0zj0yjoB2
TLSH
T11665AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b1e97a90548cf8431118940ba1e073432acae3a4f94f72e0e697f8c0c83a6b52
MD5 40eb04c382041147085e6e4e069c686a
SHA1 900bfcc30690b284609def4bc85019dd0e67e584
SHA512 fac15c445b63a5ff1cf70cf52a58383fb07d24ff6c63b75a2002bf6cc44e29efe0a67ae1710432d22353882fe9359d5eeda2898a6262bca2da7aa5c18274acac
SSDEEP 24576:zG88u8FpJqH1bzria7/maatr0zAiX90z/F0jsFB3SQk5:C7ZFPqVea7/naB0zj0yjoB2
TLSH
T1F085016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 09ef400b6b07866e2cced6e0b91dcb3afeadffe6915626864dfeef200fba1f81
MD5 9e1c90711c9ae7d378d287ba0c91ea13
SHA1 99ea1afff0c063a5f3980a4298b7464da34841e9
SHA512 4f906ffaef5cac1f3d6b3243f42db5a1ed9708434cf019663305bda41407bce4337649d5bbe48f41b45e745ba378bf02ef5530d2737931cbe8f14345a1258de8
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmaB0zj0yjoB2:BG05lO43boB2Yyjl
TLSH
T1AED5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 336acb7f2aaafc8b9c49afb2bf7fea9832f432bffd8e04baf7b9a4a3b46f2e0a
MD5 d491942af02b1f1c19b3082ce9a4aba3
SHA1 b5367aabb78ad14b37ca4688d655c3ba08ce1011
SHA512 a9797c116627b48bb3ad7786eff82320e79dfbee5ee0fa96ee53d1f3530f8ffba0c48b27a821e5e075458c874d706431b96a1e3da58208bea898331e4b43f793
SSDEEP 24576:5fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn4atr0zAiX90z/F0jsFB3SQkr:pa5POZ3+Jt2pasx2+meaB0zj0yjoB2
TLSH
T10D65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6f522c30ff856304891cfab863b2c02c09407ce62b87ebe327a999f5a4a3e259
MD5 c793852c3f5831674d8a33f7ede7bbad
SHA1 d5b5a4f41678be136cff308c4772c59683eff785
SHA512 cba4a6897a9e04e53170ca83b708e96ce057dbdfc7c77bc4b9c2650c05658041f3dd5a6f5d31dcf958cd9fec4143e1d3ffcba2565297ca8c9f2669345f4d2e8c
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7Fkyatr0zAiX90z/F0jsFB3SQkF:0Nc/zEOVHFHaB0zj0yjoB2
TLSH
T172858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1b224a6e2c9430d1a6acb79774d72037f1af481342a6e85484b36773d2bc09d8
MD5 5a51d9f7055658c2e53db00ff4e0661f
SHA1 840860319a9da7358f446750018c23040feffc45
SHA512 5f22dc5da9c147eb756840fbdb1bf5c925609167aa3407fb6564aac41c6eb82641f74be318a0d2fb71e77bcaca8e490005462bb6e8c34c32b6bc8317ebe2415c
SSDEEP 24576:K8kNvNnaFeYhJNtmZBmnatr0zAiX90z/F0jsFB3SQka:K8MwBtOmnaB0zj0yjoB2
TLSH
T11055BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0add4f68907ff683aebd507af74721032e40778e1c87aea70910503b5032e67f
MD5 28ba80baa20c9f6f6abf1bdf9993441b
SHA1 c1516fdc3fd646b11101f14e36fad21d68ae3a90
SHA512 758576cb339c49d6f760966fdf4668316c84511ab6379da754bd88840945c3297c1ac1aa5bc91beece0128561353ab6562b5eae630c002f5fb8bf7c01d8ce918
SSDEEP 12288:8HvUrBFrEjwaQWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:8PUr+NQWatr0zAiX90z/F0jsFB3SQky
TLSH
T19165E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d84dcba3b04fbde6a5403d5a8aeeb5ae8b79f7df4f1f673d6d83b37a501e7272
MD5 38134c4f40244744bab479adf4e366f4
SHA1 2b4297086734d98079f8728f45e112f1839e7921
SHA512 bf17bf07920d20bddab1632ac432f6308d59ca61cdf314abc20c187933cbea96cc85853badda40fb8b3cfdccb91a40ce6c77e74b4e0e068f496909c3d243fce8
SSDEEP 24576:ND3FHshBIYQgAxatr0zAiX90z/F0jsFB3SQkw:NDVHeBIAAxaB0zj0yjoB2
TLSH
T15D75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-120-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1028-122-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1028-320-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1028-128-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2204-22-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2204-15-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2204-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2204-21-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2204-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2460-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2460-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2460-157-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2460-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2480-75-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2480-81-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2480-73-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2480-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3672-69-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/3672-6-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/3672-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3672-64-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3672-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3672-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4272-91-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/4272-317-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4272-86-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/4272-85-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4500-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-102-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4500-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4500-338-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-336-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4500-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4664-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4664-50-0x0000000002B60000-0x0000000002BC0000-memory.dmp

Download

memory/4664-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4664-40-0x0000000002B60000-0x0000000002BC0000-memory.dmp

Download

memory/4664-46-0x0000000002B60000-0x0000000002BC0000-memory.dmp

Download

memory/4668-143-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4668-140-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4668-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4668-134-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4668-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4728-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4728-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4728-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4728-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4728-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4808-67-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4808-58-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4808-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4808-288-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5452-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5452-321-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5452-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5452-114-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5452-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download