06f9b33ae4fbd67af7cb47701837ee87dba1babd98aa7faf511fcb0e539793ab

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260813-waarpstygy
SHA256 06f9b33ae4fbd67af7cb47701837ee87dba1babd98aa7faf511fcb0e539793ab
MD5 f5c1d5b7c60b431866037a9dab787d75
SHA1 64b59d11ddc46fad38839ed47b2829510e5c1bc5
SHA512 68f79eb9e4a9b46568167a01fbe99f2e6d7f431e593c888ae507ace17c43bbfbe26b28ec9dcbeacb94adcb2542e1e8d90ecd2d29dac9e9fb61e238d13dd8522d
SSDEEP 49152:OvvSXJ5RffxjaMQy9IMPrlI4iQSFeHktdVckwv2Q9VTWxddjBkvr7XTCbspWSEt:+I9NrktdnZddj0r7DCbspZE
TLSH
T166167C17E7B901E4C4BBD13D8A569657FAB2785A877197CB43A0835A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3248	elevation_service.exe
2444	elevation_service.exe
4124	maintenanceservice.exe
684	OSE.EXE
2688	PerceptionSimulationService.exe
5612	perfhost.exe
3232	ReFsDedupSvc.exe
2304	SensorDataService.exe
1392	ssh-agent.exe
3672	AgentService.exe
4640	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8e0d2bf4238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000130ef314b2bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070c654324b2bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1f7986f4b2bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4684	2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3248	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3672	AgentService.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: 33	4640	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4640	SearchIndexer.exe
Token: SeDebugPrivilege	3248	elevation_service.exe
Token: SeDebugPrivilege	2444	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3108	4640	SearchIndexer.exe	100
PID 4640 wrote to memory of 4464	4640	SearchIndexer.exe	101
PID 4640 wrote to memory of 2680	4640	SearchIndexer.exe	102
PID 4640 wrote to memory of 5556	4640	SearchIndexer.exe	103
PID 4640 wrote to memory of 4308	4640	SearchIndexer.exe	107
PID 4640 wrote to memory of 1152	4640	SearchIndexer.exe	108
PID 4640 wrote to memory of 4340	4640	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5c1d5b7c60b431866037a9dab787d75_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5612

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2304

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1368baf98bbf21b6182be4b720d95f4b52c397e316f887b0ef0d2e28ad7cc493
MD5 76828ea11507400676271ea68dc7e7ba
SHA1 b42afa27de0a863e396f807222bb547072f8c956
SHA512 eba8e8cffd681990ff7a1aba9d4f4302d311b4526381d68c72c611fed848344bd9db24a2f42a29381b794af2b490e55522d2da15c95acb304ac15eb458f4e081
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhBkvr7XTCbspWSEt:03q6HjBw0r7DCbspZE
TLSH
T1B6D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9f6e576a2307ccb9fb090ffdc21d98cf65efd104c627c6b38fb1f4f5f1ce68fe
MD5 8d25cabd6b1ee057e7fed00090681321
SHA1 885cebe2f79f277f081fb1b2f8ccc1da3cc2531a
SHA512 96a9fb833a47703be2830392f6a0c7cc54bf4bc3174518d17080f4022821713cd290cd0a84031c9a1abd7bb064a1b24adad866c91c6d27238373704d7d3b3edc
SSDEEP 24576:MXYfDtczAyVBuLuur7XTlkHVx5KpWSEt:rtcPBkvr7XTCbspWSEt
TLSH
T1226501286BE509F8ED678278C8A28511EA7378954770E3CB03E496791F337C85D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0771dcd4858405ec6edad00afa04b7f2d4395b02fffdf673be1d1996631927f8
MD5 32b869e462e791412e3170f8ff8e9c76
SHA1 601ec0f8773bd00d2a95787d75497d012a624b02
SHA512 354966b8d3d1e2940fa241fea1b6870bb7fbc1333e6e5d3274f669bc3d62c94e6483d29ca82d7e61c6d87e270981e0b157ebd8e176c01c3387a4a84e9e8b0b8f
SSDEEP 24576:i0Le5ji0hmxirMzVBuLuur7XTlkHVx5KpWSEt:iPji0AcWBkvr7XTCbspWSEt
TLSH
T128859E16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6cc861c4180001a3424268905101685512ec42138a6c0b6d693d4aa2d94eef49
MD5 0658b82feeb33f9c10768dc566825435
SHA1 20adbc7acfde524aa010d6ad4903db267d63967f
SHA512 52b949310614d08e36d3d47339413f7f03b3eb183647a1d28aeb69f10790db4f7f15570f1fb7747b2263798abf987e9e900c6f202102ad117617f6d69336dfaf
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyu9VBuLuur7XTlkHVx5KpWSEt:V/ezSC6vUzPvxHjyiBkvr7XTCbspWSEt
TLSH
T1F6756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3a45a344547f10691666bbcec897d2087c24a9aaf753fbf90859684b6494cf89
MD5 036d87c5d08c27e8c7762093144dfbd6
SHA1 0fcb6bf993633e4dcaf2d21aee3a2f981e62bbce
SHA512 9ed0d3f7d0c71281ebc33a644e8182bb509cdfff6aa6e154d729fd38e37bc0fcfbc57b81d5e20b14b814b850b3749f9ae61faa6f3a4c8434ceca3f222cb1cfd4
SSDEEP 24576:nVbqPb88hv/l+6uVBuLuur7XTlkHVx5KpWSEt:nVO88hXl+lBkvr7XTCbspWSEt
TLSH
T1DD55AE66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fa9c3d04a5a22e21d90a6f9c8c9617a1060acf8dc6e7a27336ded64d5569cd49
MD5 b90600e86019d215ae1ae0ceaeedb093
SHA1 1bb5ddc4ceb318b52e27025dfa79c26d8fa5e1f7
SHA512 9317a202d9a7fefd8ba7a0542e78fbd06274cc0efc674805335fda7dd404a6d97937d145e88f231ea276732bd78db40a16e37cea39439dd3a2baea50dcbaad68
SSDEEP 12288:wRvVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzFc:wRvVBuLuur7XTlkHVx5KpWSEtf
TLSH
T1C945239D4FDE83A4CF7346B12132497555AA3CAD0B761183FA62B3EDA4B0AC7DC18784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 618728c6a754172d9a8e62d1e27aa93d4656387057f1613dcbac839c19d3f6b3
MD5 3a807bea6fad38a52343665866d1206a
SHA1 8e2ce58fadb61a7c1fa2283ea8c3fdc26cc956c7
SHA512 aac4ac05260c533eb5c2492a7612a911850d71142428a47edb54f3117a86855407492626d7d091cdc45180420580f68fad2e255cb8417f1aa545aa2abd446588
SSDEEP 12288:oeBNUbTVO86U2VBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:oJIU2VBuLuur7XTlkHVx5KpWSEt
TLSH
T1BA65DF3BEE28FCE1C67A8DB856518600D7B278704F22A3CBE165830EDE235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 205db06608c88484847a8dc97125a2977b5cd1016571b66e412ba00a2f93784a
MD5 17337d56183b8c068cdf32d53e671976
SHA1 184c5c717008fd1d0d9a429e243ce7728e4791c7
SHA512 08c1c6508b50dbc9ff4975fedcec4b3459fa53f3738dcd0310c16c3422348d99614e758d7f090ae60bbdf6e7a485428d3aed12ceaa93ee21cc665b94a0550bec
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:TQvGAdlCEL8c/yRNw5Cv0r7DCbspZE
TLSH
T121267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2c2af8399db5c8c34fc7520fa4e3a1f8ad2d368e4b90073b556b5ae9486dd58a
MD5 0ed9b7780ae51b1df6201d3b23d7a450
SHA1 507b69a87ce4ba61282cd6fcf73f22a58cf72ca4
SHA512 69cc9b77f49fa143ba2c5f73e891f389790a513a25acec7f8a784144273502bea139c0399624251262b6de6f1a1ce2087a2ff3bbc21b9792c329a5d14c9aea12
SSDEEP 12288:MAwSfxL/2Dc34DLLmt0LDQewsAjQVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSD:xdewsAjQVBuLuur7XTlkHVx5KpWSEt
TLSH
T1C675E031FEB5E036C77B0DB21B32C716147D79604B621AC3F3A88A9E59702D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5c301e8efb055a616a98efef67e79589a6cf479e88efc3e14473577c4a6c5921
MD5 e6e1c5e09fcf87e83e80bfadc786579b
SHA1 1dde73fd95d408d934b6d2d302fcda810f11f718
SHA512 b6b867859b1472fb916cecbe4715e3e2653b646780c013234871f66f69edf41c9f6b9592245cdf4ed3559058ad14f81b9cc6bbbe8a9fcc239271c8bbfc0728a4
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpC4:KUEtQevvqc2W1cpV2EI32pC
TLSH
T171474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4c7a6719741acb9a2407d232d54017ed9d6be799317d2007f43522d786754aa6
MD5 caffdbf90ee97512285601d18a484cf4
SHA1 4192521ff3b7b26b9a1767006337bf12eb6f4730
SHA512 5bc06942e6b6b46677cefd03fc3adb47c3564034a01a2934f9ba75b5d8746071fd4b8eec75225d9c34a387b9bb1bde41d3a3c97d1b14d60e288a0974b260b117
SSDEEP 49152:dCbRquA/m2yL5zifFiV+XenmE3/zmBkvr7XTCbspWSEt:aoqHVjnmL0r7DCbspZE
TLSH
T1D7D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bc05c2a49ac634fd091fda63a50ef2ee33735ebe0ff472f9cc7acdff63026528
MD5 6d336e201520ef5ac3c1a324caf11291
SHA1 bffb559c29357e890143d50541d5ac2250fa98f0
SHA512 6245cff3e80040a61ea7c2c914a00d82bd9f3c381e6e4e6978d4feda0a015595ae6a03214bb6665d433448312c1a8e410af1cf81f17d253f04c1000c3ed86124
SSDEEP 24576:vAhGLJIFoiwtA5l7S53xVBuLuur7XTlkHVx5KpWSEt:vAMyFoiq57Bkvr7XTCbspWSEt
TLSH
T16535AE81EBF945D4F5B39A7899768570EA76BCAA5E31C20F2150D21F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5031e9d5dc93ff5eee31958e6c26283b9faffd15b6dbe1bd1a64ba090f3347d8
MD5 7f8003c525af21f967bbf6bc70c7c76c
SHA1 c00143ff2d370532026a6d7d2648328de33dde99
SHA512 045cd3066c0b223d3a7dd8dbdfbb74e16d5c58f2b6119c4761e2060f41dac27dfdcb8ab502074cfbb85c099f06320a27e41b2b24ab72dd168e91eb270971b975
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CdVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:jwuoOW0VBuLuur7XTlkHVx5KpWSEt
TLSH
T1FC65F14967E90CF8EA6782388553C536E7F2B8162A21D70F5760C35B6F33361AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e62b7bd2312f80a853d1ec7a278e6fd59b0dacfd039d0a8ff1bec930e67a3f0e
MD5 d136a6090051c04dfa4537c97e44faf1
SHA1 1b460bc45d02597eb74ccdce0c4a31d4dadf867b
SHA512 9d53be06bfc377d6f8bc68add1a17ffddaafd5435c831cdd54d3a54023486ae90551fae3ce850cbd1db197482fbc2dcaf049421ff4417fb8ee57cfbc5d6cfd55
SSDEEP 12288:4BZ1IyAVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:mZu7VBuLuur7XTlkHVx5KpWSEt
TLSH
T1D355129D2BE961F8DBA3427895B14615D7B238A7173203CF662143A96F73AC39C3C721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ca8972413c89e9916e4cc038605d40f0e0dfff33dfa63e4ecf58cfcdcae8bf0c
MD5 f4869085610b7f3b871f6c819b9385c7
SHA1 adfe439a32cebf183cfe7abbbf52c25e1248784f
SHA512 303f02c5742419ba622ee7f2ac3648aeb49384d9bdc8b4cb70a5fd99c0c5981a1ff7475dc6c79ef9a1b4e62a5173a00dab00198d14001cdf17791c4f264a4b70
SSDEEP 98304:HQRQyi36YOcPQLvw2gAf+PN3k0r7DCbspZE:WQyiKayX+PN/C4
TLSH
T18A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a4157776d4c6e6258c27e32ec4ee68633f9e0edf92b9152586e7541b4df37848
MD5 31c4402fae7189ae84e672d0f72372f0
SHA1 f322a65ac3a0fabe7ced2f17d24e57442ecbf63f
SHA512 48411c842068a59ef41dd7d7bbe784296c1ccab936cec01e403b30ab736d84e335b08a92abbfd954ad15fd355596dd97c329386572560b0847dc508a266e87f5
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3k0r7DCbspZE:LQyiKayX+PN/C4
TLSH
T1EF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 42e4cce1c28ba0177cd7d0861a1ed23bb672529919a8d8bad2600b778a5a5248
MD5 da3bcdb706dde96cc467300c9e18eb2a
SHA1 8237b962c26d30e5fe6380cdfddb1193cf214812
SHA512 e9f4d4c37b37d6ec430822ccaa893816cb266ffdbc4ff3d8dcea57504928a01b7f4e6b988b055d1eeaf253a2ce896c76989ba1bbc1d44996fa81c1c3d8338b55
SSDEEP 49152:i68Qg55nhheWu7PNU3/WBkvr7XTCbspWSEt:gthWRc/W0r7DCbspZE
TLSH
T189B55933B2F600A9C44DE1769F46873196D27C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dd1e1d3dee26539760897f7d190c3e6ca68bb69c96828ce7c35b1930ef1eea9d
MD5 4d140cd63190684e3b74aa02f4e4e75c
SHA1 52a375248c4df1f6f6981c66d2a47e75323d38e5
SHA512 de4abf479d5dccdb0a9d91759825239959647a752ac3ac94742303668c80da90076b05a65cd706a879b27ce829db5ea85dc0e2c95d31d6f69e3c78a157bc1894
SSDEEP 98304:Dy5112gYy5azzVvL69nLKnhZN0r7DCbspZE:eLIHmWhYC4
TLSH
T108168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 66787b572620c88068b6133f6c28d40e1ea7d1bccc84afef153a51dd692c2e77
MD5 fbbca9f8c7aa3165b3c4fa4cab2ec896
SHA1 9429e826eff4a15cf5bc021e7c817d6cfb733f4d
SHA512 9b4d9f7e8175afdf63c71c3de079e56c9b0738db9b1800516f7dc6ef2cb0884961d0f2f60efc27c856f47cfb111b206f9c1b76162451d4d0cb3adec47cfde531
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3Bkvr7XTCbspWSEt:Wu6JmVxd2d30r7DCbspZE
TLSH
T171D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5b51cbf749bea72004b8fa47d1269785631a1503170d5ecce8b183b671f4bc79
MD5 9440d085ff9c0a42419d65ef59cf6ce0
SHA1 8169d637f6cc21a63bcaa4da532a2331df59b305
SHA512 427dbad2abef37639eae9ef96e54fa080f0cd5f7012c196a27781fcb17c7c1bb757edfd9cc711ae84bb142c28dba20c959469eae18c4bb6f7cfe55872ba4b257
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4x4Bkvr7XTCbspWSEt:ZmifPbRL0r7DCbspZE
TLSH
T1C0B5BE13F2D901E8D06EC17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7dfabd8c21e1396f22cf1b183757099132309aa61113ec522d931d5a87ba3d53
MD5 8ffab93a415ef62651b5be5e8b3c8083
SHA1 e83dd979d6cf056fddef41c38ca5dbed29bf9c09
SHA512 afa916ae0399231e95ab1dfda4587f065326d5e6fe0e74861ff639fe16c429b336f027a99d6580958ee24d94732ef4bb7efdb3b72085d8008d226f08b4aca959
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHqRBkvr7XTCbspWSEt:P5dKTi61R0r7DCbspZE
TLSH
T18BC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 26d0febbdfb47198c53d3fae03bcd765f4e02e74a53ebb9e2c381b9b328ccc3c
MD5 e18c86172e9e0030e65db10df3d23877
SHA1 d9cbee89b2dce1111963e5ef4582578e639cade5
SHA512 85eccbf88d188563768a7dfd010d2619fb5e15bd4776d3fa275c605e2ad866a80f9990d29f0de25e156e0c175da48af3583a9e41ee00c5641f58ce7e9d5f29a4
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wsBkvr7XTCbspWSEt:PX2iyph30r7DCbspZE
TLSH
T1A795BE13F2D901E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0482a91e48a3b06bd6860be38fc656cb5dbb6bdc8bcf05882bdf96c799d4e6db
MD5 169003c9439cf50037d8c30e941efe35
SHA1 4c1c686a14a4e9efd57c071bbd5334caf54a003b
SHA512 8761604548f5f6bd12b1e0ef71aa0932fb4957cd01069f6b6b42cb023ec7de9a74a098ac071eaeb34d2ac6a90ff4f848695aacd794195ec5bf9d39bfefade511
SSDEEP 12288:o3VBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:o3VBuLuur7XTlkHVx5KpWSEt
TLSH
T1E445239D4FEF83A4CF2282B0512145A455AE38EF5B371183FB5663A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a2fd106688a716ea5523df10001b4f16b718cd03b91fd77f789869143d2fb575
MD5 0620e988d5952a97d457224cc2181f2a
SHA1 9e62b9ce40d157543ea496e76ae4975f2f84068f
SHA512 2fce1cf9bfc2283086c8301f50cd63864f878f6009f4eb7e71a5ffba9fff5c6b912b3fe7dbe05a637f9e388e3989c942c7316ef42e9a71142b6b1ea605b92de3
SSDEEP 12288:gMVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:gMVBuLuur7XTlkHVx5KpWSEt
TLSH
T19345239D4FEF83A4CF2281B0512145A445AE3CEF5B371187FB5693A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 54c166632178a6f74c84b504e673123dfd4df6adfed663a00fea6a870b44481e
MD5 3844c90f3ee454729fe20ff617e453d0
SHA1 578db833f950ae8535be457ea0d4042c72dfa10c
SHA512 08a03c3b13d7e6161dc01f499c288eecfba914c0f50de84072b75f6d7d2648093b0b70280f62ad01c695df36aba0b38322251d01fc77e599361d9d4274f234a2
SSDEEP 12288:o+VBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:o+VBuLuur7XTlkHVx5KpWSEt
TLSH
T16345239C4FEF83A4CF2281B0512245B455AE38EF5B371187FB5663A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 de3d7a1778b0c6a383d6eb5eafbce751c1aedb6de471b59c9a4d4d48f26f3325
MD5 22b7f7cc21eddbb26a12cdf5115f4a99
SHA1 0ff41f0fe8c2603befbc670efef29d5bf2c305b5
SHA512 1520b5e359729ae52271fe7be6ccac20c689e7eae2e1614e6f3c5b40be678f30612149eba2518afc2ef484ba30689530d21a2ebfefa495a9b3efab34545503f4
SSDEEP 12288:9VRVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:5VBuLuur7XTlkHVx5KpWSEt
TLSH
T1BB4523591FEF42E4CF62C2B091324565D6FA3CEA5B3312CBFB1152A959B07C69C38B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0d63ec1e9e2c799c9ed75143178fa1711d66816e16fdd5f40852b2dc8beb8e98
MD5 907693030a7db97e6c8bd1aa51ea97f6
SHA1 fdac1fca67acca45df307dfb0e1ef07c157f7701
SHA512 c67f7b419c8b8d48e82823a45126cb6b6cff109975db5eeb4c123a45483a1c8f2eb55cca1a13396c8856fb2b40fb82aa408948d2a0c1906ae909222055a3b356
SSDEEP 12288:xpVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:xpVBuLuur7XTlkHVx5KpWSEt
TLSH
T1C645239D4FEF83A4CF2281B0512245B455AE38EF1B371187FB5663A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fed951521c45178bd61837decdfbb7251b1379cafe5b27b4bdb18ca22314e17d
MD5 8ee2b5f93229ac6aba4c52ca5cf70911
SHA1 b347e9b38c21592b2218f2bab21cb31aa06e3323
SHA512 df3c10de42145d41b2fb8b2be4d8533def6708f7331bd020298fb35c164f405e40be516ec0e7270089c46215792dd8e0bdf6bed29d328e95a176decbf4a3c930
SSDEEP 12288:B4VBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:B4VBuLuur7XTlkHVx5KpWSEt
TLSH
T1ED45239D4FEF83A4CF2281B0512145A445AE3CEF5B371187FB56A3A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d4af02a0004fb31cbb58f4ef1f367da4c3117959e50fe95dc87db910bdb32a56
MD5 dc57e20fd5274735aae6dc60dd11100b
SHA1 8b3bc67c73fcf6b57ede5a1c2ec2e142553ee38b
SHA512 791dcdeda2cc10e712bd792d29973aaf2c28ebe16d1f5a93f7f2355b01b3eef85bec39a3f8152341e1305feb542a66dec3d5b3782989940beb564f1e68ad744e
SSDEEP 12288:XEVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:XEVBuLuur7XTlkHVx5KpWSEt
TLSH
T1DD45239D4FEF83A4CF2281B0522145B445AE38EF5B371187FB5693A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 cde79b73dcebefebfb644239101f58252945bdd464a57595561b8542ad3126a7
MD5 b72a3e3329806083f18346690db80d56
SHA1 c2d337e85d191a9a6b7dabffa9aa1ff3939ce4e9
SHA512 7e0c2809ffb75d804cabc39456ceae71c45ec2a604752f6ae166435b79e7042f394cd997f793976747e68ffcaed7e415649c961f938cde566440b71948f0542d
SSDEEP 24576:UZMSzFVSOsVBuLuur7XTlkHVx5KpWSEt:UZMSzfOBkvr7XTCbspWSEt
TLSH
T12A650199B79008F8DD63823EC9218916D6B27C6A0B70C64F53A4326B5F733E15C3DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e95a66f8e934106fc9f3e8253759a6a1760a24c127c353b602481512e8d0e804
MD5 32717a9f0af7b700016105624bfce418
SHA1 a76fe2f278e262014a653ac76e2e0e75154bdb20
SHA512 d0038f8d59969ff4d1e0b9e6e6589f78d5c54078f5370fead0701b6f8886d3f823e98ef4f30d941fdbaf3ec8c7c4103cb2676daa8d300fedf2e144c0e4264e38
SSDEEP 12288:1rVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:1rVBuLuur7XTlkHVx5KpWSEt
TLSH
T19445239D4FEF83A4CF2241B0512145B445AE38EF6B371187FB5A93A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c2193d7d705eef9c0aa6334118ab31d01f935562f00d6cb3fb07360511a68f91
MD5 a1929e4ee5c7137c62b7614fb321fc33
SHA1 0b93abfdfb34c4a6ac43d0b1a14d196ce5178fbe
SHA512 939c523115b044a669a6bd573a47f021acc39c717efa4b44bdf67c888d6bb02751fbf42f443751669e2c9ab3257ce6bf6b094dc80f545fa82a95fbb87dee1c1d
SSDEEP 12288:hfVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:hfVBuLuur7XTlkHVx5KpWSEt
TLSH
T16145239D4FEF83A4CF2281B0512145B445AE39EF6B371183FB5693A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1a54e1cc0d06ce1e8b2a654ed3f3bd3632ed0dfb250bd79e61535a9d4e3843d6
MD5 3196fca3336ed14b379c8f59988fe643
SHA1 4fb83b31aa063b4dd380366d614697df71971e94
SHA512 b5745594ba1600d476430cd4e9d8a9a5665addcf79cdf7334e1a94ab52e9104471b0dae064b0d1367e02b0bc50befc28bfd958ccf83fe10173af645398d7b1fb
SSDEEP 12288:dyPz5L8AVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:UzyAVBuLuur7XTlkHVx5KpWSEt
TLSH
T1B355124B7BE621F8D633823484620A11F7B678760B31469F676443BA2E737D19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1cecc91bb57a88f3d5983a3ece2eecd6bc960f53a27f725a7f9119f5c6547b16
MD5 77d24bf314ee68865ab05c63f6105f41
SHA1 d11a9e0ed3f54f1bb803684a2391b76dac3082cb
SHA512 727ef19a93f4276d720a2d6f42b30d7ef33fdf3a7295b76eecd409a4a94d251eabe572b9eeb9390c5e8caa09a60f3e31691f5dfd1eabd6e937079063f0006c23
SSDEEP 12288:UrVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:UrVBuLuur7XTlkHVx5KpWSEt
TLSH
T1B045239D4FEF83A4CF2241B0512145B485AE38EF6B371187FB5693A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5ca5cb75116c19fe7b1ddcd62c233c0dda3fba664e4e72f0acbf6bb6401bcfb8
MD5 7c8d1cb281cb652e77dbfa22be3e139a
SHA1 15f080ee2391c4df584434b1cb9108fe0b4a9597
SHA512 b048e4b7701fb87ed628faf8375b022db0517dbe075da8decfe07eefa40e14bd1a7015319d45cf4731b94ce4c1e80467b6c7b63d2d715461c9bd8b64d56f586b
SSDEEP 12288:brVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:brVBuLuur7XTlkHVx5KpWSEt
TLSH
T1C245239D4FEF83A4CF2241B0512145B485AE38EF6B371187FB5693A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 52c269f7a51c686a1ff9398c2dfb84220a6dd41147e818ec4034b53dae3f93cb
MD5 3f8ccb59dabde27541c9f599ccfe8b04
SHA1 76e0404bb21940b2fbe2fb5a203bdd226b5fb503
SHA512 54e57841d3126806a1b3b8876827f4403ff1e0ef7eead6d3c7a81171ceec000db9c7a86273950b3052b372b0fb34b0304969edf3fddefc26435ad1c83aef4ea5
SSDEEP 12288:7yPz5L8AVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:2zyAVBuLuur7XTlkHVx5KpWSEt
TLSH
T10955124B7BE621F8D633823484620A11F7B678760B31469F676443BA2E737D19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f60b9be6d7a101eafa49c734fc4e826feca1a37c2a8ad64f045051377d824677
MD5 77d8ed4d00673a20ef24607d87808367
SHA1 54eb2ebab96c8983b3efe402777df7abf5d4fcfa
SHA512 86ed1d86c06dc15f9badf4e59eb4d4d8ab541515eb0729eabf212a986176ceb5e9745acf6e6f13ebc13f4b4c365f5df1c06207b184ed6f2553fa1412c97b3efd
SSDEEP 24576:gTHaLl3z0zDOVBuLuur7XTlkHVx5KpWSEt:gT6Llj/Bkvr7XTCbspWSEt
TLSH
T1BC6501A8B79008F8DD67813EC9218916D6B27C6A0B70C64F53A4336B5F733A15C3DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9dfa27f5fd570dacbeed86a257d67144cfb93143cb2e9eddf742b647b7414984
MD5 772effe903b85d9a8eb75c6afe97ee31
SHA1 47e9a00833e8df193c440c405d346f3871346e29
SHA512 782b29a19eb342c524d562cc7e19b5cf94ba251006813001af5e2465a674d9ee7bcbfb034d765ed8d08a4771d66ea17da5944384d205695173dfa151e93e3e14
SSDEEP 24576:D37d9CHKy7GZ6VBuLuur7XTlkHVx5KpWSEt:j7d9CHKyaOBkvr7XTCbspWSEt
TLSH
T17975C090F7E411E8F1B7CA3589724511DAB67C9A1B31DA8F13A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6a6ad542c401df56b2ac7ab8b31cbda93d56c305650e6e3cbf128c46f3fdb3ca
MD5 bf1396c2b60394f0ce969ba2168f6ced
SHA1 4a19ef7c1a2efedd59a93b651a980316986f2a79
SHA512 67b0708c4e8ccdc3f0ee264eb1e2cbd9ae05b790e574a91f95481a94fce52c70a59ecb822638b28134056904e7880026a4a13faa84cd22bbfdafbc02774dc5b1
SSDEEP 12288:8eVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:8eVBuLuur7XTlkHVx5KpWSEt
TLSH
T13045239D4FEF83A4CF2281B0512245B445AE38EF5B371187FB5663A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7a6780d93b3570039994ca22ec95307d9fbfaf01d3a2923b3084284452d0ecb6
MD5 9045e4cfb92bd6478933205bd8ec6f55
SHA1 b8c22c164791440edfad1d37b1c63e0398addf70
SHA512 881390090d62342934890239e65dbeafcb49232669f7b3af47a4ad175b4815093da337cdaa21e3129ee540da85517c78a8b35c34292a4380d60c1a8960f0db40
SSDEEP 12288:egVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:egVBuLuur7XTlkHVx5KpWSEt
TLSH
T1A745239C4FEF83F4CF2281B16122496455AE3CAF5B371183FB5653A9A5B0AC79C187C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9967ef681256025b8d75f75f16c1bf8afc722df74d0c7f72c92f8c69e7ef19db
MD5 3481ecdebbd6913d1b57eb29bdc12014
SHA1 d9e1f252a3de5da2614a5591d31b0da19afec140
SHA512 ce3a49d49102832b3c5192062be9cdcb3747a4ee3be8f5441824c0cff340beb22d95038ad7937a43b4fc871350167b5352e204dcb38379242e3497892d15d00a
SSDEEP 12288:FVVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:FVVBuLuur7XTlkHVx5KpWSEt
TLSH
T1F345239D4FEF83A4CF2281B0512145B445AE38EF6B371187FB5653A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3318fe2a92dbb7e2006d123cdbc16f1d917a80ecfed0a5dd6681116f0bdad0db
MD5 bf3c10ad6ead511d5a50e6fcb39d6f94
SHA1 f223451d6769c454c1c8773eb298e14187c399f4
SHA512 0f8d619349225ce5d73269f49c6e6c1be17b287ce6415709d190ed0665ea3e5c8f8dcf3494e6e18975f2f29a83325c208aed8ed795b83991fe6051e8a49903ea
SSDEEP 12288:BrVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:BrVBuLuur7XTlkHVx5KpWSEt
TLSH
T18145239D4FEF83A4CF2241B0512149B445AE38EF6B371183FB5693A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 08e43e16c2a22f077d450dbfc0e5c658db0a054e92456c3cb57b2958b44406aa
MD5 34e2e37e78d47bc43fdce198a376fa17
SHA1 0b317f246fe084852d253b68a9beaa9e790d1992
SHA512 a8408b61901524eaab3eca62a7d871ee1d7601c6eec4d1df79122a24a971260cc56077fdef77c6a4bf20d907744275e9823760cafc02e5b0f7e6880937ade490
SSDEEP 12288:beVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:beVBuLuur7XTlkHVx5KpWSEt
TLSH
T15F45239D4FEF83A4CF2281B0512145B445AE38EF6B371187FB5663A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d972a2cb7fcf2af39ffc6c9f272933c0ff0a9aa920f2f055581c8e7ea30e05c7
MD5 ce5c0df3f7cc8a9f166f38153ab4215d
SHA1 6272196e86b01c6aa7270fb41990361b26795be4
SHA512 2498f60b0db060703759dc7dd36b09292ff98fa677582f87d14c922e11a59ffcb0ab1c62459240d3a4def437ab968120d6884d9f430e42a43f53ab022a9d26dd
SSDEEP 12288:pDVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:pDVBuLuur7XTlkHVx5KpWSEt
TLSH
T14145239D4FEF83A4CF2281B15121497445AE3CEF6B371183FB5693A9A5B0AC79C187C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c502230e1e0b8d038c29a575a9a16b9101bb8ea387d06a2d0ef6ef0c2c4faf62
MD5 c147113dce5ac182e1f6c2cab795e97a
SHA1 04979eb56a33e3d809d0b34cfacb3570f929f3af
SHA512 ae1bc6d8c07efc383881979f0f60e6530bb22855739edfb40e30ddb8914b0823fa490294cee51cab95fe94b52f71ab8775cc9c3f99d3069769222f69f17ba5b0
SSDEEP 12288:UpVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:UpVBuLuur7XTlkHVx5KpWSEt
TLSH
T1A945239D4FEF83A4CF2281B0512245B455AE38EF1B371187FB5663A9A5B0AC79C1C7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6459dbaa4a0030fb3e21505fdc3013ea95cc60a31f3f50d9b324399636b56226
MD5 0ec86f8e5ddc38ed2dc73880633c95ad
SHA1 38b027143a557d945246f156df239b4fe6b49673
SHA512 4cbdc042f26680085d23cd5ee5d8b7fc90b003b46d3b13a557e7d5bc824e2c02eca1a102e37cb1d5fa30966d37baada8be7774d2e7abd45b34a4a5607d1e7412
SSDEEP 24576:Afwvok9RX6wkyAIPVBuLuur7XTlkHVx5KpWSEt:IMnYItBkvr7XTCbspWSEt
TLSH
T17585CF29EBDC44E5E177923C99B3460AF6B178691B31C2CF129A53AD0E33ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5bad6d1a4df41d95a5a0a426683c807d7ea181355843a5d545843edcd22ec172
MD5 4bf4d7f0f8b8226a8b5b6ddccd728410
SHA1 f001405fb41005e381d16035bb613206cad3c636
SHA512 180df687dac0510fb0aa0f1346ac61af3c3a644496f3b763a18d39e889d71d4ec372b336ed242e6c12386df925ddb510166a359a3bc9a242717b8867ee7f8652
SSDEEP 49152:hYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MBkvr7XTCbspO:JySzPE0r7DCbspZE
TLSH
T183067D96A1A801D5C1B9C1B98B17CC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 083c85b25e92e96bccb35fdeb3f21e2b6320431486dea418c41e2dc12338440c
MD5 dede17a955a1ecdb8d1728c49ed54c19
SHA1 b8bea9e329b046f65825a6f9111869703072847e
SHA512 55f30f725e05e667dd04405930f9c6c195311d895eeb8ab2b6aba7d003a1f066bdf58591ab9d643803afad6540d56754570c4b6910ba6159b4f21a674086e27f
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcVBuLuur7XTlkHVx5KpWSEt:V47JUQj1irIhCnDHUPfF/8Bkvr7XTCb1
TLSH
T13165AE1DA3EC01E5E1BA827885154A5AEA71742E1F32C6CF2270837D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cbd60b38254ac5a3f4eeea86e114049b43b1c45c9c22771848648cb18afc70dc
MD5 9cc42d59ad6867fa18b1836c08fddbb7
SHA1 f2146ef832668134f4a7c2fa08eb6a981ad7804c
SHA512 2f4b660e3e7fea59600b5dd8149aa38792a0ba3a307cef9e7bf417a6c5eccf8f6424c8a9e1dd6136fb7c1e3eaa2e299a2d7e4d60016aca553feac6f74c63c3bf
SSDEEP 12288:+Nsf7VBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:n7VBuLuur7XTlkHVx5KpWSEt
TLSH
T15155F059C69802E8C56E5275C7124A40B3773C6A87F293CBA6D0F27E1F726C19CE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c51571ea76892eb05490df8f507dcf679551ea9d0fe9e35c42619524b6f3ffdf
MD5 28cc829cea6b3d0c3bddad720f9e38da
SHA1 14b95abada582348841922714eb87bdbd29ed36b
SHA512 fe07128576c5a99ada752a3fc97456c90420bfc2dfccd66ed4a3c3cd61b0730e41bceee840f110ec0e8e5b1862f36859ec5dc2fdb4a27b100a68381b0bf5ad79
SSDEEP 12288:AjioNy5IAnaHbUriC1ofpJYef0GOSCoYt1:AnNQufpKesGXX
TLSH
T17A452910B62BD75FC6A940325E37D1CCAB707D05EE495B0372C8872FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 938108d2b33de5fedf894107582322d47124a6c27cb8841d3b7c68e0d31b6b5c
MD5 727f118417f9858ae2404cf17b2f3c7f
SHA1 f31a95a7e2ff4debf6bf0a5bdf54f73650dea489
SHA512 3efdc4289987f5b51ac77d3932f3eb82ae91e443e975bf7a3a4c17112746815d5ae025bb81a570657ccce4f59b7a73f150ee488e2c5367dda0390b6798272ca4
SSDEEP 6144:6rfEX6oQycp7ylN1VIBxEIE4L2LhXMKmT1cr9+F8gKDexHucpskxRGHHucirI3tM:6ro12c4Za9+izRrKrCmDc6
TLSH
T1DA55D8816137E38FD1F76032072A9B4DAB64EC06B7096E2673C8453AD86A755B0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 edcbafddb08e6c4519c824a198e77a3f4d5c09c58163dff286daa138745c73a3
MD5 c2021c19280adf339456047017a408d7
SHA1 31a4597ba38ab5549154f69f0e0be33aadf5155e
SHA512 5f9885fd5eabc2b9797a68d827ee403b75d3b5138101cf33f2ae1c64565f05d294535024aff5a7d5933822c207b06972e23e3c8a390b412f0a3a269e87cd6e9b
SSDEEP 12288:hz7TVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:5TVBuLuur7XTlkHVx5KpWSEt
TLSH
T17F4523598FEF87A4DF7246B011228534556E39BE1F3650C3FA1663E9A4B0AC7DC38788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 418496607fd5dc2b1f2feddecdd69006fb6ab6565818a1d5b9c3aa929d862b8f
MD5 f06aa6a8e12441d89aeb6946a1275b9a
SHA1 786781ba3675f4e17a71967a0fdb4982f77c1419
SHA512 44712bbacfd42c88cd81330d98e00d31b3ba7440512a98ea8f6b80f4db504a1ca306fb8b513de420b7e5387328871bb756be9f7c2cf1de2be224f0875e1a92a1
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bY9VBuLuur7XTlkHVx5KpWSEt:zgb4mBIBhGF6Bkvr7XTCbspWSEt
TLSH
T16165AE1E22EC02F5E1F6D2B89DA64417D6B278160732D2CF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9f60f72f2d137d0bb37d0428abf07fbbddea1631e808b2287cfceb7b479eb524
MD5 8eb4c508d21725dd0d761e7dbf6237bd
SHA1 988c251ae9cb42250630a334bbf3e08ede2f24c8
SHA512 3707867d676f6326b683482bfa9781df7c74016fde7f6045135ac0a30e2a517fc0d4f167054a2685b379e19505be62f2448d0c2c57cd38a0b7f5f19194f75f42
SSDEEP 24576:GG88u8FpJqH1bzria7/msVBuLuur7XTlkHVx5KpWSEt:N7ZFPqVea7/HBkvr7XTCbspWSEt
TLSH
T1CA85F1656BE502F0D477D1388A424663F6B2B8250374EBDF47A88B951F33AD54B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ca6abe9952d57d47535ec2d6ebc215b97d96abe3f8a18ed66a776e2d95901704
MD5 bb9925379dca51f8184b6f186bc51958
SHA1 462f3c985ebfeb76e217130979b5f5ed007bd291
SHA512 d7b781196d3731912ae0209fa11319b208bf171baa2f187d35760062fc3895b50e4ad3b631958d4e56e8d5485e17320a64b7d64a39f04321e37f46442d51cf08
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeBkvr7XTCbspWSEt:wG05lO43bV0r7DCbspZE
TLSH
T19FD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23415033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 34f970bc1429d5eed09302a4f338fda5e9a7df0ca2d3755975ce0d24f88b76b5
MD5 73b76f5eba355370e0e1d4f375e12bf5
SHA1 999c39e07b7dd34257f5d1a95ee4a88708f1898a
SHA512 39882aebe4810e2c5b6e6e9e25d33ea84f74e37bddf550ecac30d7377d2522c3a599fb9b4f09af243f99b20c6d060f7543886e9824f6dde66f6415d60e220f0f
SSDEEP 24576:/fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnSVBuLuur7XTlkHVx5KpWSEt:Ha5POZ3+Jt2pasx2+mWBkvr7XTCbspWt
TLSH
T1DD65BF5EA7FC01D4D5B9D17DC583861AE5B1342613329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c155593945837d741a728cd93ee3176491af77867c39a6aaaa582392d3b35d55
MD5 818de3ae4fa6e4b2920ebabd7df3d72a
SHA1 7c6e1962e7996f156b2ddead9b9ff79a612ba17b
SHA512 65fc1e7e01a45971ce4aca26b75c9ce0578da3efbf1afa58c52bb0d0e54817cd5acc72d3024ae3b731d3acbc96488d610e4c1fcdcd43b200f3d6fc4cd9f76e16
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkUVBuLuur7XTlkHVx5KpWSEt:6Nc/zEOVHFnBkvr7XTCbspWSEt
TLSH
T138858B1623E901E4E5BBE1BE89779546FAB17869173086CF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2e4760932dda4b9724ec7b0062c2f19534a00b116d043246404fe74be5aab08d
MD5 bfedb01c8f808c731bfa2574c0b40b6f
SHA1 9974882954bfbbb341675764625502735c6d4e51
SHA512 2cac4ccfc09176dd4da2cdc4888b85376c63ee51e4ea6bc1975c53bd95212ac31dd30f149e7d779d3dc9258572bd32ab6578a93216c72cdf8c2d2ea2f1cade1d
SSDEEP 24576:88kNvNnaFeYhJNtmZBmRVBuLuur7XTlkHVx5KpWSEt:88MwBtOmLBkvr7XTCbspWSEt
TLSH
T11F55AF6EABF846E4D1FAC6B48D238512E6727461073293CB9390C13F1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f0adc77b4170c1a06ce6f92e054401acf604dba9a5a4bd406915e071bcdd0df8
MD5 0bed053f5a7b3ed8ced59a828bed90d3
SHA1 4ce3029ee8c3c3beb3bc8939c9af5d5a89195146
SHA512 d099db88c8961cadc6f65620a438cadde886bb0a8e2b00e616919d5b21e19da827d5655638433b2bf83233e944100a0fd5fc7218f857521f393531391adc7ef6
SSDEEP 12288:4HvUrBFrEjwaQoVBnpULlOxxo37QSCqTWyjzUQMVvJ5KpZjoSEthwzF:4PUr+NQoVBuLuur7XTlkHVx5KpWSEt
TLSH
T16165E12F26ED18E4EA76E17D85428719E7727866071292CF02E1817E5E73ED8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e5087452a7a51a2d0f48a4b46dee78e6b93d1246a3a244cdad39f2c0aba4043a
MD5 ef3b91d284e1890a03a95558dd3b07e9
SHA1 3cd3e5bf1a49c1d71d68589fe2068db5ead6aa46
SHA512 1d615b3126b0db737b67b5f5443596b906fcc2ff8278c916fb35bd34205b5cf019a22a91ceb0c6a4d69742169ab02181499373547bcaed60c79eb3718b7f3c09
SSDEEP 24576:YD3FHshBIYQgAXVBuLuur7XTlkHVx5KpWSEt:YDVHeBIAAFBkvr7XTCbspWSEt
TLSH
T1CB75E17DEB9D00E4D57BC1BC96638A06E77138AD033266CB129481BA1F67EE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-71-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/684-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/684-210-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/684-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1392-124-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1392-326-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1392-130-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1392-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2304-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2304-117-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2304-323-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2304-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2304-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2304-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2444-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2444-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2444-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2444-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2444-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2688-280-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2688-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2688-83-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3232-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3232-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3232-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3232-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3232-342-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3232-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3248-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3248-15-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3248-25-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3248-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3672-144-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3672-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3672-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3672-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3672-142-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4124-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4124-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4124-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4124-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4124-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4640-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4640-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4640-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4640-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4640-327-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/4684-174-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/4684-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4684-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4684-0-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/4684-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4684-31-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5612-88-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/5612-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5612-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5612-93-0x00000000008E0000-0x0000000000947000-memory.dmp

Download