816aaa5eb7753ae195eaf6e93be9f7370aee299aaaa02b5292e64c4529f80612

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260816-nbpcgswxfx
SHA256 816aaa5eb7753ae195eaf6e93be9f7370aee299aaaa02b5292e64c4529f80612
MD5 3d6c0c9ab41d5fe8e9ed3b8e4304bd28
SHA1 a77955ad8cf1c42190af2c27862844b0f94802e7
SHA512 c3fc5e5043ffce7beb35c1830679ce8ac06b8d75b969fc681497a2b8c17f34636f14396b168f53aff50a0fb4711e06416338bf08a2528d2141987a87a9d9f980
SSDEEP 49152:34VlZuN4fQE+27ItYZuOfVZAx8hrywGVW/NcCn0W7p4jU9dsTd3HB+kn3Hnx:3DXPi1fq+k
TLSH
T1BF267B1BE6B940F5C0B6E1798A579617FAB27819873297DB4790470A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6132	elevation_service.exe
5964	elevation_service.exe
548	maintenanceservice.exe
3256	OSE.EXE
5028	PerceptionSimulationService.exe
1256	perfhost.exe
4792	ReFsDedupSvc.exe
2424	SensorDataService.exe
2512	ssh-agent.exe
3140	AgentService.exe
3392	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a402fd48e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e79a094702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d52d5b53702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000144e9953702ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8abfd53702ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f61c553702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029766853702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085cd4854702ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074194d94702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb225653702ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf58f752702ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6132	elevation_service.exe
6132	elevation_service.exe
6132	elevation_service.exe
6132	elevation_service.exe
6132	elevation_service.exe
6132	elevation_service.exe
6132	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1852	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	6132	elevation_service.exe
Token: SeBackupPrivilege	4792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3140	AgentService.exe
Token: 33	3392	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3392	SearchIndexer.exe
Token: SeDebugPrivilege	6132	elevation_service.exe
Token: SeDebugPrivilege	5964	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3688	1852	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 3392 wrote to memory of 5424	3392	SearchIndexer.exe	102
PID 3392 wrote to memory of 6044	3392	SearchIndexer.exe	103
PID 3392 wrote to memory of 3124	3392	SearchIndexer.exe	104
PID 3392 wrote to memory of 3356	3392	SearchIndexer.exe	105
PID 3392 wrote to memory of 3384	3392	SearchIndexer.exe	107
PID 3392 wrote to memory of 2436	3392	SearchIndexer.exe	108
PID 3392 wrote to memory of 4480	3392	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_3d6c0c9ab41d5fe8e9ed3b8e4304bd28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1852
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1852" "1460" "1304" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:3688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5028

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2424

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 25934295d244b28af71d7114577ed8f29924bc4b7f093396daae1d2ecc86fccb
MD5 2bdf9471a8efc5d81e46a192e11628d4
SHA1 205f33e7d6a6cf734a2b06e081a3579ee95a76d3
SHA512 2e76f60f5afde7b846ee724c59b6a279a6039c7723351bbe7da02d9907cbf068bcacd47a915a03a47804346b452fe8c930dc2076da744cc7f95703b7f98e33cd
SSDEEP 49152:xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyB+kn3Hnx:33q6sjBd+k
TLSH
T183D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 55f6f11e7d5ba0c23628c9a7cbf225062d0376edf48b88c12b3d371d34e54c68
MD5 603f160506cb1ff213e65df541737115
SHA1 29d4f843f04ae11c0b3934e8cd1bcc25b4ce1309
SHA512 387ce533a1d902f2fc8510eee63d196d3d2da009dfa8ee52d9afd2678bd9fedcb6bfe4d69f5ba49b185e9710477f9c11d30546ba0a246af07c382984ce0ea9c7
SSDEEP 12288:F1XLsswWkxy2lRq2czAaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:LXYfDtczAxNyBo4kx929bL3Hnx
TLSH
T1F265012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 13e44c88089c6e7065e4c64a0d611e47d26a1673d5a0be377419531e5a3c3a05
MD5 13c260097a243b1e40c6650848327925
SHA1 247b8d7492d82f0d9ad957d577326ef76a92ffe6
SHA512 e354a1d4c305697cbc0acc70cd625c4263dbdd8866c719a1e2e8d4d334e6850a8a6ebf0bbfabd9837795d63134ad52b8fcb4336cd575cf7d838c7599f2dbfbbe
SSDEEP 12288:DXZNYVLeyUji0h90ZD0wxpGZIVuArHsfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:10Le5ji0hmxfrMkNyBo4kx929bL3Hnx
TLSH
T179859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a0dc6f87886ef879381f116ca80f51981a0c1f1839f9b715300d7f6d62820ee4
MD5 46f2545ff584114a0d560d4dcc58bd75
SHA1 609e46b6400a5e31d24eaaea2b444d360f1b5c62
SHA512 327cbcfcbac381e7daf55fa0a21e5849f3cd6ecf3c8074446627e3027d99d07e8807c681acf2d45f005e5bebf018138804d95a6b2c26b57f1e2a2e7f9deacc60
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyuyNyBo4kx929bL3Hnx://ezSC6vUzPveHjywB+kn3Hnx
TLSH
T14B755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2527cf4e989a535479d998c8ffab44cb1a6c0a9b9acfdebc9f8cb7c5f78eaa07
MD5 f17e3f7b020c1b174bcb64c40aa37dfc
SHA1 d79a3186f7eced3dd955273bcd4cd3311475e92f
SHA512 83b6128683615a2b85f4254f49830fbc3b389bff798dea08516dc5afbe8c28f8c52c513043bb1e86d4ca55bc64daee4dcfdc8db328889d6166e8b744aa8f5a1e
SSDEEP 12288:gVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98GLDAptNyvUgXZ32dT4ePc7N29CD:gVbqPb88hv/l+YFNyBo4kx929bL3Hnx
TLSH
T1DC559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a65414c9b583b1c071ab6b53c2132bbb9f39a80762144a94cadde47347730d5d
MD5 1f0df58cbeabec2f19d152cd0fdb0300
SHA1 b07350688d39f4cc2ba17f6eddb528fa146a7d3b
SHA512 9cb5a5094bca57f61eb6865d4ee4e423e4e4940336223937dbe32f72626805ee8496cb22449ffdfaec0d53de840f8441c2def06248d86551f976446a13438f1a
SSDEEP 12288:SmLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SmINyBo4kx929bL3Hnx
TLSH
T1B94523134B0C627AFBBD3F70755E8454CC35BC890D95DB94DE62ACBB58BC9A2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e0b439f44e385fcad95de29b1810ac505f3fb08f03fc8706b2e4e6179dafd48f
MD5 fa17a390f0dca8a5afa864c70f053ac8
SHA1 c79ab96fc5393777c6bebec7b93f8a2064768310
SHA512 9348e9b9f1699ac5060bde139323d5bd35d2c57381b527b83a3152e871ada479248557dc4f77b17e172576cf1104c02c7647e805fa4d717c5bbc408aa7468731
SSDEEP 12288:ReBNUbTVO86U+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RJIUNNyBo4kx929bL3Hnx
TLSH
T18565CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c0d626eff08a562a83e51c0654a084790d4dbeb1a18d509257a8e30549e65158
MD5 3640da867ab2ea27a3f16d67a0784f60
SHA1 03d77baccf5b03b25523eacae04801f664665489
SHA512 60e0780aba563e6272af81264a0664b7f27b36991e399cb3160738db8d314dd2995ed2e1236f3e0cfcc404dd3e1b210d5f0092a74350b9fb70906614e570d0f2
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THM:uQvGAdlCEL8c/DRNw5CH+k
TLSH
T18F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5e1d1b360291dd8b6d934e50bd2a1989925dcb9dd4d537bb311e57e69a83ad64
MD5 6f004a75bbee584b39ff4c16cdaaed69
SHA1 ca8edabebd08fd28accbd799d96c48429cd44b10
SHA512 10eded0d9023c25281d8516cc57561dca227361117a4c0b08d30c4abc13ed6d064ff9f8d2b02a1fd25d2beda3e161534a8833b91cd51a724958ada95b06fe0c3
SSDEEP 12288:rAwSfxL/2Dc3XDLLmt0LDQewsAj8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:UOewsAjjNyBo4kx929bL3Hnx
TLSH
T16775E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4e53d8d9503d191ff1716d63c01a20d0846db724a4895ec66703284be71758fd
MD5 98eefaaea1a2a9c9b8b6813cc90b4e3b
SHA1 acfb605c7cb30afc68c1645db0e7d9d74a92482c
SHA512 59cb4624657e927dc77699b79b1d5949a428273146889ab687a1b30c6235d4852601d3384caa317c5097083720ef71084574444c6b514e5d9aae2704c450f41b
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHI+k:mUEtQevvqc2W1cpV2tI32I
TLSH
T1C8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bf0d3566620152d0b550f0f3f807940ed6cdf4c65592d817055b72a6b56f0c91
MD5 81dc8f3ea8e8a80f8c8a3eee571ccc87
SHA1 a1b4a7c0551bcb5797b65157ece193db9be6f574
SHA512 32dd6900a0cb3b352a6cce5ae00d285a113e732bd639478bb47a51469def05364e4c54de22204121f05f257314eca78a040164565297126d9710bb9e164c311a
SSDEEP 49152:DCbRquA/m2yL5zTfFiV+XenmE3/zMB+kn3Hnx:8oquVjnmz+k
TLSH
T12CD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 267d392dba88a2062b47649130d663fdca9da5b6e42940e2ef6fafb6ddf02a5a
MD5 0606aa9a0753325cabc809417489c958
SHA1 833e709244032c72e9acdcf55c8693d2bcb6d17e
SHA512 1d8ba43037b6e5c9462e36595089e3195bad77336e594b83e4b92e872bf3804c7d990962822e26513dafa324feb8d12db0f6142045a536617d1c47b4a155be9e
SSDEEP 24576:1AhGL3IFoiwtA5l7S53uNyBo4kx929bL3Hnx:1AMUFoiq51B+kn3Hnx
TLSH
T1F535AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d22c87ac9529103764e7135081079b7b8dbdecd04d89b4f4b2fa20301b8648d8
MD5 b249bec9fc9a24b434f091d113e74277
SHA1 083b83e897ee34cfd5df583c9408e1ff4ffbd464
SHA512 dc5bbf23effacd840332a3bd106674ddba80a83aa2d374f0fc89b43bc140d32eed9520e992c2b30749eccc0a417558342c3c6258313d4208ff0ece2dee195cb7
SSDEEP 12288:Hmw5HEjsChNzBFgl0WDm+CNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Gwu6OW/NyBo4kx929bL3Hnx
TLSH
T19365F10677A81CF9F96756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 44969ec7544d392b7b7cf9e3ab6cb46451c12b962ef250f8f5c8ee609a937962
MD5 892572c00029b86db4a044d2c4f08026
SHA1 beffc5a142766060831fae8bbe24953a96276483
SHA512 1da5fa2323fd3bad92a4d4f399b9dd1515ce929db4ffe63e50bc1fed0409205937aec522c11eb1820453b48b03bc45768eb53a36b7d2f3410979f1a05cf2e388
SSDEEP 12288:tgZ1IyMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WZusNyBo4kx929bL3Hnx
TLSH
T135551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e868e4bb56ee2e7e0f331b99ab8758dfe0b8945301eef5ad740b0887289c59b0
MD5 0cdbaf97ab53a160660f4ead11e6a743
SHA1 fdffa7709bfc7c1dbc83c06e9421659f02855354
SHA512 3caf6bfe5203caf69f7b5f8822b174fca1506daad01cb697c21555a059c73b0eced5890c9effb3c95b7fab1b925e275b340f5a88bd481a11e4d13ae5f077d718
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:mQRQyi36YOcPbLvw2gAf+PN3e+k
TLSH
T136666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2abdc10104e1387d49bb299d935eabb4ca5dbc6a6ae1366b9c4693639950fe5
MD5 2ac434afa2eed2c7d3c9f77282ee117c
SHA1 e5fdbdbd45cb464c63007c9684695db61b255694
SHA512 a49576e9aad08cce5d10627711103084d3ad749cc218ce0540ebe52274a28d741c2c2d37f2f28c35481aa0aec8766208a615003c970c26d0eacae749ed02b836
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:3QRQyi36YOcPbLvw2gAf+PN3e+k
TLSH
T168666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6e0488ae681448abc699126b943fa80c42e71a9b1a94c0ac45bd95c73db868e2
MD5 5ea2b62eb6570de2cbc66757cfaee54d
SHA1 2066b1fb5bbe758a1737e35b416711ff4ea45a9a
SHA512 a1a53ba15e31a02e1ba59f09f3d71768f2ca6f9f0caaeb10c03de48337246e412526010abdc3ccb2d51d28bd78e3e1898d5623e8450d96730ed8abffa985f1f2
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL08NyBo4kx929bL3R:668Qg55nhceWu7PNU3/cB+kn3Hnx
TLSH
T1ADB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 481d545a184c490547a36f580fb8be484724c5c503b36cba2f78cc1e982d5477
MD5 71c66e8dc36c596345374d6997905e42
SHA1 4df31704406c464af8ff48a3279cf4076cbc3cac
SHA512 422b54ba23d99abc4e2ff664df5d7ebdaa958bf9d92c2fdf37b3bfa8dca46d7f6103bae17d84ec392a05efa33cc50f9ad47ced3b90dacc7cf07f41d934dbf972
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:Oy5112gYy5azzVvt69nLKnhZd+k
TLSH
T1C9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 97cf3f7c9c5b9f5a597f261decc06de0dc5e4e201f0d5dd6fab092d2b799f5e5
MD5 ff092aa0d40403e6de6f13b1e7e5be98
SHA1 797cf737648b6bc8f00456f0ec72bd35fa54fe23
SHA512 93ff31597aefdfb22a9a6ce2a99e1607a6c8c34215a2d10178f7a13f2311264060af334991fe3093dc2c2dc9d823820baf68dc26a9923b8c0def7b1a2a2f5f21
SSDEEP 49152:5B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnB+kn3Hnx:vu6Jmdxd2dB+k
TLSH
T1CCD5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a4bc9628701a2ea8917773cfdd4fa80a9ae55bb06afa990fda956481f6cafcd6
MD5 7f84fe0fcbc2f068d593e57236ddfcef
SHA1 cf0362ef830b146ce2d4861c4f807303f299ad5c
SHA512 df09d67d749caccc255ec58d086fd4a8a931cf91f4c89f482ea876c7e249c114b89676570e54d2fe1e30b349c1725244d54e05ad0557ba508399337a71451a46
SSDEEP 49152:o1hpsNoJpF1A63U44CwH7R4xKB+kn3Hnx:omifPWRz+k
TLSH
T10FB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 03c77b148b3e136300d2dddf66a387c11e8d08bbc0eb3f2b762cc52368427a49
MD5 9a4d2ed6485be1fc6ffa7ab04e394058
SHA1 ce680dee874132e5d47705f6361e2e30afff654f
SHA512 e7dd6eb4e5519ec7d948a36cd0c9a7ae762636b25728cfae29192c22587ed327dfa052cb4ea94eb64db632bbffbf7779773b47a7e1301f5814d6549130749a76
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHq3B+kn3Hnx:M5dKii61x+k
TLSH
T162C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4df6dca90d12beca57bd215d07b1e434d5194b38599050a40b6ed6973f334eb7
MD5 400a94254026d8b1effbce54cbd999e3
SHA1 872a31066f46a38258e3f7ee2fcd8a83e9f67acc
SHA512 2c4f81c076b2bedc085b3dde47795165a123d19c06a1735d47e95c34cc85cb12725682fedaf4d03000d3ede2da7fae4a81d3e818e9f49a438e52a6903109e579
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5wmB+kn3Hnx:BX2imphf+k
TLSH
T1FC95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4c7fc04f25c8d872bed0df14891e5f4d914d4170a1e28e168ecc74bfdc844408
MD5 30a26f709d656224561a5e0946ad4dfa
SHA1 fe9561972c5da0ba3f0a5ce4d01c2ade7621cc1e
SHA512 9bf8300e742428d0fc07f4de7da5bac61fc38a1b408eeb3c1094dbf97cb67579757858c4492574257f60d81112288639722baf90fdc96a68ee0ace34c224f6a6
SSDEEP 12288:4jLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4wNyBo4kx929bL3Hnx
TLSH
T1134523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 30d36fb72109de018dfee9034b6ee34da22ebd687ed628c9c84bcc48662edea2
MD5 ef6171172a1ba96ba8c04d50058f98da
SHA1 7bf7ae5ac7d692cefce9ee165d260fd3e786baa6
SHA512 94a03067218ae6746918b67bd7b314e193760609013cf567998992186879a95be32be80dc257f1718c0b8553bb6e1ea1f08cebe0d8b07e8486e945842cce12e3
SSDEEP 12288:3oLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:33NyBo4kx929bL3Hnx
TLSH
T1434523125A0C227AF76D3FB0644A8498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3d3ca3478ab37dac214ff028ffa7739877c22647772f51eab28151f773964879
MD5 2c8aa1ef9598825ca7d236d854bd27d1
SHA1 c68c32be91e0f70240a3f05824eab6929ecd9fdb
SHA512 5071da843572bad37c20ad00a730a29af7383e5a08195b2b3d29ff570a29b1ecb1cdca6c93bfdfaa4342f389423f7380ad051ebb14f2e087bf5401d59588044a
SSDEEP 12288:s2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sVNyBo4kx929bL3Hnx
TLSH
T1FD4523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 890c6d14baf1396769342bbab68f1079cfb45a6563c6765a4d0cfda364ef485d
MD5 5887ffcb40b3a7b6aab30fa678a6a2ec
SHA1 03abda60c29662bc4f93a8b712d4b9a3b95d4249
SHA512 0118256b6a308caf115bbc696ff80364747fda2ba4469b880a24a18177bdd6a00b15178664caf9a1763dafd78eeff21be132a245259fc68b1a80f260f98d35f9
SSDEEP 12288:JVxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6NyBo4kx929bL3Hnx
TLSH
T1A74523025B5C12FAFA7E7BB0985A8054C835BC8A5B7197DFDF12487B0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cbfebf57e9d69cbffda31db919b74978a6618d52ba23193736fdec0f97782c56
MD5 5de2d413b5718382c181d9b5c941aca8
SHA1 59063de3f677576fbe20f5ec600c09422a3b1bba
SHA512 f16f7c32332f2cf51c56cc6475bfd6ce25f5dc411acc2de5feea9cd107b0219a17ec9f589d8d05bf3da2349ac44bce8f6719de5278e021be3ec01f2e1d29a447
SSDEEP 12288:sZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sGNyBo4kx929bL3Hnx
TLSH
T1BE4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 59f3fb6d63268abe7b3119da445ec8dd41a448c8260de95558fffb1e6a1e908f
MD5 b037dae9af3a0715c451b76ec083b83c
SHA1 c4a0b0d9c7070f735232e5a0e35a2489e6dee87a
SHA512 786b4c710e2f0052771400a4e13cb0e7f8fa7ed6a7197e39a655a4cf886a14a25d7700496a79fd4eb2c671a40080202e08081574bfda072edcb188892c135de0
SSDEEP 12288:oULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oLNyBo4kx929bL3Hnx
TLSH
T1EE4523125A0C627AF76D3FB065498498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 461ba8a139bc9c4b5f90b1d09edd5f1f3a8fdefb4570238bc507bd1eecb7d3ff
MD5 700f45ee7e1fd932b5fd529cc0911d79
SHA1 91bd009819f40f13fe5dccf13e886cba9f251793
SHA512 263ecc1a8ef35d8d9fe466f9b6ac760aa6f4840386d6c06926a74d44b4a6c6492518e6a9c594fcdb31181ff9c2c854368263ab71c56480adfbe02014ad604bda
SSDEEP 12288:gwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gPNyBo4kx929bL3Hnx
TLSH
T1704523129A0C623AF76D3FB065498498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7682acfa6836d72109962aeea55a52fd2d084e7b710225e6abdc4ce9e3c573b2
MD5 070f120956882696d9cd91f4edad6827
SHA1 f72efe022056b67b4a68e358f1ce591b2340600c
SHA512 b4c92e7e6b49415cbd463f9d722c8ebddaa40d386608b5c504d4406cf788d97ca7ab68b75c49808fcd98fc830080a4a9ff7d92b0afd9b90f44c764b58fba0cfb
SSDEEP 12288:viZwbjzzFEoS2cPvyILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:KZMXzFVSOXNyBo4kx929bL3Hnx
TLSH
T102650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 791238132acf0ade1f6a4e7e32d645a985ae684c3bf3a2c583ca9ba0b65738af
MD5 e34494760a18e2bd69b16d1504f5b700
SHA1 eb454788c6a680d60d05b572206d0698e4760fa9
SHA512 1f8a63db49d91c3651b95fa9c1307c033804982231699ccac889d3fffbe9f2ed36b577560ba559730f9e63befdc0f56d19dc2befc4d1869899283e3cf7babb78
SSDEEP 12288:EnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EcNyBo4kx929bL3Hnx
TLSH
T17D452312590C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1a198ec088722b1e26deb0a7d9b5723c5cd6dab75e69d7a5e0dfbfa55ca8a2de
MD5 6ded7f99c12c6dc0da6aa795c13c42be
SHA1 e810b970840d25d93f2fdad6fed9cb1ad2ffdaed
SHA512 2da47bb3e739a1232351ac054ba09ac77e78c6d1d04e4cd14b6b74017cd23d35752e8fa53a53ab431543fb0d1406b2f71a1dfc3a6f2c89222625845344639d3a
SSDEEP 12288:zbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:z4NyBo4kx929bL3Hnx
TLSH
T1C34523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f4f5be1cc2aa67d8733642af7b6804db0b0eb25fa1122c1ac53a6e4d78d46e75
MD5 c09d621a6914c157d57ad5cfa939ea9c
SHA1 34af3ab5c8538b751b2f47ad1ba32aa14108229c
SHA512 e655d7509bf4f51377551eddd1725003cc80ae161d52dcb899d4e7dd4a043f41b6b7905a26ce616fbf7fb681547ad7e8fff803cbd6a205835fdef93168e6cf17
SSDEEP 12288:XyPz5L8MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:azyTNyBo4kx929bL3Hnx
TLSH
T1F955120773A831F9E17A6234C8960A05E731BC760B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9c818053cbc0dffce75cb879a9e49a3170cd73fd48abae7fa458930bd31a48dc
MD5 81226a5808a0a6b1a684e8eb6047f027
SHA1 869bfd690088d40a35d51316f5ad894dc3825fe0
SHA512 0d4ddb31881c8e7679cac3981cf609d41e5564f18777d9f5b96388f46d0fa77257370828d2ae6fe367f7d7ac43171d56a5c736a09460f2b33c8c40af61080771
SSDEEP 12288:GnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GcNyBo4kx929bL3Hnx
TLSH
T1E1452313590C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987B59BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 417f328b86adfe5077b3a35d2d9f8cbf2fb8eb85ce4b2d4056fabfca9435cfc9
MD5 e9a14582b58be33ed78322f6daa1b89b
SHA1 a5730a7c6771da10b8726854fb8bb9e4c79029fb
SHA512 fd0dc6637b093808f6204ec2494a0d0333f53b2e772f948a660a40ff08f7bc0a2922a23e05c129c8032fbc5e290cedcded7bf8b2ed43fc899f871b353839f945
SSDEEP 12288:knLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kcNyBo4kx929bL3Hnx
TLSH
T1F1452312590C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987B59BCEA34B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c1f293ee7af1641bb0653256442a36560645d34d8c99270b04a0559990197fd7
MD5 d87e5bafd044ab9c0c257f6b36eee1d6
SHA1 a48bae4cf912b698f7e7dcaa209bacbe1d57996f
SHA512 b0f2c998f786bf35bbb91da2487cddd2d190676de6f2f9206d8e3f1c22ce4b133aec0f50ffe48d58eca0f3f97db830bfd79423c0d411d751da3104c1a6b16859
SSDEEP 12288:RyPz5L8MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AzyTNyBo4kx929bL3Hnx
TLSH
T11855120773A831F9E17A6234C8960A05E731BC760B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e47719fbc6d6fd11b15d520b3834655023854896ba45caa190887348bb80743e
MD5 e0cbe1f2b9927870fc5e83318b00607d
SHA1 da5de56e0629fbfec78996c25734f8058e2ad761
SHA512 58736c17eaaefcc3b980adcbdfb0b10b3f25d78c466d272686f61b91f4d8c4658fd56fb3e28597e8c463ca1dfa74319c9fe4d7f555566a53e60dd4c02b8e9da9
SSDEEP 12288:HCd98WYoaLHF3z0z04PDvhmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:iTtaLl3z0zDlNyBo4kx929bL3Hnx
TLSH
T11A6501A5B35018F8EC6B823DC8568906C6B2BC5A0B70C65F07A4367B5F373A11D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 04f41d93ea172e664ef1bafaf5d41f086e121ae1334c80c2e39ce6adf13d258b
MD5 429e5c56e70b3990b8c8d2b7490f828e
SHA1 7569b026c56927083c09a17371014012ad8cb8ec
SHA512 7a8598b5c0c83ddf2cb2f5d74442723d4c232278c69bb0baff7d92dd03a0cde73b46d46e217fb59b445133c9f1b4723a3c1688d5597d2b496dce4a4949faa1c6
SSDEEP 12288:0i4e7ARdTfgwCHKy7GLbbdIvVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:03ld9CHKy7GZZNyBo4kx929bL3Hnx
TLSH
T15A75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 13163e628d065b7d31bcfe805b04f253007cd7eec4f46c8ade77bcb75b94d094
MD5 0ddf5fa316775bec848273d729d87a72
SHA1 1916cd6645ca203eb8bfd89e66ca33b1ef1b585b
SHA512 3607d813786ee240a6c5d5ae6e82a580160653df081165db46a2a8fb4f42d27aa57667556df3979d9d589398bdcca9af3fba0ab79a4d4436a9ffbd2fac29829d
SSDEEP 12288:mWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:m1NyBo4kx929bL3Hnx
TLSH
T1804523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 75cd8794aecf18b881fd21506d4825b06a66adde771d4b2f5fee75db20c2023e
MD5 e14d73d5c306a1b27b4ececfca810423
SHA1 4ea51fbd001d008b221b9be5ac9f014631a54402
SHA512 d32c54b13e4d5e2d315076d4ae891d10040002d904b60b9013c194fadbe021e2d290df2eb824d731e45f0cf6fdd8b2069b7cd69e75b56cac1a3ec0e6eeef5a6e
SSDEEP 12288:DsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DzNyBo4kx929bL3Hnx
TLSH
T11C4523125A1C227AF76D3FB0644A8594CC34BC8F1EA593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fd47b41e1a86b1c1017e5fb3095b5c9a43b250cacf159008980d64d6cfedbdbe
MD5 699ec86fb7164d417c1c0dc09a554c39
SHA1 91461158f184f75a4bed9a8d863b7013c89ad477
SHA512 b282f5f0d6529100447b2a50801768cbed6b5095190400ea8bc00ed753d194861c665f6d11176df4590dbb9fdd17a7d812f7398627c8bf8404ec5e5079121ee1
SSDEEP 12288:tVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tKNyBo4kx929bL3Hnx
TLSH
T198452312590C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987B59FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ec640cf61691952c4948f0589291902f2be497c2e80fcfb4b6ba6ff47de6810c
MD5 24f007e0b0d5b48f8cc0992dda7697de
SHA1 35883b005bd7dc172d76429b720fb3f0a2d8623b
SHA512 c4fcfa243217e9faf32622b3e35e3e2f4d3dd5f8f46664512654850172ceb8e1e391a288d6d1c74e6ffe5268fc8ced0a3223215018b9b6690aa0cf3c5431fde1
SSDEEP 12288:WnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WcNyBo4kx929bL3Hnx
TLSH
T1E84523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 96a4e6719844c8a5503a6106772758788422073aa897c50e0f2e7b1cdd11a88c
MD5 4f3db6cba05c87aa3b11bd893b8ab879
SHA1 d517d5d68f444c721022604ce63bfd277a8d24a1
SHA512 66cc28ae6f1a827ce2c42cac21f305b3c6af68a93f3cc7c922aa129ae15601816281315cd1f9b90a234f824ac8d2dadddd40c568eb3506e7713bf4427d3af428
SSDEEP 12288:LWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:L1NyBo4kx929bL3Hnx
TLSH
T1DC452312590C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 da0059ab38844306abb8d25fa8d48cc3128eb90019e982a67771fcb6b7ba47f3
MD5 cf73a4ea388fb8137c70e6931c461917
SHA1 012e5562d850d06a44796a476edfedb5d5409441
SHA512 712f6cdca8f8f37934e681bec98ddecc07f6551b42df4ff6dd3567e9f7187283f77d4bd81786d326813de7b1ff4778ca7074546a1d3ed617fcaf6e50deb973cb
SSDEEP 12288:PPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:P0NyBo4kx929bL3Hnx
TLSH
T1004523125A0C227AF76D3FB0654A8554CC38BC8F1E9693D8EF27987B59BCEA34B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-08-16_111340_1852-4568.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-08-16_111340_1852-4568.log
Size 1KB
SHA256 0001ecd17b602a89b2aba3b2b09b01b2c86d0ea7b06740538ff5f5129c3eafec
MD5 2d0fda9555f9515751bad4d37d5f2b85
SHA1 6ac920f7238e5d770c0514e55a58ccd8fc566cd8
SHA512 c1d1adb00a0b92e3aa62a46f55c0b8c418f72e202a4f20869d6e865ae03c8a2f070efe0a79661dc1114c737a113c72f6fa4d5a4a8f7c3a53174b5cba7adbc03f
TLSH
T13B2184197BE80A06FEFB9AC2D8FA15536E3639517830CA0C0164434D1876F86EDB531B
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 29409890f0c2d38e67acba99ffe2daa0423b549c7ee7c8e9798f8fd21972b133
MD5 58eb0b0e2c0e49dc318656b7acc8bb44
SHA1 9d18573427859be6fc591d7ac89467b2143f18bc
SHA512 38ff1e4a0fd87c1e2437bb270c3a4f0df095d015a9ee6ae96d7cb82e5be94db410d294444c3e6850a2cb25b3d0823a43628d420359b4158cb96b86ca08f9ea4b
SSDEEP 24576:mfwvqk9RX6wkyAIoNyBo4kx929bL3Hnx:wMnYILB+kn3Hnx
TLSH
T15385DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c037eca0dfc63da08d646b109afda268e1a94605e3aacfe6151413bb5113d132
MD5 6228acde51bb49ab69c1fc198c62a648
SHA1 7ddce492cdf06597b3752e12f424e091ec46ac77
SHA512 98a8b1977510a3c2b550372ec13fe0082d8d9ec1bad1d47dbc31a7fb9a183ad6a3b1259b834f23833f6769f71242d3a1830649ec0639e5b65eba8c8c484fb29c
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GB+kn3Hnx:tySzP++k
TLSH
T1D9066C56A1A801D9C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7e55f1fade1a0f094b68436e495ff2ece79ff30575732985f4bfc54c34c95212
MD5 822c38097414698a0f55abb104a2e3cd
SHA1 7d9b50452e2ea0016bbfadd3755524861c0f39ee
SHA512 2efaf5d23a9256a8058e328d3004c293302c13e4fb6f7a6655622feb9e06f59c1ef459db47256b1d1643254d79b1fbddf0c98d10743bbdf0634854a35d820d52
SSDEEP 24576:Z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYHNyBo4kx929bL3Hnx:Z47JUQjTirIhCnDHUPfF/WB+kn3Hnx
TLSH
T13665BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2eeda5aace39659537810296a35dcdb2ee7d1147667f830c44fa549325aef767
MD5 a8f8ef3049fdc192305d70990a653fab
SHA1 cd909d3e2c961a2349e7d9ce1ab3323929c5f94f
SHA512 3c88defbf7bc9076d447806a641e566551ef5bb93a98dad25ba799389d11de8c9d86b12c3f4fef5565743e5ca9e9c0ac0e9123ed7490a8106570c5da52abf7a8
SSDEEP 12288:+psfXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PsNyBo4kx929bL3Hnx
TLSH
T16D55F00AD25812E8D16E6274CB468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 50dc1bd05687648e19727b061743997a230ead35b0834152be390d3b69d49853
MD5 b3363adc1c51797301c421b4fe11819f
SHA1 c9a26f97bdb3e7fbac0d7fdaf259c4dca95df1dd
SHA512 5ab0d0fa42ebbfbdfca1d2e55d3093510110d75891b2b6a4296adde9b998cba280c8e79a2068378628831c3fb5b5364bf5fd07b5070f7e2a3e87295199759570
SSDEEP 12288:pUe6+uU3f6adgxWF0qQZIChVq59Usfyq76vTfwOeup:pUXFUPGOdteTfwT0
TLSH
T129252810766AD75FC6AD40321E33C2CCAB707D41EE059B0372C9872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 398KB
SHA256 e6f35f53e33d1003a480bee39dde8d86095596b45d897736f880cdbff54e3920
MD5 987327e65ffb7572bb396d86c9c8951c
SHA1 f7ab72fb15b4a85ad5787693c656a00d522c7e09
SHA512 c1eea644c2ae8ff1b7b286e73cecbc082c1b5c92971b1b93fba279c93bf5652434f41085dd617f1c2844c26f778b6d1815f505d40c182f537308b74e7ca5854d
SSDEEP 1536:pQo4Xyy9W29WOhgWOEiTfhr2iSljhcCt8/SdTvn:8iy5SUiyco8Kj
TLSH
T1DE84F941B325B32EC0F64073457196DFEB38B812AF525B023BC41DA9DC72256767ABA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4c90f3e7ee0033f1405b85219f78357200606cca608b01d3636cc4bfc32e4574
MD5 ddb484187eb5e9af4b3affef0931852a
SHA1 459cf44f993c79369edfe60e2f54aeac95e81535
SHA512 c0539562b7b981af92b3f440e81b2efe7e392853014810b62677f32229fc995136abe8da5513b178a4e98cec7c1108a7a9627d69b44c09945d2f3a2318df58ce
SSDEEP 12288:oy7/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fENyBo4kx929bL3Hnx
TLSH
T1B7452312975C623AFA7D3BB0645E8124CC39BC890F50D6D7EE1658BB59BCED28E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 907734611437ef4f1d3866e692a858bb3bbc58b3d1f69157421b67e5e6131a76
MD5 0928ff1dfc339a7a898aa90ee2a11c39
SHA1 d45e2a14ec4889124f871c31ae4cb1d30c0ac448
SHA512 0920fd0d515db2b725e1271228ef2890eab908ab8997c7c588877965da4e6dc6ca985afcfb775509c99a812544207a5671d7d74572c994dc27a653a605dc16ed
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYyNyBo4kx929bL3Hnx:Tgb4mBIBhGFoB+kn3Hnx
TLSH
T12E65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e5508660e51d3bb621684c4305c4b37ffe219a060108ceec271c5576839f6156
MD5 6b878da93b15bcaa4d1f78d685cb384d
SHA1 3112393fd4a9421a9336185c7f754af605ceb6ed
SHA512 f70174691c4f25706bb5ad8c06a8d9c6d398bad7f27f907cba6b4291b4b0b037480116ab7991e6b0bd475918708cbdb9e0c65bebebf6d6ec7f334f06caf8cbbe
SSDEEP 24576:nG88u8FpJqH1Jzria7/mXNyBo4kx929bL3Hnx:G7ZFPqVAa7/5B+kn3Hnx
TLSH
T1C585F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 50819e1554b000d727c965a1812c594beface639d3bd05d216bd1372d82d8ab4
MD5 8981dfb47bf84a6cafe3e578c40b2297
SHA1 75bedfb7eb36d351c0da169de978ffe1f3503c40
SHA512 0fc5f839bc8924147a50feca937973dd01f4dd648ef0ac73c81955b5bf96e1deca5a8dd3e1153877159f118ea0b442717acc29b379463a0feed98c1a7cb45ad9
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEB+kn3Hnx:qG05lO43bV+k
TLSH
T1D4D5CF6A62EC11F9D1BBD17CD9C6460BEBB23815033456CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 87dd95195f6de920b893b8d2e6362f3507e51184f9ef83b4b1d8e511de1d0bd8
MD5 7dec2dd4909fe8c511ccab7678809252
SHA1 0a91b7cc18aee7f58c721924c105ee4f5a41573a
SHA512 abf9290025886153280f35eb2239d871e040a0d28987b9e5de232d20b6c00248d792fce9e117325a79052be1320ea70ee60fd4c79504884e8172c4e75a202945
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnRNyBo4kx929bL3Hnx:Ia5POZ3BJt2pasx2+mcB+kn3Hnx
TLSH
T14C65AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60818c55b9c26a3e90fa9c40c182ec09a5a34fd4ce9d6b738ade6c607a190380
MD5 fc4d0e8c22f70e9fa0024213d2de2a29
SHA1 5902ac74fa45ca484bee108ec7baa14d41bf2731
SHA512 cd787c5891a88c0fb84063f43db0eb07585c397536fba7873d990572bccee5dfb6b155d106eeec6575aa2dd6dcd9b8e139e65a6e701567b1eed018458a927e2c
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkfNyBo4kx929bL3Hnx:hNc/zEOVHFZB+kn3Hnx
TLSH
T176858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f4684f0f4bd2695a7b3272a51f4ac3c44d9e465c97b11c632a9afb01ea16b04b
MD5 a301b564237caecb89dbb3e9ef6f13d2
SHA1 3ea4125d34cd672da57f6d99ea97d7cfb247292e
SHA512 84d5f72d6cd267f203f07b7ca6646de19c294547e5cfa77ebcd5137f287602664c45df3a66303f2088a9d1a407c82f82b802ab630717d99450ec89d5aade70d2
SSDEEP 24576:tTkNvNnaFeYhJNtmZBmANyBo4kx929bL3Hnx:tTMwBtOmzB+kn3Hnx
TLSH
T14E55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0fbf0a2f9a33a6cf522f1216a86081b5d45a93c9ec41427230e92cccb30b669b
MD5 a77ef6f53b302cbc10f4f217c95d0b48
SHA1 d09565f9c69defe6fb24cc27c739de22c0cadf3e
SHA512 7d158d933e2b9bf1a9145d1d97e54269b5e8c51d41839aa4a5fcb4651bc94b217da1e9faafce63061784fff62d99278f46395f269af537e81e3d88d112008d9c
SSDEEP 12288:lHvUrBFrEjwaQkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lPUr+NQ7NyBo4kx929bL3Hnx
TLSH
T1C365F21F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 bef89dc8ea95aeb536f2c8c37cb419f78ce2ecd2e6b19eb3059914a4bca17760
MD5 eebe3afdecd0adc61f728e655dbd04a1
SHA1 3db23f3bbe07e8d20a9075c5871614d9e2ffab59
SHA512 7b224f1968c1d9e4b48532e5d8c19090d4bab9a4419f05bd891e8c133e13f7a5017952f319503c36eeafc0c857e05df0598f077362d36633c4c483dd14511de3
SSDEEP 12288:pQcMxWDXN1Dp/fshBItT1IQgADLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:VD3FHshBIYQgAQNyBo4kx929bL3Hnx
TLSH
T1BF75E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/548-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/548-48-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/548-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/548-61-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1256-86-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1256-310-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1852-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1852-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1852-37-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1852-43-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/1852-0-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/2424-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2424-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2424-314-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2424-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2424-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2424-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2512-313-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2512-116-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/2512-122-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/2512-113-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3140-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3140-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3140-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3140-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3140-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3256-63-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3256-70-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3256-292-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3256-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3392-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3392-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3392-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3392-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4792-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4792-96-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4792-345-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4792-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4792-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4792-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5028-76-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5028-309-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5028-74-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5028-82-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5964-186-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5964-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5964-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5964-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6132-126-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6132-15-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/6132-21-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/6132-22-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/6132-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download