905be1e175f7a7210a433b9f60c1a9f2e84cb849b92265821c987e1ef33121f0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260819-plh4wstfpg
SHA256 905be1e175f7a7210a433b9f60c1a9f2e84cb849b92265821c987e1ef33121f0
MD5 f40e17694aeaa68bad4482c6c26ab241
SHA1 8f90241d319cd44afb41f4ef55f32518404f8999
SHA512 b7d1f3f4e591de7c1e5c9d14174291b90dbbb8905d6eb9bcc352d3f4ee2e7335af73508e04adb1e898d1f07ed89ec6c5887965d5905c76ed081e95f908b03587
SSDEEP 49152:W7EE3hXd5NHfrPqx0AAzXfuyUU0CBedbQ/dBZchqmb2BqZTd/dQjzQgilV995S1i:nBB89/dBa5dQjI
TLSH
T1CC167C07E7B941E4C0BBD13D8A569657FAB2785A877197CB43A0875A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4812	elevation_service.exe
5208	elevation_service.exe
4464	maintenanceservice.exe
1160	OSE.EXE
3272	PerceptionSimulationService.exe
2084	perfhost.exe
1968	ReFsDedupSvc.exe
236	SensorDataService.exe
5112	ssh-agent.exe
5220	AgentService.exe
1152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a41baf81e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-19.1226.4500.2.aodl	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8453e36d62fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfa088f7d52fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000059a41af7d52fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b4e2536d62fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007577bdf7d52fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b596236d62fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000409d11f7d52fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
5208	elevation_service.exe
5208	elevation_service.exe
5208	elevation_service.exe
5208	elevation_service.exe
5208	elevation_service.exe
5208	elevation_service.exe
5208	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4500	2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4812	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5220	AgentService.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: 33	1152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1152	SearchIndexer.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4812	elevation_service.exe
Token: SeDebugPrivilege	5208	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 5580	1152	SearchIndexer.exe	100
PID 1152 wrote to memory of 4548	1152	SearchIndexer.exe	101
PID 1152 wrote to memory of 4652	1152	SearchIndexer.exe	102
PID 1152 wrote to memory of 5268	1152	SearchIndexer.exe	103
PID 1152 wrote to memory of 1832	1152	SearchIndexer.exe	105
PID 1152 wrote to memory of 364	1152	SearchIndexer.exe	106
PID 1152 wrote to memory of 2236	1152	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f40e17694aeaa68bad4482c6c26ab241_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1160

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3272

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c6610347f0f593772c805dfac7b8ef0e576b0ffd8d5cfc94e50e4a7c87a6fca8
MD5 41db7cb6c8298880a40e43365cf8f12a
SHA1 fea992650c260ffeed6abc82dc6890940d6a80cf
SHA512 a9ed3ca054830e1df698306aa2a106f0b26bbe7b5b45b9524b062ab95a14fcbf47f8d12fcc2f9a0e842312d79edfe9d1f6edfc65c92e0fccdee159b5b3e9b60f
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1jzQgilV995S1V0:E3q6HjBmjI
TLSH
T18AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 dfa27bb91191b1eaf7e7d97147b3497439912348a655f2ad9cfb623c1965b9ca
MD5 5ffecc14f9d79fd26cafc858ed85c614
SHA1 0db587ca72250a073a962ac9c8e711a6cec73bb4
SHA512 63811ec4999a6ef7d08650b2e5a2298b09abfe3f593eee7c42b8c9067fd506bbd19b33e55cdf58fa9126d947e0d8bbf08032c7d0d470b93da31dbf3a6d4a6ce6
SSDEEP 12288:U1XLsswWkxy2lRq2czA88jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:yXYfDtczAJjzABgioiNV99L5S1fd0b
TLSH
T1D785F12963E448F9ED67817CC8A1C506E6737C914760FBDB03E489261F236D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c623d44d7fcb3cb08060bc03985aac13be816089389e354858f7b3989cf3c6d6
MD5 eaf4dd367ed584345db099359ee7dda9
SHA1 e0471d2bcca88ee661f9e9998de03ef09cd4d0a5
SHA512 e8186c0b2ae2eba89bea592901e9bbd942fba9053fcb9008feca05548d8e5c5ad6dd5a3296ded49a74d39e3c3492f51f10b5c63966dafafb66be0de004edf6eb
SSDEEP 24576:E0Le5ji0hmxYrMejzABgioiNV99L5S1fd0b:EPji0A2jjzQgilV995S1V0
TLSH
T10A959E56F6748735D073C0B9C5D2A68EE972308257308ACB4286C77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 653c7e4e23eefb62f97bf098a44fa8bfdb10b7949b72961350de4706bd5d3318
MD5 30422c0e8e971a804787dcffbd0b0a13
SHA1 ca80cb5440670e03b1539b3ca8a905c3d5fe7d0a
SHA512 2edb2bfb5c46d4d40ec82a82b89ce033ab6dd4b62229406669c54335080cad83b1c8be1a0b261e16acf799b376668d524628b36efb2066c9c4416425626297a0
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyukjzABgioiNV99L5S1fd0b:A/ezSC6vUzPvxHjynjzQgilV995S1V0
TLSH
T136755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 48e9d4a5865449236a39a309856687bae2462984234c3be13f50e852fe164a12
MD5 a7659631d614b8550ed84325208fd1b5
SHA1 bd7f00cc53f6220d16fd506381cb9935f14c037a
SHA512 8b49ccf584252bc2e73c2d4cc3bddd21e255dba436a5ee7010e62a9bde872db06dabff48733f6ed29ccac258daadeb9c3a47e54d0b448741b3c5a4511c776411
SSDEEP 24576:6VbqPb88hv/l+6FjzABgioiNV99L5S1fd0b:6VO88hXl+ijzQgilV995S1V0
TLSH
T158559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB4246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c20f604e55fe0df4427cc078fd37436326da0d833873df1be6859b026b54dc8a
MD5 ff08972bda3fc9a123d89a2d78e623a6
SHA1 6aabbbe87588c9be630d10c5f3ee00af807c1bd0
SHA512 56bc48918ef631c08fa908570653dc8e7b17dc78a708e72cdc4e185184343b2e30f801f26f0417d9a8dd2cd3cee4812dc531c1edd14d40a6fd882fde64b4172d
SSDEEP 12288:xH58jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:xH6jzABgioiNV99L5S1fd0b
TLSH
T17E6523C79768C88EF3750879E4A4F80FA4B35DA086407F9BC3E12C6A5DF9DA1C911297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 857a1e55162cf466e9af648fa4eba62edce3140db65997c398b4373c8f2ec77e
MD5 9a6d9f85b138c13e5658e49504b7a028
SHA1 ab50a15a2b058f29f7c6f0b491b1bcdfde5db939
SHA512 57a6a9bc4a12f71bb39b2f933ce3e6ced0ce1cc1b40673fdee717bf28ec6d04bc6011220f3b737dd56d03b759d42f98351f1ead987ee9963f6019bd60f23cb27
SSDEEP 12288:3eBNUbTVO86Uw8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:3JIUNjzABgioiNV99L5S1fd0b
TLSH
T12F85CF7BEE28FCD2C27A4DB85A91C600E7B278704B51A3CBD175820EDE235E14E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0ff6041a9f6e0dbf115ef0160267a79e680bd919f1dbb71b979a4bed66cb5125
MD5 4560f83db5dd165107dce2e23ca299c0
SHA1 9b68de492bfffb8fe14ea1a3ad18d0f96fa6a162
SHA512 6ab163822adf150b0c24112569a976a5f59f3b68043659134abaea9f348b2d38f7a00d8ba095fb628741bf7489178e7b5382292f996639e4e2996ff274c5b391
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:DQvGAdlCEL8c/yRNw5CUjI
TLSH
T1F5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7a08f9a306c455a89ba337ceb3c570837d46bb53d948c2b5eae02b85cb268c65
MD5 52be73d1dd734684a7b0d10ef6802222
SHA1 798e5b68f661e59dea5eb935368c21aa225a7144
SHA512 a9124954febc80c7b1b3ea73f351811877669c17567d9536e75b841536849ba4d38e9fba81902c43a4c3f0743f7a8125f51fc7ad3940918e9aedd9e3db90b81b
SSDEEP 12288:EAwSfxL/2Dc3SDLLmt0LDQewsAja8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNf2:Z7ewsAjTjzABgioiNV99L5S1fd0b
TLSH
T19985F031FA74D436D3BB0CB61B35D70A247DB9204B612AC3E3E84E9E59706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 20b2a5bc08609c6635042c182db82856de0c6d06a43ab3216c8c6b3018a6b846
MD5 5e9678ddd83fdfbe7d17d242940cc642
SHA1 2d51f091ffd2e329e2abfc59fabe768d04e99805
SHA512 bda32d3a705b2e129d604d740b8ec419a1b561d0110279c6eba5e87333c57b087f0ce13b17af912f26856afc1ac9c9a2be96725637c0d865c25d55aa526410c0
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHr:UUEtQevvqc2W1cpV2EI32
TLSH
T124474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dec1ee0eb3c534ebae9abd433b582ba9eb7154756070f9bb0b79a83c0bb009cc
MD5 e5d4c172b1d8083a4b872b9bb5a97059
SHA1 329975444fefe68da8e8831f12bc8dedac411a32
SHA512 58e71ce03ea55b110913d9f3820807336803cf73c89cc79ff921b904032b380c4a5b3dd369ecad93f7f86bccad4091d0dd29d3f9c9d643bbf0547ef9bc90038a
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zzjzQgilV995S1V0:foqtVjnmYjI
TLSH
T1C9D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c6ebb655c98056ec9cce221c2932368de4d4de755b83b9b2ddfdcb3261888cba
MD5 83c780d387a59d96de683f66d74c278e
SHA1 9bba1516ee1e91caf47cb19b88f415f35a93f5ae
SHA512 9bd52610656ee8520fd325910e10c0485ca1ce8f6e9596ac004c030ec19dcb3a345933a294004220d1fd860215c556825fa199958c0e286c4fea608a9000d677
SSDEEP 24576:GAhGLJIFoiwtA5l7S534jzABgioiNV99L5S1fd0b:GAMyFoiq5IjzQgilV995S1V0
TLSH
T19F359D81E7F945D4F5B3AAB899B69171EA76BCA65E30D20F1260C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8a2b2bf7fbd5137c4e978383fe7e86a90aba724d08f20a98721ab6eb92a4a11a
MD5 04d1e4e72405dbc97e01145e42fbf428
SHA1 835fbcaf307938a260e207cb0258597c9377fdf3
SHA512 1b019feb026076ea699edcc91d1a3c6b9dd216bda76b5cf0ed128fb49e0e041f79127cb16286752f838438129b5e8d8aaa402e17db967a08f825779bb5b9dae6
SSDEEP 12288:Gmw5HEjsChNzBFgl0WDm+C/8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAP:fwuSOWHjzABgioiNV99L5S1fd0b
TLSH
T1D085F18672A84CF9E6678138C557D536F7F3BC112A20EB1F43A0C65B5F37261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f5de92ebf94da24000d893e9619668a591051eaea6f24d51fee081809494e239
MD5 a079d2b490da61d5f25daa50723250cc
SHA1 383caec7783bb9abdd219834abb7a8e5953116a9
SHA512 a92a25ca8ba410f3e54185ae5909c1d6e03de222a6ee8963b13beb32d0807f494bd554750a8d6d77c1314dfac7270f78692ca9f3f0431f580f37eb1ed0a8ccaf
SSDEEP 12288:zjZ1Iyq8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:PZumjzABgioiNV99L5S1fd0b
TLSH
T15175128A23A894FAF263417DD8E4A50AE3B37CA2533167CF42A1056A1F77ED14D35723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bcc2d4aaa1b55e20343afed13d31eb5cdd21343f76d0b80db4f17091cf9ca037
MD5 7f2ddc03d7ee55cd1b01502d10b3798e
SHA1 0d3e7a9161b3e5d957538a1fbdb62a1dfb529098
SHA512 37e3eda4c570d9a14a12c4980963c78646a157e7d21348ebbb9c4a1e313683b5e03c1424d901bda1c20fae2d4b71594b16778ad3b05663e843dbf0d63acfa80f
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:zQRQyi36YOcPQLvw2gAf+PN3xjI
TLSH
T1A7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d7edbda22a818229f06cc5f50b64ea8539e9a53c1793f8b5c7018e7995e33e02
MD5 d6f07c407f7ab05410c8cd354f2cdb49
SHA1 241a6fa863845a22ca21773b3dc0e86673ff42c7
SHA512 1966dfc8403ebc429e3b38a7ac966e725c051a7be12d2c60010812fd0eada39aad43a0329cf68a07a5a0270be7bbe5dea11abc8a80d4b25128c64528d71e2067
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:cQRQyi36YOcPQLvw2gAf+PN3xjI
TLSH
T12D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3fe76ef84ec2a089cf56496bf7cb0af9b4f4d55a98a56e15fc2b446323040d1e
MD5 3e4ce8b04740ac14840fca8c96780e59
SHA1 510827e5e6ebffd4a4fcc5f0e701518fa50f8355
SHA512 a3102629d21424f5753edadb7cc6177d5e8ed972ddc557d2eafe75276f5d1f80b596867d0368a6ce8680dcb54298119da0c6b08e0b92b7c9b97f701dfb2e1477
SSDEEP 49152:e68Qg55nhheWu7PNU3/jjzQgilV995S1V0:sthWRc/jjI
TLSH
T1DFB55933B2F60099D44DE1769F4A972196E27C718FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 23dea63c3ae1908f743f5811a8a144c6c5a26733e2d9d8215b917fd0f0293d0e
MD5 f7b54a6e5ce7ff3967f02f3359709998
SHA1 1803a5256c9c3f19830999283e95b90e481bbe61
SHA512 4c0f92692efb0bf8322ae2bd8aad3e7d4f60b309310206bbbd43a9397ba87029237131f2d2f3ec47bb4f0af0acb8b13b9ffc50523e5b54be14f335f5d1cc73b8
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:gy5112gYy5azzVvL69nLKnhZ6jI
TLSH
T158167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 87b99b6d7fcf6b8a811be741b8688850b6f1ecd1439dcf52cdda7575123b3684
MD5 313e9caaa10d9922ab2e1c6c8445c49c
SHA1 0da6d133deadffb6d1c4d0c3c151014131a109e8
SHA512 c51210d37db3c2eecce6a7584f7f2e4da8eb65682c7c819f079406aac4e00c1977d672c8525e7d87386fd0a6fa108f9cd48f6f5979631567961c9102a4e70a92
SSDEEP 49152:QB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCjzQgilV995S1V0:Ku6JmVxd2dCjI
TLSH
T1F5D59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8f730d14dc6de1748253495b014dbc334e2ade03116e44ee1a4bb100895dfa12
MD5 355fd7dd07ccc6a87b5399ad92672fd3
SHA1 d92241029daac032547d6630931824a6612fc33f
SHA512 3fd36727059c4579ab8c9ab714a348f6675fa9ba1b52a6aec815143aaaccce41f22b7729d8d9c6676372c579897c4c2f01763d8f465b35d9c052610b68137f5b
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xtjzQgilV995S1V0:NmifPbRYjI
TLSH
T18BB5BD13F29900E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e7ce039d84832e87cfed90abf846c297fdc0b9caf29f062f4e53e028cde0350
MD5 1618687183cf4bf2ec74fbd20ee18091
SHA1 ee3fa679dd6c8b4156ce6e93c66a3482bdc8969a
SHA512 7b2d96d0e32113c1bdd0a7766d98548ac7a6a343799197e31ea8743dd18aa0b64aff9f52b1f53e029a7c1568ac939c79062442b10da12cece063d80ef61dac32
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqmjzQgilV995S1V0:e5dKTi61mjI
TLSH
T1FAC5BE03F2E940E8E0BED67887659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 26377d3e2260a646d4921fceead736d4f0ae1b49aaf50350bb400d52bd771b0a
MD5 bba509a47b198eefa89cde35bea55033
SHA1 3f99a717edca6e1bb2b19998a6f47ba17d98877f
SHA512 cf0e8a2567fc60727d42c0d34aa8075ef7c899707ecedcad64601d1120bd9a06646799a391f318d017df0bce4a18f84aa5cfb597d425a5270bfdbba99db6f07f
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5wJjzQgilV995S1V0:iX2iyphsjI
TLSH
T1D495BE13F2D940E8D06ED178C7468632E972BC150B35BAEF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 132f25c28ea9c5d535fba3b641ec5b82c74db19a7c01494193533d01641e72c8
MD5 28746846e2cfb7f5e97fd831a19ccea1
SHA1 92ec5c782e0d711475041239cdd6854d8efe17b7
SHA512 a05a7e8d18fffbcefac01e52b9539a99a06db264e4911245d35b0348bcfa2c25f91cd6ea36929080dd140aa9b6d2422ec4fb836dd8d24fa87e62d5cf42f88aaf
SSDEEP 12288:GR8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPAc:GijzABgioiNV99L5S1fd0b0
TLSH
T1066523C79269C8CFF32044B9D454B50FE0B36DE596403AAFC3E608265EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5fa77e1679545cd70a25be9d92f2c86ae11c26f22e338baac7527e9acc4852bb
MD5 05808c3e81c72e23bbbf5ac143d4627f
SHA1 5cc4a28a746dfc8e5b6fccbe49cc56ed1963496b
SHA512 05e5a3c1cf0878d2d44535c805dd9eb33986b6b402cd3c6f70064c1f7a1e709cf29632113f71fcc89a792f3487656f2c4554ed6ecbfaa81257d7221290842d32
SSDEEP 12288:kG8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:k/jzABgioiNV99L5S1fd0b
TLSH
T1E46523C7A269C88FF32044B9D454F50FE0B36DE596403A9FC3E608275EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a2fb4c4ec48d1bafb4b6edbbbbb53e388fd4d203f1f062be79b9935a0cefe73a
MD5 58448cc5691fff16ec2faa6e54375576
SHA1 92f0021ce669d3060d4c03363c5ff78a1ba04500
SHA512 72189674ec3e185957d38e739207c6a930158e4339b65a42755a6cfeaf5a6653b396d88aae1591a57ef69a79c50cc1144a9e727ba08b7a8768a4b3efe29138ce
SSDEEP 12288:go8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:gVjzABgioiNV99L5S1fd0b
TLSH
T1846523C79269C88FF33048B9D454F50FE0B35DE696403A9FC3E608265EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 920f3f2fb535e1246c7d5be986ccf8075df63a286c9f17fbcf50d63448ba9b71
MD5 714834381e27050140abfee693263e33
SHA1 f644e6d86da75bbd1f2d5c9bcf8125e30eb0d1d4
SHA512 27c29877a21676b13729baca9736aaa569790357df4970d54ab0b119756452c733acab689d569fc13815097acd53feb14e9c0e5ce2a8847cfd620ab2d380df06
SSDEEP 12288:/Vz8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:ajzABgioiNV99L5S1fd0b
TLSH
T1376523876769C4CAF2718579D860A50FE0F37CE597217BDFC791081A0EB6EE08930B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 bcd09f64f7ac3b2992304d10a26ab5dce6373a1860888d9576a9a6510edc6107
MD5 0eca0ad6220072e45b3c1681b28b6cef
SHA1 e4b1894ad4b4fa445a21d235117239fbf9d3b884
SHA512 9ac50e7d976c9de754a0b8980c911f5aba785c796c63d8d8bd12913ea1bda8034815fd946b2a044af588be5ab147d21d8f617d5849e68f578a523ac9bf93202c
SSDEEP 12288:sb8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:sQjzABgioiNV99L5S1fd0b
TLSH
T17B6523C7A269C88FF33004B9D454F54FE0B35DE696403A9FC3E608265EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 70f9c81925aac0ab2c5eedde5a9257af9546b249812c690f9e0c104b2ed62619
MD5 5e20e22d03f97a088a7f81e1ec4f5c61
SHA1 26f911ca2bbc533f81a5acf224917f3e58de8e9b
SHA512 c9f0b37bb131de29c1b3e2ef424d551e5698c2a71544c2b1e59e3078d3a370faa20f161f618da94d51cf3ff5a3c91f9e84912a220ef1e956a3d74feab413482f
SSDEEP 12288:Py8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:PbjzABgioiNV99L5S1fd0b
TLSH
T1556523C7A269C88FF33044B9D454F54FE0B35DE596403A9FC3E608265EFADE1891069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 11a2f956ff70ef07d6a1582cc7bf9a20d8e7591eb7a5e8cc67320387a05ea3a8
MD5 43a7d9a75547cdd8ca0104c64339123e
SHA1 4748cebcd6f0a53a200a6e7f39ce5dd57a8f68d1
SHA512 3f72fe15f497c7f720e2c43c722093d7c2cd4fad7ede9775b8875812b85024741525dd0b5e7d2a38c33736ab60e5b7631c7ce79a99771adc52e929fe9b27dbdf
SSDEEP 12288:ru8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:rXjzABgioiNV99L5S1fd0b
TLSH
T1476523C79669C88FF33044B9D454F50FE0B36DE596403B9FC3E608265EFADA1891069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 6e746025d61e68a93b5a35b6fbd344e8ec342f506302643088751d85cc61c5f7
MD5 1d61c907218f8145d26947586c4a97f7
SHA1 bfc6e38a2b66e35e8f9b8c2e8e987ba5382cae7a
SHA512 dcea472955027315f0ac07be050de165065e650d74b3598ae4fe49bd9cc1f1a0f3ab89ef1ab84fe568522bd078fea43986c7237acd36154f6ecef843d450010a
SSDEEP 12288:DiZwb0zzFEoS2cPvym8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:uZMEzFVSOfjzABgioiNV99L5S1fd0b
TLSH
T1CF850195B3A04CF9ED63813EC815990AD1B27C6A0760CA5F43E436275F737A10C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 39dceb8a7958830c3d16f76144d2f7fa8ec1745756f2a4f49e4abfab3b98abbc
MD5 4dd3bd3ed4f55544b6924b1ef5afdd3c
SHA1 83f4e166de12b602dc268f11376c5af0abadae59
SHA512 8fa94b16729cd03822f52aa2642ebe8ef2e9faa844d099257016a2ee00c60c3b1e92b195143e69dc071abff1d41950f63a56f9dc086b6057b666ec9e4d69c710
SSDEEP 12288:BF8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:BWjzABgioiNV99L5S1fd0b
TLSH
T1AB6523C7A269C88FF33004B9D454F90FE0B35DE596403A9FC3E608265EFADE1891569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3a228dbc38d8ac96365b2fb07c70f22d1beb19cedab5c78637b4c2d62a2bc19d
MD5 f03d128c3b2f5d9033c4e27dcf0cc80d
SHA1 2df65f0d6887f133b9cc3331c103f70a394abac1
SHA512 a244c513254293c94f097f94a980cbbe67ca667801a561fc10338e3218569dc67c9ca6625f6bab21653adb0998439d94c3511e348cda825b4550428404473c8e
SSDEEP 12288:ZJ8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:ZqjzABgioiNV99L5S1fd0b
TLSH
T1EB6523C7A269C88FF33004B9D454F90FE0B35DE596403B9FC7E608265EFADA1891469B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 675cbf282686627662606a79bf803092b93475c45532c5d37f705abe78dec525
MD5 f0285cb1e4840ab1bff95f53f163425e
SHA1 052a2f2fddfd4dfe03f3d7ab734e349d1d0f50f3
SHA512 dba8fe09bdad7cef544018b04a084d2777756853ebf5bd2389a32d4e1b26414e1a1d1816e35fe887232a9c7210a39e2df5fd25960ee3ab9e253a4fd790031009
SSDEEP 12288:eyPz5L8q8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:DzyDjzABgioiNV99L5S1fd0b
TLSH
T19F75024773A560FDE1368139C8615906F3B27C724720AFAF43A006761F77AE19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 65fb6a438f602616b0c8925ce363f523549249d0db55e6e90aabffd4c3644629
MD5 b53c21deacab9c4c7a34dbf35f5a70e2
SHA1 8da8fc61124ad532e74d6771dbd9b4aa2a2ce934
SHA512 c58502273885e3d275a1364c74abb6df15e301bd0517b3e06059592c7531d79fbb879a0eae8242269937778de4f4b66ae84d05cafb903f9b54458292f13ea71b
SSDEEP 12288:yF8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:yWjzABgioiNV99L5S1fd0b
TLSH
T12F6523C7A269C88FF33004B9D454F94FE0B35DE596403A9FC3E608265EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 24b81e0525953f5de9e7a4398e5679372b241bc953c4ce02718451aa822e0072
MD5 fa642d734b8e1d476929df9b853735b7
SHA1 bc8692070b1f3f18e665c9efa89808226f26041c
SHA512 edf9e385a7fe7924a9d6efd158d77a973b2459239645a715c6159b1d2a67f7638ff030cd6b8538c1a92d4314562e43db6e26399f5b17f24a088579049010ffb1
SSDEEP 12288:sF8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:sWjzABgioiNV99L5S1fd0b
TLSH
T13A6523C7A269C8CFF33004B9D454B94FE0B36DE596403B9FC3E608265EFADA1851169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 3ff90d0656438fbf2e582c061fc3f6e631b1e08c04e27ca469c0178f8ebabea8
MD5 83a0c62013fc4812c70a3d8b97d522bc
SHA1 cc28c338fa7f1a6e1b60671e01e580d4200ae5c3
SHA512 9bdb58aefaa1064f220bb756965e41ebab0746ef089a6b39d18d163cb44d5efa6e6a1790c85339d743b52ad0035e0b211f76a7ce3f2f4a4b862f1a21f8a72a8e
SSDEEP 12288:hyPz5L8q8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:wzyDjzABgioiNV99L5S1fd0b
TLSH
T1F175024773A560FDE1368139C8615906F3B27C724720AFAF43A006761F77AE19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d3371b8647a8b9e5da96b336c523eb5bc1d887f624d7adadd884a250c1106a4e
MD5 544579f544cb0a88d3339472b3d039c9
SHA1 6bacf40dbccbc2c6804864a47719d0dfd24bb6c4
SHA512 aaa471df0290f52cbeee252e5ffb78a044bb6d33340488d768e09c7310162fce3ffd9d79f7797b9481cced1f186c19be321e3ef191f9f25ae4ae32783e2e156c
SSDEEP 24576:BTdaLl3z0zDljzABgioiNV99L5S1fd0b:BTwLljkjzQgilV995S1V0
TLSH
T179850195B3A04CF8ED63813EC855990AD1B37C6A0760CA5F43E4362B5F737A14C2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 22c6df9b7598fa3851cb5cb63b1644f2ab396956d67c5579459073a296d8a5de
MD5 4e3d90b32282c015b2d1c6aaff677a3e
SHA1 688bd5892c9293f40232e25248ed59ac5868bd99
SHA512 256da80a3c6d641f6b4b13494c94f524e0c1d92dcad4eb567f795a8939cfff2f938706d8f2baf1b5e42f434b90c651ef84e4787e142b6503d75a4bf1ac3b8928
SSDEEP 24576:Z35d9CHKy7GZRjzABgioiNV99L5S1fd0b:p5d9CHKyaLjzQgilV995S1V0
TLSH
T10095CF91F3E414E8F1B78A35C8759512DAB67C9A1B31DE8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1dc66cb011be38803e3d020e604a119703812b303913ee43189cce46e1570876
MD5 b682ca13dfcb2e102af7cbc6d84f48f6
SHA1 1f5a9b56dfce07ff807383b2360d0ad3ef1e3670
SHA512 a574f70e46b87855c8e6ca50e79156c40349c1a7b9c9b57f7587bc67e1b25b875e4d27d6bd3f8a8dda797a5241c801e93f5bda4ee63bfba8785cc3b18a7efb80
SSDEEP 12288:zI8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:z1jzABgioiNV99L5S1fd0b
TLSH
T1316523C79269C88FF33008B9D454F54FE0B35DE696403A9FC3E608265EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d60736296ba401b78826e52404e0c7b23061080db14ef29e87e0d51478b41b41
MD5 964baeb151c7ef51820189b3a8e83595
SHA1 b2c7eca7112fb37d641a0a11270dc297970c5e03
SHA512 4bb94400afb7600df8c113537265eecae65735c6fc57de7c1d664a9cb31e5a076e6a5b44983f8c4ae8f3f79778923c88e7022b6db289cdc03aa266230dd8b0c9
SSDEEP 12288:+K8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:+jjzABgioiNV99L5S1fd0b
TLSH
T1746523C79268C8CFF33044B9D454F90FE0B36DA596503B9FC3E608265EFADA1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 9391899124e42dae6b35a35db05f454997e75cd929b194a9293dba435686cbff
MD5 5da0b6db2bf0551b843693eace217128
SHA1 3e4eaebc1fe17c66fba2b25ab0ca7ec5c6b4b331
SHA512 3f77c085d116f8d81e7086c8a9b7bf88d3d63c9173e914c5bfbf3caa4f6732d8c3bc672543a1bf796d9ee4651411c7592d4fec8f49178d1d30f9c33a3276c1e4
SSDEEP 12288:QH8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:QcjzABgioiNV99L5S1fd0b
TLSH
T13F6523C7A269C88FF33004B9D454F90FE4B36DE596403A9FC3E608265EFADE1851469B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 aa6124e7a1f8a0db6e79ee191550bd57458d3eef79dfa94bedf5977db54061d2
MD5 5ffce0891861e75dc84ea7f995132be8
SHA1 5d25ffdb75be205a65e75a5aee8e18d258e74c37
SHA512 abf9eb24ba537e46ea6eaaefc867d19b8ec54ab6280e9b9a34ca8a0750bc82fbe2e03b5964912bcaa9018df11a459b1a1cb8c9c435bbd5d11b98e271a7ff85db
SSDEEP 12288:FF8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:FWjzABgioiNV99L5S1fd0b
TLSH
T1096523C7A269C88FF33004B9D454B90FE0B36DE596403B9FC3E608265EFADA1851169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9ff49054e0d95b2a4dacdba377eaf387890f86b3e2ae2cde846a32a4d58f243a
MD5 95f2616c6e941f4a6c74a6e0086cb48f
SHA1 7af6bdb2cf38ed4e0cce9405a180c5c0125aa67c
SHA512 4845466796268feb821ccdfa2b8d50aac966124b542addebcacf4db2f226c7f6ace7160fac48db57603e43487cc2a82d5f5674811a2276dcde31f6648005bfa3
SSDEEP 12288:XI8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:X1jzABgioiNV99L5S1fd0b
TLSH
T1266523C79269C88FF33008B9D454F54FE0B35DE696403A9FC3E608265EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 5284551de20fe3e1bd029b4f306148cc2a1d3e01d4eefd72f3d488c0440c171b
MD5 01edc12b06ac373bb67ef27497007b5f
SHA1 e0ed13ae5009a720d6032303aa99eca2f99279e6
SHA512 6128e22708a89d15abcd7a8d4e445f09d897e8e4e6faffbd932266e344cc711bc6858325aadf787339b8a17754870660a4737648b44d96104e8373639c8506f9
SSDEEP 12288:0t8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:0ujzABgioiNV99L5S1fd0b
TLSH
T1B76523C7A669C8CFF32044B9D454B90FE0B36DE596403B9FC3E608265EFADA1851069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 6750432a43dcfbeb806f80811ac28e014b537d1c714fbfe5f90a8b03dd364ce3
MD5 36409060165befaddb7cc48313fe937d
SHA1 37cdf5c0fce4f730c6d0e3012f27ab756f5929f2
SHA512 63956e1c3b26bcd2effe4818a224bf5bf25dcad2c722986a6d8fe213bd8a686a2a8708ace4f74ad0a9e9a3da8a98ff3fc52fcdfa26e8da008db29bdb6db3fefd
SSDEEP 12288:gb8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:gQjzABgioiNV99L5S1fd0b
TLSH
T1E66523C7A269C88FF33004B9D454F54FE0B35DE696403A9FC3E608265EFADE1891169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 ed041f52c154859180e488f5db44938c9b4453cf3cd86e4360e67587f4513e36
MD5 b3a15126c18e33b36f4b24822807fdd8
SHA1 fea59f93ea6d9d008ff26f898cfe867b77598bdf
SHA512 b5894b183dbf4f10bfea4df37106b29e2326d9127985c89b8192e210226af8bb1b43cb340fff3f91ddf8ed1e8db380443cec144766b617582d28efc0d3a256d7
SSDEEP 24576:wfwv+k9RX6wkyAIajzABgioiNV99L5S1fd0b:uMnYIajzQgilV995S1V0
TLSH
T13295DF29EBDC44E5E177913C89B3460AF2B278691B31D6CF029A536E0E37ED09D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bc84978162368512ae5524c5f655dd0dd6853addafbd7fc606e04b025e421764
MD5 fc4ad50fcdbf58ed1231321e3fe277e4
SHA1 5704dcd83315a5ad7b71f7dd03a33871544ed69f
SHA512 8f8193ef6abcee25a38d3b8a864699645fbb004e030e14b8a49fb973bf050fc0fd09c66e265acbc58fc97c1d79caec31377691ac4ce891b5ba6f8b07e4e9fb25
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pjzQgilV995S4:NySzPRjI
TLSH
T14C067C97A16841D5C1B9C1B98B0BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f78823a2be7cd1cb51c1a4f3f6c35cbaafb8b2697d745e72a55471416d6d7f4b
MD5 1ff9e71ed49175bba737a438c9b39f87
SHA1 4f7e4cffee7db7a13af45eab7b97869523b79e10
SHA512 7ef095813665f92a2a4eedb0a4ba37d2a181d6523330c34bdebfb3e45390735a12953883f87f1f69fbd4ab02c3104342133fe569fefb2e891f0385c4e1c58a2a
SSDEEP 24576:b47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPjzABgioiNV99L5S1fd0b:b47JUQj1irIhCnDHUPfF/ZjzQgilV99B
TLSH
T1C565AE1EA3EC01D5E1BA927885158A1AEA71782D1F31DACF12B0437D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9440a59c4aad1e5182c35c0281b316e8dc5df7a7d78c47cfdb7f8b4ca0775f03
MD5 9c5d2a65da3c3cb7c2fa512934391576
SHA1 e3de31b7d5325d1119fab425b6aff1483abaa0e6
SHA512 95a52fca4215995c383a10fa8fd622baac90a506f6d9febaef380fed80a72bf2660e698556453c442df66edee3d648dcd6b23f0f9c5d68827199c1b431b7f1b3
SSDEEP 12288:lzsf18jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:8mjzABgioiNV99L5S1fd0b
TLSH
T17875F14AD29881D9D16E6179C7559A06F3737C6583E0A3CB83D0F83E0F76A908DE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 e63a2857ac31880321f72837a3ec2171e1a2ffe6183ecd7f2955bc2007372e46
MD5 1378c3b7581549f96d17e23776aafc81
SHA1 e9ade1bc2d2cc852e80083200fee847cec88741c
SHA512 8a856284e2aa71d224fde78fb4c452a90bcdc6690070fba3558aa48e36439781d8399ccd2714f2043fd8f28f80fc2a6aa84b1c350394546a4ebf425f02693215
SSDEEP 12288:SXoc+1U3f2UP9uCbZimgPkaF+/1aRMLEORpxz:SXTKUPGSipPFF+/1aRMLEY7
TLSH
T117251810766AD75FC6AD40321E73C1CCAB707D41EE05AB0372C84B2FD576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5f2e64c38af7a941c140cf4af22b0290f1ff96f6043d3c5ac956ae91ef154a1b
MD5 c45b0ebe46873cc7289a589e5cf2f82b
SHA1 33956a1e5ac5b62099bf24cba7a3013e8ca1e4c0
SHA512 6096cf5e5ac522c417e53f75d82e8ba775588fab4d29fd8ae083a9b6cb8255e5b26d516c5675f8a786ab36961a96e70ec47c895a78a828e6142b99ddba9b6c41
SSDEEP 6144:m9DvOnFnduGs1B+M07+I1sI1LI1kI1Tofs5q0+Usc39ehz26tMx926tMx3Gztgmr:mIBEt07oL+Usc39ehwG/kD/f
TLSH
T1DB55B5815137A3CBD1FB6031076A5B4CAB64EC0773095F26A3C8553ED86AB62B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7707265cb6429ec31dba9e2a1c4ea6af6dd3151a9c3887ea252d12a87b5d53fc
MD5 851de20e719f2503515152ee61be88aa
SHA1 4b1cb5704693b80b9cfac376918f67182b0a2caf
SHA512 b14fc2c8270edcbf25602eba4ed069bfb0a56789a195be0c59ff6d63689a09ab808605ece9ed5feb1a4d94539fa2a38d1c0062d84d02593c7d477d1bb851888f
SSDEEP 12288:/+7d8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:a+jzABgioiNV99L5S1fd0b
TLSH
T13A65228793ACCC8EF2351978D458E51EB077ADB48B007ADBC391086A5DBADE18D3174B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8351ecc54556142d3822b348594278b73d8d58c1f118b6b4523926c08e5712f3
MD5 90423e056df93344d62ce41a8bdca935
SHA1 354a9bde4d0b186e4a02e873539f91e3a3e704be
SHA512 03025be4a1b0e4c2574c9ad0e1211e82667da1d61757c9207d19f27d15838aca0ba198b0f18bd4ef6f8595db2ac963b9ae648574b119040ac5bb94d378207e04
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYkjzABgioiNV99L5S1fd0b:vgb4mBIBhGFPjzQgilV995S1V0
TLSH
T14D659E1E22EC02F5E1F9D2B8DDAA4417D6B278160731D6DF0251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 fbf82f003a67d28c718409de0f24bc53a588f339efd5085c7b62ab3ae5acc355
MD5 e8bc7e44b2d5ec38f9899078aed5bbe0
SHA1 9d78a53494e1bba1f70326ebfb90de7c7aff0c83
SHA512 d48c405318437cce31d6d1629c08f5cafebf17230d7ea34d6a5a1775c1c3f3b2461b75b72dae7b6712da8d550e46b210f33f905ce952cd2907a6f11e773df838
SSDEEP 24576:kG88u8FpJqH1hzria7/mfjzABgioiNV99L5S1fd0b:X7ZFPqVoa7/8jzQgilV995S1V0
TLSH
T17C95F16667E001F5E477D138C9824667F6B2B8250360FFDF47A88A551F23AE14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 456a80d4f06852539a39966fc69783d4a9397f518004f823213c9b36d83fdbd2
MD5 dfc079472438b4728ccd9ec748130e51
SHA1 169ebe1859101bc546d553c3d29922b24ba8d41b
SHA512 be704b203c6897174643f0dd4e3c9e02a83cac890942c28ddfe87786631f4e88d3f2dfbff246e57e10bdc1e4d440c871239b063d6649f0d84167d437854b011a
SSDEEP 12288:9HvUrBFrEjwaQC8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:9PUr+NQLjzABgioiNV99L5S1fd0b
TLSH
T10A85E15F62AC1CE5F676A17DC581860DF772B8620311A6CF02E0817E4F67EE8AD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 30b2c18923be2a02bf88d7172913e8fd06e9038e2c16aff9aa73bc71d5461514
MD5 a5e4509c18c1e2f81a5b96e0eaef6ff7
SHA1 6f06a0317900ca83cf5f50dc911edf05d8100e14
SHA512 2b178df6de1c2880e03ac7138295fbbc9ba4143c56a6a10bf3082b0a3b5fa2750c06dcacde2917074b34faf711d112f57bbcf3e367086fc8ab665534ff6fa441
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbjzQgilV995S1V0:DG05lO43bSjI
TLSH
T1B2D5CF6A62EC01F9D1BBC17CD9C6460BEBB23825033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 80face19e5b3f51a9a25f59e5be0c83aafab781756f8e84c75fba4dc3e373844
MD5 ab83277541996d269e5bc2f6d837a4e7
SHA1 7eaf5720425adda00550bf8813152ea9e53cfce1
SHA512 6d1c0a2f45b06c857180170e8b1b6888a6ccf8ccbc3c26aad6ae8a97eabb65fa49a5a875bff7f3399c79f2fbc7a9ed7c79cb79c5ef0e88faaf4116ed6a3362f1
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnpjzABgioiNV99L5S1fd0b:Fa5POZ3+Jt2pasx2+mjjzQgilV995S1i
TLSH
T17065AE5EA6FC01D5E179D17DC583861AF5B2346153319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 29235f300e2e177d2da882bf11c8287986e977511cb8684519d98bc76ce05d02
MD5 87ce40c96cba6997105d8f3fda0e0fd3
SHA1 68c18ea8bdfca1a8322fd7e646e1a3fb95f8cd4d
SHA512 42e0c44341bca09212173f629418dbae5bb2494590ada0d5f2a6de70cbd4504cbb13e98489a4222375b9991dab0e983d395b4f925db52dc424f76307c4017b64
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FknjzABgioiNV99L5S1fd0b:BNc/zEOVHFcjzQgilV995S1V0
TLSH
T16E858B1623E901E4F1BBE1BE89779546FAB1786513309ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb625cd6639d38be2f6ab5e05fe8ab973133f02f02fcff63d3dc70090951eb3a
MD5 afb66a376af3f49e3608b4ecb59777d1
SHA1 46e4939f4b3970149b4e7d070e215e1e74182c60
SHA512 43840e01bc472957fa38000d2d3d8b70b2b0290a41a58efb762a7a0889dca65648b6911bee0e87a39ebbd7cd631a22ae8f48e6326f0b333884b0c517b2069a4a
SSDEEP 24576:M8kNvNnaFeYhJNtmZBmOjzABgioiNV99L5S1fd0b:M8MwBtOmOjzQgilV995S1V0
TLSH
T15B55AF6EB6B845E4E1FAC6B5CD238516E6727861073293CB8390C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 cdbe629b1415b11d9dd4cc4d2c331e3935fb1e290f8146dbe1cb08304c61b8ed
MD5 9264d12d43d83fda47befe6df0faa5c0
SHA1 ac854161db3eaa50c991c5a93b76811adbd069b3
SHA512 920b93920e275e5acc6593073f3e4b7cabb0731a106526e767bb9f31bd0394e18e7d3dc65589c685ea7ffbc785967696313c411240ec90098387fda4137421fe
SSDEEP 24576:uD3FHshBIYQgACjzABgioiNV99L5S1fd0b:uDVHeBIAACjzQgilV995S1V0
TLSH
T1D595F17EE75C04E4E57BC1BCD6638907E67238A9032166DB02D481BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-117-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/236-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/236-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/236-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1152-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1152-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1160-289-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1160-65-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1160-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1160-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1968-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1968-105-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1968-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1968-99-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1968-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1968-338-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2084-94-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/2084-88-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2084-317-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2084-89-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/3272-76-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3272-84-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3272-304-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4464-63-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4464-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4464-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4464-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4464-50-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4500-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4500-0-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/4500-38-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4500-37-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/4500-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4812-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4812-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4812-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4812-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5112-131-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5112-123-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5112-325-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5208-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5208-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5208-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5208-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5208-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5220-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5220-144-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5220-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5220-142-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5220-136-0x0000000000730000-0x0000000000790000-memory.dmp

Download