793a70c3dec5bba042b551f1dde7f61239e21d4ee122eb189fcb785f0b493863

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260819-qlrayavela
SHA256 793a70c3dec5bba042b551f1dde7f61239e21d4ee122eb189fcb785f0b493863
MD5 69dd4f211209aca90c93f00f3eee6c90
SHA1 d508017425fbc4d014bc397eaecc31c0b938d983
SHA512 293e2e68bb98c8dfee7abbef18af752d0ca5ea3c81b13abc40962697e477caa77273d49834287122b750c8a08b4737a354a44067b9b3d465005f5bfab6e70301
SSDEEP 49152:S7EE3hXd5NHfrPqx0AAzXfuyaU0CBedbQ/dBZchqmb2BqZTd/drwwQFB4Hd6axz+:bjB89/dBa5drK49tzTzm
TLSH
T135167C07E6B941F4C0BBD1398A579657FAB2785A877197CB43A0875A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4172	elevation_service.exe
5304	elevation_service.exe
3800	maintenanceservice.exe
4812	OSE.EXE
3624	PerceptionSimulationService.exe
4708	perfhost.exe
260	ReFsDedupSvc.exe
3868	SensorDataService.exe
5640	ssh-agent.exe
4400	AgentService.exe
5132	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f95c90465387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f19647abdd2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007da2b5addd2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d33333ecdd2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0d858abdd2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d7385abdd2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5688	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4172	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4400	AgentService.exe
Token: 33	5132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	260	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4172	elevation_service.exe
Token: SeDebugPrivilege	5304	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4656	5132	SearchIndexer.exe	100
PID 5132 wrote to memory of 3216	5132	SearchIndexer.exe	101
PID 5132 wrote to memory of 3468	5132	SearchIndexer.exe	102
PID 5132 wrote to memory of 936	5132	SearchIndexer.exe	103
PID 5132 wrote to memory of 4380	5132	SearchIndexer.exe	105
PID 5132 wrote to memory of 5488	5132	SearchIndexer.exe	106
PID 5132 wrote to memory of 3884	5132	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4708

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:260

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 441db5f6e06b028e8fb5a929c27a489e2456547f16bce2df84230f0527bdd675
MD5 546e9f3cea48c2e3c3befdd77e14f6e4
SHA1 f5db1f032c88bce44de5c508b5b9937b91c1a214
SHA512 fad613057ce45c8227567e33a809446e700d6823c697a201e8d66b1a6c6e6f7c352399c5f848a3db273fce8f4a4a9bd3f72db40c935f8d135b663c3d709d9590
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnswQFB4Hd6axzkszpw:03q6sjB949tzTzm
TLSH
T1B7D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 541cc37982627155d1e233b42422e6b397587713005cde2e9c2b7350e8a7dfaa
MD5 8197a15567d49f9ef75fecb3b3667853
SHA1 04abaca0eeebb2efad225e10216d96d8977d8040
SHA512 e7f547b45f7d526a4c6aecbeec25b79fd828561b2f925382aaeaa9cf865ad22aaf68fd6497ed932e0074cfbf0b8662cae5723e265ca5268a9f90f6b58870f21f
SSDEEP 24576:GXYfDtczAISwQFB4Hd6LausvUWx9BkszlXWy2v:ltciwQFB4Hd6axzkszpw
TLSH
T11D65022977E408F9ED67923DC8A28515E973BC5247A0E78B03F499251F332E85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 57b2576702dc358304d7e526167bbd91b6bf100526f5a7fc9c08acb65329adf3
MD5 8b985bcb351478a529aa13e204686da9
SHA1 ab4928acf23ab07d383fb754f13da7af7b754599
SHA512 879516414042ca6b2633edcfbf20b8ecd929dd32ce45a1fd955f6fe30ed264f6ee944e2ebe3a796de429fe0c8b87b1bc0962a334811fe07041d047c5b7c005d0
SSDEEP 24576:x0Le5ji0hmxxrM1SwQFB4Hd6LausvUWx9BkszlXWy2v:xPji0Aj1wQFB4Hd6axzkszpw
TLSH
T1A385AE16F5788375D073C0B9C5D2A69EED7130824B308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f4d0f697ec3e3910b562a2fa43e650ac1a6d5e226f8709309526dbddc14ad3b
MD5 0f84df46d1b2dab64699c434fe65c857
SHA1 7e82583f4c2ad83b5c7c9347d855aa87fcc17050
SHA512 e3a0434bfcb45d3f2e03e86ea07a4020b2940491c4afe94f1da1766f10a9310ca62e2e5ba4f3ac549d8c76a1e9cf764ec318f57269c2319f9b031291ff5a916d
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuHSwQFB4Hd6LausvUWx9BkszlXWy2v:+/ezSC6vUzPveHjyZwQFB4Hd6axzkszm
TLSH
T1AF755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0ae25d77853991caa4c026b77a6eefd83a431abba6538f7d44331454934f7a8c
MD5 df66be30d95eb30d50fb82ca706696b2
SHA1 55d88dec74fa426cdc6864edba5cc953da160c2b
SHA512 f5d42bf121cb20d024a5d51a400488a605bb0b68f3ed69f8a25bb5fae54221369eab815764e5c6f8fda1b74636c14ca1743e9e17785f695bdfdc578104f448ac
SSDEEP 24576:qVbqPb88hv/l+YESwQFB4Hd6LausvUWx9BkszlXWy2v:qVO88hXl+qwQFB4Hd6axzkszpw
TLSH
T1DA559E66F5748371D073C0BAC4D3AA9AEE3234424B31CACB1246D76C2E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 138c2357b5d005a79976f9e7a61efe6d3139907d63b4d5f8d1d72c7c2f992f3f
MD5 82c79d09d550a42c82bcc0b1b1d5dbe0
SHA1 d116f595d9a06e974e1a0cde39081550081497a7
SHA512 59ce4846b2fdad4f076d74c9c1fa14e69651c11cb9814bf2ae85365897e6bc6320c32681d53369c384792186146bf499570e56d5a39cb74b81d889ba917131b0
SSDEEP 12288:jLKTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:jLBSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1634523C2A57DB1EAEBD33333D09764FCCC8EAC238F94C60692B63A0995744B9D145987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e4323cb5245759eda8ad7f11d24e3e8d26a79a74fc96f97f99805029e3a6774d
MD5 f986f09a132211bbc7c8f3da933bc921
SHA1 96848e9985496be432f7ce76c01a879edcfc6ada
SHA512 ccf8e0279f391fdd6adf70939ad34f17a768a9643889ce0ce83798a9df3c15af87139c13dd9c7a4034f3759e36a999053d36c0831a33d7831d729be7cbbc4ef4
SSDEEP 24576:HJIUcSwQFB4Hd6LausvUWx9BkszlXWy2v:HJIU7wQFB4Hd6axzkszpw
TLSH
T11665DF3BEE38FCE2C27A5D7956918240D7A278314F6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eb8c8aebf9e9bdf815b434f02cda2b6db990d05875475163bd2612976b1c59ad
MD5 81d5e14640cad5896d2c838a49e2d312
SHA1 1aad7a0714d59200a96f9f00fdafb8799fcbe7c0
SHA512 7bc03f0d07b16b93e69640d32331bfccbefba083f98e6228cf72dece190a02da2e75dfd71d6bcc1ed8e9100667b7fe1ba352ea540a3771678b358e402c56dc08
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:UQvGAdlCEL8c/DRNw5Cg49tzTzm
TLSH
T152266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d00bf4ae95c45582e66cf095585dab3e8269d72ecdc4152f9b2cc458ef9b9a20
MD5 eb4591930384a253de6e3e6231bdc64b
SHA1 3707acde8fcfb9741ca7ebdf7619113a9aeceb60
SHA512 c2d6a51c9e46e53052f18d7b6daceb9fb3b4773b59cd24a0f07b9ee821a0668a7c2baa7983a3a49f623c2815c3a87ed1237ceee8d823a4211b6cdd6dd796b483
SSDEEP 24576:Z0ewsAjmSwQFB4Hd6LausvUWx9BkszlXWy2v:CljFwQFB4Hd6axzkszpw
TLSH
T13B65E031FA78E036C7BB0DB21B26D71A586DB9204F911AC3E3E85E8D59301D26376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a17c930edc452a97c7ae8ab73b3da9deab7ae2a28f574070793d4effd1c508b4
MD5 87c06a69fdfbbc1812c70f4e4b301469
SHA1 8566fb050f196b6381e42575d78c22698333ca49
SHA512 7487e53ad1eea2dafb3077288d14a14fc787ad3975414663b9b643d29ea1c1581ec855428fd1a5e9a8ede562f674ce59317c5305dc4078f36c041baffdf316f3
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHT09P:IUEtQevvqc2W1cpV2tI32T09P
TLSH
T146474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 80d71e68def378322d31c1494949a99efd6de0cbdb55bd7c1ac024de026b7dd9
MD5 4967c03c92bcaa1489ef2b0c49a0fada
SHA1 08b3ab6c900b455bbb159b0f3949c5ebc049a4d9
SHA512 001f5745898e0988b9c867cc5a27e56a2397183e4f2ab42abcfe439833cb3ced9e5fefa69133ad8c538ba8665c1cb6d73e0195fe9d909ebb3cb567d383c869f1
SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/zlwQFB4Hd6axzkszpw:goqtVjnmk49tzTzm
TLSH
T141D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f833b08303a0b8576d75ce98ed601a3ce50bd1d175b61ac22e42289722f10651
MD5 cb4695a905857a1c77be84fe4e11a3b0
SHA1 ec5108d7c2bbce8a4235b9aa99d10c8a5bcfba5c
SHA512 34e7680ae1fed14bde632b49b7060b84d66244db0daf608d06a1df2fa6420bd03ea1eeff7c2ff3fbe750b8bfee5389734a1bd452dd109df005c967e343a9215c
SSDEEP 24576:YAhGL3IFoiwtA5l7S53LSwQFB4Hd6LausvUWx9BkszlXWy2v:YAMUFoiq5mwQFB4Hd6axzkszpw
TLSH
T1A5359D81EBF955D4F5F3AA7899B69170E976BCA65E31C20F2160D20F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 25610d5007b5f5d736f5cb212add6c7d1576432eca4eaa2bb3fa384fdc2fcdd3
MD5 65ee39693d9053226e51d4d32b15d1dd
SHA1 bab6b89bb433fb53fddc0fa093c722faec2b2050
SHA512 fcaae1cd65d475b7a6fa7168446a55833d63cbc049e7ceee06ec1b2093d0ceea04f8610ea691df1a3539d7a34b19f2a8de773f81cab8a65825a7e442d97ed6c8
SSDEEP 24576:Awu4OWKSwQFB4Hd6LausvUWx9BkszlXWy2v:AwvOawQFB4Hd6axzkszpw
TLSH
T12365F14676A91CF9E9A75239C557C13AFBF2BC122A21C70F1360C65B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 06d1a9cb51932517d9f35a4284639bfa2d7c417bfec362ccf97f1f6864cb9cdb
MD5 e7dcb40f163e1ee49d7304d214f7e876
SHA1 d0c319c197c5916b4d7928531276ccc077748512
SHA512 1794fbdbf6cdf3502fd8bf4042c87e3469eb60d68925ad338e79e0db29b3b00002f3a1958b91452fc3bd407bdadb26152184ac3099ea3a0643ef9cd7e714f11e
SSDEEP 24576:lZuNSwQFB4Hd6LausvUWx9BkszlXWy2v:vwQFB4Hd6axzkszpw
TLSH
T1DC45128A32FC30FAE2E3623AC4E2559DDBB67823477183CF126502591F329E55D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f4073585c4376f999f498bcaeed8942b776bd6da9f8c22cf8727ee197528fab6
MD5 6a646efa55e695e0083a6ebd6a73015d
SHA1 df6440350a48f4f3eff43900a7a9aa2fd288dbb9
SHA512 6b469eda04b3ff89b5f19bb3ad04678caad97619ca336cfbf29e7ee2a5fd85f3ad8ed6813be4d6b77e688a036b6fe75b63090fbb55acf84e4115bfb65af2f089
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3Z49tzTzm:NQyiKa/X+PNJ09P
TLSH
T107667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6cea9c19082f5799ca5f38066ec7e516fc65f6aeacdddf8238766a111f071099
MD5 cd1d07409bea4e0484666355363679fb
SHA1 5d444a482b6951385a1eb7543fed76893d333347
SHA512 3533725d36ec82201b57cceb895cbd554b49f785a1db83105401e43dc0a5cef15b237fb9caf398e88acfc384028e7039cbeabab75e74b5ffacc1043a660b128d
SSDEEP 98304:VQRQyi36YOcPbLvw2gAf+PN3Z49tzTzm:sQyiKa/X+PNJ09P
TLSH
T12C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6dcdc15004022183b3669bd76a9d37d62f2286b3402cf966c3ef4f5b1f706dda
MD5 0169e55441ff70ea76af1c07779e0fc1
SHA1 0ac66dcf16993d8751ecdde9492390155b5a8d76
SHA512 0e053f541fb2011e47709a2a430cb945ac5b0d1a48ada104f0c9d99644c099e3e35a37fcf3384f3dc8057dc97fd8fb83685956ba68bc7518af8fbc39816e470e
SSDEEP 49152:s68Qg55nhceWu7PNU3/1wQFB4Hd6axzkszpw:mthLRc/749tzTzm
TLSH
T14FB55A33B2F600A9C44DE1769F4A973196D27C758FE0E3DB815172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fe9f9fd212ece0f6bb0fa71504fac6eca13e996a887026c4b291aaaf686d5270
MD5 0bbdb57e52491471aeb12a32bcf4829d
SHA1 770c18b646937646b210dfae0b7a8a6917acd441
SHA512 d4899c9b27ebff895fc90c5ec8d35c3d8f9a5cf82b105cb570908d50ce950fc8aeb1b3e412b42bbeca8437b8862425169cd11c09b3b4cb6da40e508dd784bdd6
SSDEEP 98304:my5112gYy5azzVvt69nLKnhZe49tzTzm:XLIHEWhs09P
TLSH
T197168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8dfe95d6bdfba45d91c1dbf8a92c4abf110c85b2bcdada822886f4dc2ed5b68e
MD5 4740eeccdc5fce9c1be91c1afd0c9462
SHA1 cec81c1fad52e98fa23a5816031e0977cc19ecf9
SHA512 cc92c67fbb83a358e52bc618c0a880f08447eec7662e066ec309cbfff8cb6a23d9675f2210c04be196597a62f776edeb6a65c416efcba5259a764ec535785979
SSDEEP 49152:jB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glHwQFB4Hd6axzkszpw:Vu6Jmdxd2dx49tzTzm
TLSH
T18AD59D13F1DA01E8D06ED179974A9233E962BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 99adeec3e269f5928b2f2b73a861d6897db642f67d13fd4fe6f30870be6eb253
MD5 d3bff91feec27be4a4f5586ddc8fbfac
SHA1 a26c39b1623a85193e7357019484106ae55eb48a
SHA512 0ef77e224f431fda27643e9a2ba8dcd25ef9d99feed6bdd6a3e7583c0c5b80fcb2b8aca6b6cb899a7c45f984793985b49a080c3c832d08473d90b539cc6ef0e0
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xbwQFB4Hd6axzkszpw:smifPWRk49tzTzm
TLSH
T154B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1c65e7924a4c33288b638fde2e03b436b665fac9b177501201b853b63926572e
MD5 03a88f60265e5bafe51ca458ab19bb5f
SHA1 65f1c9d47a58f89c28b2d7c8fce13cba65633ebc
SHA512 f032c9a9c71aac4bc990115438c71a5e3e30e5fe2d607632e6827d305b8ce08c305f9449154cdd2aa02e53875159cc93e6d4c0e45e7fc89305eb4da4802542c3
SSDEEP 49152:KSuZQIY0Be2KcRVtOnks6NMHqwwQFB4Hd6axzkszpw:U5dKii61K49tzTzm
TLSH
T122C5BF03F2E940E8E0BEE67487669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f776abd0d7cc3271f958459c23d41cbf04e25027e9f88336d67949eff6c95dbb
MD5 50608336f61958d72565e7cc4b1c03d2
SHA1 2ace89ea98b4fa8872b6ddbcee017a3910766e11
SHA512 d8c7fc398bb277c6f742123b7c5890705001d60688da46bcff4f08ac1a9f94f8aed33dcaea6d772a9e2de12b4fbae84cf44fd13f53f6f9d3a21b98f9f8719605
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5w3wQFB4Hd6axzkszpw:vX2imphI49tzTzm
TLSH
T11295BE13F2D900E8D05ED179C7468632E962BC160B38AADF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 015e32bc936791a5d4a67b551d7fe82ad04e155792699a673b95106f82d79c76
MD5 72b077939aff4af54329d7d7d2b5d6c9
SHA1 590a9837ae74e58b0e9218349803d3c00e86d645
SHA512 73751c31053e6ff8e459b254afac1285ec5a966e3991c5ec8ba127de5b18993f9b0e41c0673f5f106566e24fc8b00771e2f9ae7e890cb85fe71edeccf0e7c9b7
SSDEEP 12288:KSTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:K5SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1154523C6B57EB1EEE6833333C05754FCCC8EBC278B95C20BA3AB360596744B9514598A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 0fd4051beadf663d5f3dee034da9c5dd352e791156349c5f8ac2905e346ffd01
MD5 918becd17150e57cc6985989a1b9c228
SHA1 f068c9498388b4ab65f34c6a1110cc5c16d301c7
SHA512 077f59cd8c0a79033171ab2bd366878f2f7c14f06888c856f13004d4bcdc2e700bd90cda1130aee8d39b850397aa3aa9b3a36a0c1f1de563ecfb5344f5c20f69
SSDEEP 12288:CdTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:CySwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1C44523C6B97E71EEE6833333C05754FCCC8EBC278B91C20BA3AA250596744B95549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 f0252e5cceae2d572d704a2c9145ffee8b26e92a43c02d6cfbcf011116790ff1
MD5 190c9b1739fbc804891c71150b02142c
SHA1 825f5736f209505a345c4be9e6688526c4cf49ec
SHA512 9ec108d32a255e61a3320284b79cf12cc80940351aee26867f0bbad1a7eb560846f26b25beb21924a69ddf3a194bd136672b34f4fa0532aeb31a8b1bf824a2b5
SSDEEP 12288:07TUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:0USwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T14C4523C6B97EB1DEE6833333C05754FCCC8EBC278B95C20BA3AB250596704B995459CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e3b99de9e089765afabfde16a59a69d9b69a18d12c5c44e5f9ff2d6c9b72b5ee
MD5 2ac51f01b7358cd20bf2a7a11020722b
SHA1 972a4a7460d26ff1d31da04f8ed23905d5462c5f
SHA512 620d6e180a22a1bf6e1a450a1dbc594cfe8ef328752b089c415eb73b206ff9c72599dd33cb195638654c0b5702d98b45c2926c990251380e9d66e101f91409c6
SSDEEP 12288:oVQTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:USwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1DD452382767E61DAE993B333C06350FCDCAEBC638B61C34F936216095A705F89525F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 47e75f1b2d3593ced562a6a045b7390cd6b8c43bd1ea055c9947a39eb0d81dc9
MD5 3f5c17c6cb3a4c7ffefdac41600bc819
SHA1 b11a2662ed12a50f0c1e0408a2195e060f0f2576
SHA512 7b8ea7b24777faf50b5197b2a6e0194f209460a00f30d3359b719170e621b840f974114e27e534e2fd8a5a27ae70ae96338f944e6cc926a8c7ae651d07eea53c
SSDEEP 12288:JITUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:JTSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1BA4523C6B57EB1DEE6833333C05754FCCC8EBC278B91C20BA3AB260596744B955499CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 ede5191fc2cf0b22f46f6bd4b3279cd7823c7983e45219989f426293658aaef2
MD5 9cded75f9b430cd8b045bc80a9e82bec
SHA1 57342df808bcf818453359685ff6a3fea8128d86
SHA512 dfed258ef010517745f45876e4cfa1cacaa631eb63dbff7d6424381ec44666a7400d8f096befb96518ae7456eb480739d9fcae879a343281c84d09e1403cd404
SSDEEP 12288:RBTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:ReSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1684523C6B97E71EEE6833333C05754FCCC4EBC278F95C20BA3AA260596704B95549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 ba88284b5fc3c77e0ba91277db5e3eab47f68cdeef95f5e4baafd7e7bf1c4518
MD5 e9cc0e7116551d89124bb3609a3cb677
SHA1 735218bffcf0f1ed6b454c6387e6c05432284f24
SHA512 f8198fd6af27a0fa058eb7335fd0acf8c9d692e9e39bec92ce4771d219a9a8cec15e19a0ece02b24058f316ca262b814e091bca6a6a032ab1a459c4584bf64d9
SSDEEP 12288:Q1TUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:QaSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T13A4523C6B97E61DEE6833333C05754FCCC8EBC278F95C20BA3AB2605A6744B95145D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a107430044bc160e08cd6941d96b1c11a8cd6319dbff058aa267ce286adfadc6
MD5 ca8ad672df2f861b5e05358ea50f4aaa
SHA1 c45fdf4968cd9caadfb0d38cdfeea6680b2feff0
SHA512 3ae15c10e809f6e66a2b69db342f97bb93bfc0ae49be893059b384a33afd81b1fdc433cc4a598d2395092a5fb0588942fe7ae676d2e935df64f8af54d672f5d6
SSDEEP 24576:XZMRzFVSOSSwQFB4Hd6LausvUWx9BkszlXWy2v:XZMRzf9wQFB4Hd6axzkszpw
TLSH
T18F650295B3A418F9EDA3823EC8568959D5B27C1A0B70C60F13F436265F333A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 a586977f5efc4e99f2852de50abd51bcb9b28549aff30485bc54117cfb7c3f33
MD5 d97708afdd015412605f5cd63b465038
SHA1 8633b34d213b1e58023d795783dc71035b41e2f4
SHA512 3a188a98442efafaec75e760a5e8e6384eb4c99fea842e739ee9887cca61fade36da1ac8aa899489e5643c6549e25803c5bfaf51d66d33ffe0b722fc56e7f7b2
SSDEEP 12288:weTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:w9SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T12C4523C6B57E71EEE6833333C05754FCCC8EBC278B91C20BA3AB260596744B951499CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 f5dc7ff005f7f44c109d8a185ed8ddf0d6246b2469da17e7a6d5aafe5b155915
MD5 b4ab50cd13796044e6bafe30e464dfa1
SHA1 3b10cc41b04e6c468e874a16c0b774c129f3ece4
SHA512 b478edfd618a0797cfe802a57e8144cc7dab241c41cbc0d579c19e406190c294162e6c5e3214799d812118eed9c310a21a1960d641dea3549a656a45111c7db3
SSDEEP 12288:N6TUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:NxSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1104523C6B57E71EEE6833333C05754FCCC8EBC278B91C207A3AB2605A6744B95549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b67695fd336009d341847afe644125532afc60d7637602d3ca17cfeb87def3af
MD5 1c9dfc70a7b8d32462171ce5d8f8d4b0
SHA1 960aa168eda3da76bf36214cda256899d8720a0d
SHA512 a022f8c52454dfe4acd5fc8addf6b2d046977a601aecd2c86e05962624a4ac36158376e131993665500e5c0b68e0bfc64584642d6503f793889b26b2bfd14d75
SSDEEP 24576:hzyWSwQFB4Hd6LausvUWx9BkszlXWy2v:h6wQFB4Hd6axzkszpw
TLSH
T1E055024772B930F9D1675235C4A21959FB76B8334B608B8F53A407362F336E09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 3aeaec2e9e71f7a9c30e86178b40efdc5bad2eca7801f1ae8a00c7f99c76c5b9
MD5 225192229425a82ec68b74d4e3271a10
SHA1 688e0d39489a39bb20b0de2e90a20982e466837b
SHA512 7b19b35b5bf3611fb04f8e41454534ac9164116ca9ef698f2f0fd81de1fe806064286fb7fb71906c7fec18b3338e548f9177c07b997c3201434eedd3cb730114
SSDEEP 12288:yeTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0w:y9SwQFB4Hd6LausvUWx9BkszlXWy2vw
TLSH
T1A74523C6B57E71DEE6833333C05754FCCC8EBC278B95C207A3AB260596744B9914998A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 e3f3a7d013b3aee5ffdc0764421198dd0af03ae427be05a95d339760d7fc05f3
MD5 bf2c3fe9c216fbb1f63ec8e459ccff26
SHA1 3dc19952a603b9b4eae370bf278b901acc86a2d6
SHA512 fe94e402ff21313d372014e688f02bb7762f01d59b1fe8085bf46853444fd2bb80aad858b7b823aec30c13f4872713e542a65904ad3688e64c164c9c6382beab
SSDEEP 12288:beTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0w:b9SwQFB4Hd6LausvUWx9BkszlXWy2vw
TLSH
T1674523C6B57E71DEE6833333C05754FCCC8EBC278B95C207A3AB260596744B951499CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c65cc6ef1ea19b0623a9b46eea65c0ff8509a30f956775c1a7caae3b54a045e1
MD5 9c8b8256a6fe7d632dfd190fd493500d
SHA1 8a1953fd75f7e7fdd9c5ffe7b7cbcfdacade14a6
SHA512 2b0f2be5cf477b835ff60fbe80ddb6af57ef62a10710700d694f1752e7dcdcae139b77e6e85e727704f822ab24167d4d08cea0960ea02b72d3449ded55ce01df
SSDEEP 24576:7zyWSwQFB4Hd6LausvUWx9BkszlXWy2v:76wQFB4Hd6axzkszpw
TLSH
T13D55024772B930F9D1675236C4A21959FB76B8334B608B8F53A407362F335E09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cfd306c339afd735957d40274197907d90b44183cdb0a7ab7d57ff1e3ed9aa04
MD5 075b2040f988dbc3d6e1999eadab542a
SHA1 95255da58710483743005ab848b0445048cbbfe1
SHA512 9b37361cc4901c3cc35f66b25588656e3ffb11b35da177d1807f4321624c95d33567c9151770f4cb3e5a57b8eb0d30b048802fff44ee499216b12f94aeb7fa2a
SSDEEP 24576:JTDaLl3z0zDkSwQFB4Hd6LausvUWx9BkszlXWy2v:JTuLljywQFB4Hd6axzkszpw
TLSH
T10E650295B36418F8ED67823EC856895AD5B27C1B0B70C60F03F4361A5F332A15D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a2cdb9d1cfea37f9a06d1634dd35a7ee209a6c37df8cd96a85d10fc679968769
MD5 0ec1638e1483cfbbdf5badabbbfc49b1
SHA1 5238c8526743d57fbed4ddcfd40814caad38dc92
SHA512 4fbdf784115e4044138d815fbb2c64f4ddb3d21cd1c8d89a635f4f2ce9f0cfe4150cce4f33a32b7c1ae50025bf74304a18983d37423a81a397000a6cf55e4915
SSDEEP 24576:L3vd9CHKy7GZASwQFB4Hd6LausvUWx9BkszlXWy2v:rvd9CHKya9wQFB4Hd6axzkszpw
TLSH
T12D75D090F3E810E9F1B79A35C8765511D9B67C5A1B71CE8F03A4261A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 f7411bd7716531a5724ebb5036fa4f41e5596dc9bcebf19d0474be62bbe5c40f
MD5 dc626e0a437a07ed30b8a140e0be1b2f
SHA1 71725ed929a6c4226bb616dbb6a4a24789baca08
SHA512 6a9f26acb0dd1e333b9785fa168e6f838aa22044962c4bfb58f963b0755fb8f0df431baa7780c46460ba2e8ef749799000c870ea539f80f651e6938c016d9196
SSDEEP 12288:ubTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:u0SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1224523C6B87EB1DEE6833333C05755FCCC8EBC278B91C20BA3AB250596744B955459CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 08e63b05dfead8babd682be2a768e49749eac9858c4b196884979b5c32ed3b10
MD5 2d1b5374d711fc1c841708157ac6e3d5
SHA1 e48358291a1b57c99cdea1beb090f3dc266db493
SHA512 00362e539d73883fdc620f4f15fe3eb220eb296eba9c988e7895570b27139b56a4d6cae8e1943253b7a11bfe9d15f9ec1959f1856118c99968e3effcfc85ac92
SSDEEP 12288:oJTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:o2SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1504523C6B97E71EFE6833333C05754FCCC8EBC278B91C207A3AB250596744B9954598A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 76a7081eb22f443a5685dec6768da9eadcdf54fe1d24cfc279cb32732a92db88
MD5 ac40feda63abe02ec880936e973b07c3
SHA1 f50f9ea84487d11495e10b4f68ed8f16f7dd2bb5
SHA512 02d1217fe7f8a622ebb3dadfc4e6c11ecdb4b894f7bca5eca9583678acf0c899f1b064441fe514732b13e6f559bbbaedb8fec7a8cd57e1591dd562a03ab82e87
SSDEEP 12288:kcTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:kPSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1784523C6B47E71EEE6833333C05755FCCC8EBC278BD1C20BA3AB260596744B9514998A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 3c255116c0495070a6d8b2416ea37517bb06d49eb29d7ecaee1369038a80a403
MD5 b5757030cd21370df2fc1fc170bfe9c7
SHA1 73459676d0f2dc2ae4fd01d8a545f91d2fb5361c
SHA512 6e9ca36cdc0394c3c19ef94b17a8c4500c1d9957a0f6fe1ee69933d2063c4152f7de814e862f3da1f6ef710af7e6a8803941ff6b4f1914dae578359dd61626e8
SSDEEP 12288:ZeTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:Z9SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T13C4523C6B57E71EEE6833333C05755FCCC8EBC278B91C20BA3AB260596744B9514998A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 1d428784ae39d7cbb92a10613d8709dc9f3adac33bf6953b6c1e203b53e533b3
MD5 9cc05fd2d1fdea07adf1d88536ff68d8
SHA1 b8d8d30599e3f2e74e7f927e9a2e0d47528720f1
SHA512 48c008afe402a17c95a0044ae3f99342cd60e010c30b0c7225aed1191b3763afba70f39b8490246445614f6641dda8da22d203070f02c75d43fbe812f6c53d42
SSDEEP 12288:2bTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:20SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1124523C6B87EB1DEE6833333C05754FCCC8EBC278B95C20BA3AB250596744B991459CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 7b8cca5e786224c0afe7fafcac65a3ce2147ccee94c98c99754ef091f8d14f73
MD5 cf052c88eb4b324440144c417d5e124c
SHA1 bf72319bd2ef823c6f2a7cc3453770b7fee3c543
SHA512 25fde923048c847d1eccc271dc2a2b9079a1aef1437183ea12f052bfdf178c0059703d9555d65783a6b513cacff0c07b95081e75a00f4cc9f795139a36c4a676
SSDEEP 12288:3WTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:3FSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1A94523C6B97E61DEE6833333C05754FCCC8DBC278B95C20BA3AB260596744B99149D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 07bc1132ae2a9b83ff5e818f89e3382d69829dfdcdbafa0e84b158ade8405f80
MD5 c0815136c53f0d5415cd46d2c6720ba3
SHA1 ba29bba71204bcbcea045bbaf69038bfe832beb2
SHA512 fde7b4484f69fafa327eec18bb6048f0960913201664304d9b9097505100f07c6cf10ade50c7d17b967c81f356289c4c1b078f99a148cee61097f852274ecd13
SSDEEP 12288:hITUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:hTSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1984523C6B47EB1DEE6833333C05754FCCC8EBC278B95C20BA3AB250596744B955499CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ca5ad07c934237e7f346e7fc67b5f2bc25b2848e115a423dc709ead42ec62cc7
MD5 1fe0d31b832b99d4620a6c12b6bbeeb2
SHA1 dbe263d0f8c240ffcbecf6128fcfe8a507f9f091
SHA512 31383e8f234d3348996364885b363584cc94e48ea00ba78acd81ae9b964433e154763a02b272a203c40d7377599de99623e4599199b6476306cca37840f7f08f
SSDEEP 24576:RfwvUk9RX6wkyAIhSwQFB4Hd6LausvUWx9BkszlXWy2v:LMnYIkwQFB4Hd6axzkszpw
TLSH
T19B75D029EBDC44E5E1B7923D88B7464AF6B178690B31C2CF129A536D0E33EE45D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cb72fd21a71f7e4e2ee11fdea4bcc4dfbd33da4b19e12f65a6995d8857004e97
MD5 b78da4f27c2875a08656acacee7d6295
SHA1 280fa385abd860b8f95239db24761b5a475074c8
SHA512 ba1a5f2b9d62d7c7f0d0b26d2c99115460599f89431f106f9a9a64d550c513985e9ff1ab34d1eaf91d0edfcb2475965a2d7e40439b2fb0a87d896477a3b7024a
SSDEEP 49152:xYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XwQFB4Hd6axz+:cySzP549tzTzm
TLSH
T1EF066C96A16C01D5C1B9C1B98B1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d9405bc13c534738e7d63a4f74bb27d33084321b9a4944d67a2461c692723c6b
MD5 e016dd392b4a6595cbc5cdc395821294
SHA1 6d75fa3a212aace1d893c641cd75969f6775a657
SHA512 268c96661c42d5fae9f493ececa9a845e997013b18edc924058b11ed6cc79b8ce2e8ffed37bb837fe8f05840419cd338e339284d9e09a03014a475c81be815c4
SSDEEP 24576:747Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYCSwQFB4Hd6LausvUWx9BkszlXWy2v:747JUQjTirIhCnDHUPfF/nwQFB4Hd6aI
TLSH
T17365AE1EA3EC01E5E1BA923885154A5AEA71782E5F31CACF1270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2d2081384b70729ab450b4aa39fb17f70b31964b3d519570f477bb272e6d9722
MD5 7a804acee9ef8764dba39e24c4ab1b9c
SHA1 83ac4e61c89645e870822bfc06931876fe45281a
SHA512 99420e980b5368d71ea6f7e92dec3e4b8c4a10b98fbf3db926311cf8ec17003def3d531d0abeab9440ef094d4a6e8ebcf2da9744ea4ac045d3099abce231994f
SSDEEP 12288:vbsfuTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:CNSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T19855014AD2A812E9C0AE6236C3564694F6277C2687E1C3CB53D0F53E1F355E09DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 dbe42d508e2eedd91a32437bc511566d7ab294f67a3950cadec5628875eef435
MD5 ed1a0f047734bf3bc333db2d4e929aa9
SHA1 045cd845366a0186c972bbc843fff2885ed83362
SHA512 b24d867db6a57a9d8e769dd3f186172c093b3d7637c08527accc29b46cb991c254eb13fb6188808c4465f7f581c74cda6a55934c0c0f4bf00e999bfdd8db1523
SSDEEP 12288:HAEPTU3fLihXH/Eg+YUHbgImKtuYs47OUvZX/Qr+BjCIY26:HAEbUPLE3slPU07HvZXIr+BjCI1
TLSH
T12C350641762AD78FC6A940321E37D6CCA7707D01EE05AF1773C8873FD576668BAA1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 780KB
SHA256 28a2e1ba30bee9d0aafdbfdde83e1b6ea1fafa216c4a9165f7512286ad45f21e
MD5 146881c76cf03d7e0f3b7d20e9df537a
SHA1 9edfed47b6f6fc20d099c5f126ae1d17a87d1b93
SHA512 31ca728b923a7fe417b8d39cc26746c086faa9f18a0cdc2bb577f28fe6c3fb7c6d3aa7533fa45b4f5c63e9e285410767a29099071ae12b6eea5cbb362a7e0ffd
SSDEEP 6144:kJqt+8SZo78h779IUHJooIeHxIjHKGjH8Gjk/Gakljb4xHWbSnS43FwLHw1Ftack:kJqt+8M5Jrvx0Ke81/qC3oK3NGrO+L
TLSH
T1660528417177E70FC4FA50331336D68EB7A4AC16B64A3F1573844A39D85AA2CB9E13E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 d8b6986598e8089afd50ebc6503191b013a0d17ecdfd62282753d6b6b385f811
MD5 fa49cff1cf8c663511767f347f5e72dc
SHA1 b38ac1db35669676cd1b5e431a5cddb42785679e
SHA512 efe5c616e61d2025c868fda6e1f736333ed4c495d2f34a2bd8dd1589c8e2fbb25df11d512363e1ad9ff76278505086115638092703bf620e331d7b14282e3297
SSDEEP 12288:dM7mTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:WVSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1FE452382A67DB5DAF5E33332805B90BC9C4EBC374F90C287E256260995708F49D75E4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5ace45ef9f2b16452b883903941f30cbb4ae588ad5a68c101031fb3a3eee7b62
MD5 c4055cb0da8301984877a36f42fd9654
SHA1 12c9430ddc03a134b42991fbc4240c6137b61517
SHA512 64552a22910dcfcaa1962c4c11de370fabeae08f49edf28e755002e29f408052f8e6b062a0a16562c66637a60269f049c9935dfa284f255e9402772838c091a3
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYHSwQFB4Hd6LausvUWx9BkszlXWy2v:Mgb4mBIBhGFhwQFB4Hd6axzkszpw
TLSH
T13F659E1E22EC02F5E1F6E2B8DDAA4417D5B278160731D2CF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 988bb5ffac668652303d5c02e62009e6f4d3738848d756445b8d2d94ac5eed09
MD5 2ec1884faabd7112f3faf9f73fcb600e
SHA1 dceac7dc37986479b6ad6571e378163ad9b90aeb
SHA512 c42180dca5a01f329cb7df893662879cd7a935dcaeeb9c8b6bc98cacf9e3c5414804704da6a7ed21c42ee96627062bc7c7f92a46af436f7259f422f055e45120
SSDEEP 24576:GG88u8FpJqH1bzria7/mSSwQFB4Hd6LausvUWx9BkszlXWy2v:N7ZFPqVea7/qwQFB4Hd6axzkszpw
TLSH
T1CC85016576E501F1D477E138C98246A7F5B2B8220360EBCF07A88B551F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 25ca09a027d8dbc33509a54126494b997e80672406d7fc56891e475cc0b2f609
MD5 415ef7125c8a889b0ec3249d7e62d576
SHA1 b5a022ed4d1a01d9ed68f5e8e18f6b96f45c8967
SHA512 cb50407398d676b83858bb04b8a2c4654389da4d2151a266bc26f546ed4086243f9d451750d950e0c2bc0bb9dae3521bac45eb945d0dc670e0e8312293faea37
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtwQFB4Hd6axzkszpw:gG05lO43bG49tzTzm
TLSH
T134D5CF6A62EC11F9D1BBD17CC9C6460BEBB23825033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 19b022342cc688d7c4f888b68b3df9eeeee436185300d6cc59b4a07d37d36d46
MD5 590a425ff4fb5c0a2df49014982adc7d
SHA1 12ffcb3846546385850aa96db599ce3e8254d3ff
SHA512 8baeeae8b31952166b4c1edce7659600b64582f39e4eb4f4757ef1743cd763d0ad3ce8977e7d59ff4dcc3e1ea1bf1c95bb158c8b58602b96efe653ea1674a15d
SSDEEP 24576:Tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnoSwQFB4Hd6LausvUWx9BkszlXWy0:ra5POZ3BJt2pasx2+m1wQFB4Hd6axzkx
TLSH
T1FE65AF5EA6FC01D5D5B9D17DC583861AE5B1342253319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 74a5f3702138131575c601569bab1c23e9b5f3de88b95f0b7157c3d1d0c0954d
MD5 64ca8d949146360911f6f6de4051654d
SHA1 2ac7e3ad78a68efed93d23f22233bdfd285f5472
SHA512 0ef6b70039a52afd62b7c4e4cc4c84c69a20bb7aec9ab043d24a654d8a844d4a5a23383cf0956aa792a9a8fa8581e30f2b346c2c51ad1850c9046c9670c7885b
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkqSwQFB4Hd6LausvUWx9BkszlXWy2v:7Nc/zEOVHFKwQFB4Hd6axzkszpw
TLSH
T1FF857B5623E901E4F5BBE1BE89779546FAB1786513308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7857255a1b13c915f698275c53463dabd6006cb989e63ddbabf4af5a3d494362
MD5 686429a00bf1d69b54b20d6d39f377e9
SHA1 5b9216116d06c8473f77c8591af094162b7e3824
SHA512 4a51b917694300e761d5eac1622e70df591ac1b98e19fcaf1be3427280f1d3edc67f637b3b81e4885126ba2b16f3159c0f8184d8eee4a94b71215102dbebfd47
SSDEEP 24576:KTkNvNnaFeYhJNtmZBmMSwQFB4Hd6LausvUWx9BkszlXWy2v:KTMwBtOmLwQFB4Hd6axzkszpw
TLSH
T1FA55AF6EBAB846E4D1FAC675CD238516EA727461073293CB5390C13F0E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c527f27f23ce76f9f2a4f5fae0c1e4cee60f6ca20ae32dc05c96af2d1d23927d
MD5 e7c8d6eb27779080c3a7422e849f8541
SHA1 bf9c4243bbd17e506b32d41e3009c8b706e51c20
SHA512 135b5d70d30a19ebea567ab2f14bc5ded77da1d0f6344a423b51bfe9f8a34ea4bf8f1e47e73d246c4e665a932c8a66d074b27f586533472ace2c3bb688dc7bef
SSDEEP 24576:GPUr+NQOSwQFB4Hd6LausvUWx9BkszlXWy2v:GJQ9wQFB4Hd6axzkszpw
TLSH
T14C65E15F62AD18E5E676A13D8582861DE672B8630712D2CF02E1813E4F73DE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 eb9e6b2c6e300979c238f65713784bc692ff711a37a23ff6fa07153949abbecc
MD5 671175a7dbf6aa19be6320e012021bc6
SHA1 ca70901053212392acb204ba902338b6a19889c9
SHA512 65ced25c762a67f771cf685b53a87d7cf0894c04ffd01e02c0ea9f0610c630cdfeb358dc4d0cd68f6b4c03f0c40420bbf252a74eed3039d8f25b1ede135f15aa
SSDEEP 24576:iD3FHshBIYQgAZSwQFB4Hd6LausvUWx9BkszlXWy2v:iDVHeBIAAswQFB4Hd6axzkszpw
TLSH
T1C975E17EE6AC04E4E57BD27CC5638906E67138A9032256CB02D481BA5F6BEE47D3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/260-339-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/260-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/260-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/260-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/260-105-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/936-337-0x000001D2D6110000-0x000001D2D639B000-memory.dmp

Download

memory/3624-317-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/3624-78-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3624-84-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3624-76-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/3800-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3800-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3800-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3800-50-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3800-63-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3868-111-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3868-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3868-323-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3868-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3868-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3868-117-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4172-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-23-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4172-16-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4400-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4400-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4400-147-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4400-143-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4400-137-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4708-319-0x0000000000400000-0x00000000005BA000-memory.dmp

Download

memory/4708-88-0x0000000000400000-0x00000000005BA000-memory.dmp

Download

memory/4708-94-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/4708-89-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/4812-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4812-65-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4812-302-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4812-72-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5132-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5132-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5132-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5132-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5304-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5304-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5304-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5304-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5304-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5640-125-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5640-325-0x0000000140000000-0x0000000140261000-memory.dmp

Download

memory/5640-131-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5640-123-0x0000000140000000-0x0000000140261000-memory.dmp

Download

memory/5688-33-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5688-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5688-36-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/5688-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5688-6-0x0000000140000000-0x0000000140411000-memory.dmp

Download