b74d9fd57878d6f034cfc7a4f45a101e4b227f44f15ec2b8da83325e500e73d2

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260826-bb81nsfp7w
SHA256 b74d9fd57878d6f034cfc7a4f45a101e4b227f44f15ec2b8da83325e500e73d2
MD5 f9c4c879c0f779654d315c23c5538143
SHA1 dcadfb66cbae8fd070e4e142ece710d6079aef28
SHA512 0cf5927741eecf08c86755ebb886dbbbb27484415c8022f6a4f23c4419a0e67d65c9244c8cc5fb13939e9951bfd65871ce404ac3863452b934eca817c441f839
SSDEEP 49152:8ZTJmU+NjEt8LOX/8o9j2FNe7+QgWA7W3Z7I0cqe0cbyB4YTr9GCDmg27RnWGj:r7dOZsqJGCD527BWG
TLSH
T123267B1BE6B941F5C0BAE1798A979517FAB27819873197CB0390475A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4912	elevation_service.exe
2148	elevation_service.exe
5868	OSE.EXE
4456	PerceptionSimulationService.exe
5740	perfhost.exe
5792	ReFsDedupSvc.exe
5720	SensorDataService.exe
4844	ssh-agent.exe
3124	AgentService.exe
4572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a833fdff8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8d5346ff634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b7c322ef634dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bf44f2ef634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f774292ef634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	808	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4912	elevation_service.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3124	AgentService.exe
Token: 33	4572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeDebugPrivilege	4912	elevation_service.exe
Token: SeDebugPrivilege	2148	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 1932	808	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4572 wrote to memory of 1460	4572	SearchIndexer.exe	101
PID 4572 wrote to memory of 5712	4572	SearchIndexer.exe	102
PID 4572 wrote to memory of 3312	4572	SearchIndexer.exe	103
PID 4572 wrote to memory of 1264	4572	SearchIndexer.exe	104
PID 4572 wrote to memory of 1944	4572	SearchIndexer.exe	106
PID 4572 wrote to memory of 3080	4572	SearchIndexer.exe	107
PID 4572 wrote to memory of 3056	4572	SearchIndexer.exe	108

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f9c4c879c0f779654d315c23c5538143_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:808
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "808" "1464" "1328" "1452" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:1932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5868

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2b36ae1d5b9537b29e67c796bede659aef4f798697f10ab2f42cc82030345537
MD5 bb3b04b8ae883e959617fd65c0356469
SHA1 f6f1272433d7f6e670244a24a090824be197c540
SHA512 3383f854ab48683b1f8754cc358fc3624d8ecf726106af3c79b1098576cf1f61a785a6a87f63d68c33c1e9f75f86fda160996ba82e3b2ae1a92d990900b06735
SSDEEP 49152:eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnlDmg27RnWGj:g3q6sjByD527BWG
TLSH
T17BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e535d4965bdca933e65b38344d135983fab4e709283bd5c8ec5aa3935ae46efd
MD5 334fa8ae53cbc6a658b72956d9b414c3
SHA1 09e8439ff5d941dcdab51c7407c093e28ac4a93b
SHA512 ae0986a80cdc248e93992a40966d82ce76e16b4bbfb0a4d41432a20dd9b17876c8a13c5cf9ecb94f4dc2d9dcf41b1fe2fa063dffddc79587e00536576f63fa4a
SSDEEP 24576:OXYfDtczACsqjnhMgeiCl7G0nehbGZpbD:Ntc7Dmg27RnWGj
TLSH
T18965F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f9c66ed05e9d1bfbc3f72a9f03a5136064d35140f2733699ffe7eaa329b12b2d
MD5 c1b4335881ad437580bd9cefc79dc93b
SHA1 309fee58adc12432e50cc37900de29b2e94b4bf7
SHA512 b33f13d0297b790f13929d50e389b5d881dfa88298f7f0c8a940fb47f88464aa81d67f95ae121c49e8123670fc40849c895dd4e8b7c8b218be0f617d734861b1
SSDEEP 24576:+0Le5ji0hmxxrMOsqjnhMgeiCl7G0nehbGZpbDM:+Pji0AjrDmg27RnWGj
TLSH
T175859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 29ee78c6289e12f3473b47582564ca2252991a7fee44abfad0a630622b041f87
MD5 6e8b6ad24d615d5be92b89744e0e914f
SHA1 6597940931f5b462b947f1d39167481d602960d7
SHA512 1d8314ef427c27a2f8f66fa2b68699e45201292198538ca64b04caeac42d331452c41812606c6f3d4fe0462a6ee89c21c0ccad0da5fdcd9549840323595d6150
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWn6q8wyuMsqjnhMgeiCl7G0nehbGZpbD:x/ezSC6vUzPveHjyfDmg27RnWGj
TLSH
T10E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c6460bf8d26b47a0dc1918ad53836b35ebac99c26d2cc1e42ac4e25ff497cd69
MD5 9d3a82355179bc67d514fdcda4dd6ca0
SHA1 3172cc21f5f0665483b11a8ac22c27c627f18f33
SHA512 0ff13087b7ba01067cbeea0b85a7a7ef29e3607803b3aa014356a0981bd3ccb0ed38337fafc32bd3a32c57ebb302daf570aa236a35ac01b7ffb036d69fc4d983
SSDEEP 24576:1VbqPb88hv/l+YxsqjnhMgeiCl7G0nehbGZpbD:1VO88hXl+gDmg27RnWGj
TLSH
T1C5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1723a0668fac58abad4798b3c480481428679dca2c3808a786360ab5be91dd74
MD5 10ab66b46b7845a99ffc94118cd4bb29
SHA1 57975645f059eddc8986ba770df8711034625d79
SHA512 590a0f72116734c19b2de69736ab0476a2d1142f8c794bb5a2522593841a1234060b2ad71605e71d241bb08950ba91219b262d485ece897b7a98b7328d6e74bc
SSDEEP 12288:iLaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iLasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BF864C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 94e7cc34ccd930237948bd35325d9e3c5ad94e984014eb3384268cbd8dd8092b
MD5 9807e03e04716eb9c87c1f9cb025562a
SHA1 8dbca0a2a15925aa15f56b5613720fe6f33928a6
SHA512 81d2dd0a86130e1b842a2e01fb42e428375de7d450cf443cf8ba13286988ca5f396cebdef0fd0d345ddfe421f7c79601f9d14a5ad32e9a708528e0c627ded8fe
SSDEEP 12288:beBNUbTVO86UZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:bJIUZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A65CF7BEE28FCD2C27A4DB85791C600E77278314B21A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 35ce0accf4c5c187f05078eb849d7d7b3af7271a892e05f90f5a35b92bbbecf8
MD5 947be79f28802b089c6eea2e13850eed
SHA1 8b19769fa5d322ce6c672c7aaec69eb75c7b1726
SHA512 bf0d0ef4728c76d6f30566ba14e80f3fba00769a436fab0f08b4ad0c02c6104f6752722474d52e8b5bdd5465b2c458a1d58540a7bf6092f7e11a6b4c8d4926d0
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THY:eQvGAdlCEL8c/DRNw5CID527BWG
TLSH
T1F1266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1d87a89d35753b371183b9dd172a069ba760dae3490ec6e4746063b5046e46be
MD5 980155c2540dbd2667c42ec1a534c0e5
SHA1 49da4326989081bc3791fb64d6cf79ea8cfc0030
SHA512 a26f06bfdb798af740ac9d0854fd599c81c92924dbc26d33aaebb1ba6502445411cae1c1fef485e2eea3333ad688dc8ca238a90a409f30d07d6bc6ec3eaa41f3
SSDEEP 12288:XAwSfxL/2Dc3RDLLmt0LDQewsAjnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:w0ewsAjnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12675E031FA74E036C37B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 854e33b4f9296e361b332b23d152ccd72a5b1bd29c5223004894cae19c48b78f
MD5 4e9c2539bb60a3853140ea4187861084
SHA1 ad3e9f502ff6c9973bc0f1d8bc462a31b4266079
SHA512 408e7bc4bcbb28f227f88bfef7e2a1bc72e6a143fd845daf2caa2807b32055b1791939ad38734efa2c12d85a08ee6c8bef5d559d333f9b185c4a972bc16859ba
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHjVQBWG:ZUEtQevvqc2W1cpV2tI32aB
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c636a8984de485ae7756a8905c072cea68292c57ab7eb22fb53979eaa3b2104c
MD5 788f6d7f2dd7e8db7c085339f5f644ad
SHA1 5848ba1d349036d25275ce97e651649763eadc8f
SHA512 d8dd4b0959f648501029522f7760e4b7aba736f5b2fe4d9fc1921491493cd26b60d1b9d0c9b4f99778f1b8560b4bb18dc5f29b0aa97d4027c8d65954fc0b4bed
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zbDmg27RnWGj:koquVjnmMD527BWG
TLSH
T10BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c309e7226c93de783da144bda0affa75d46437a51d8138ae63592d1e6a4b5aa8
MD5 a873f64665d8ba923b527cd3541885e1
SHA1 f0cf74dd64080b32abf73ed802a7d44ba16a4a3d
SHA512 2230c2ed9aedd8d6960efe82c69f0d189387b7cba1869833a93e2f37303d95bf5c50b1eef7b0e055f58cecfd88c24e0aedbff7b2e97d12fe7cc98a9296a80bc2
SSDEEP 24576:SAhGL3IFoiwtA5l7S53wsqjnhMgeiCl7G0nehbGZpbD:SAMUFoiq5cDmg27RnWGj
TLSH
T175359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dd08bf9ad00239321883c810508c24e1e94b30ee2f35cfddbbf52a67f9bb1a71
MD5 fbe1d7168462f95c16d8cdef70ef4a70
SHA1 fb11e36945c4a4a4661ceee3140687ecf6cd902c
SHA512 81679661231ab70a78af50d36aeddc5390f9824ed6694b91f23bc2052d807d64766a1bff73cfe0fe437b7f56393e2b8ec94ffa04c2a2908652be9649219f4d42
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+CsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:kwu4OWLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19965F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 348b156e692932e38c847888c1d66459a0066f23bbc62232bc538d7df4cdfa06
MD5 addc7f787472b182937f6d77e2f1b067
SHA1 e52954b57357b39f4430dae8d5137dfeb3953ffd
SHA512 6cd1d598e728140745c0b901dbe4e61a295fb145b538e1643d414d6de94695d4e56d54e57f660042cb3b3b857231d1457ff59e4d283e51592026176b12d0500c
SSDEEP 12288:TeZ1Iy3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CZuWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B55512AA239820FAE163417CC5E5D609E7337C63673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1c10e181584f3a16e4c9a75b6e04d2cd66430e8564f02ba4d20537abc03a2580
MD5 7821cbf5ade850e90ad668c4f849861f
SHA1 5d363b61a31f9501ac8b2ae1731b1a27b2af08ca
SHA512 85720d26dab37446ce2b0585181cff5e3351e04be5b44f4d13461812dbc31de2c5cf82f693f8b921fab6cc1fca7be667f2a265cbe651a402b8bc686726b2fa50
SSDEEP 98304:HQRQyi36YOcPbLvw2gAf+PN3RD527BWG:WQyiKa/X+PNBVQBWG
TLSH
T1C1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 555da5b6e7be040f268b6600b8b8c1958f55bd86449819f1e736ad6d02bba22b
MD5 df8a97bb84354642abf5d52126b74843
SHA1 d21009077500588798080a2351e58fcf10700ddd
SHA512 2dcadff07a6b20a6c3e512b2db610ce4b4f886424ebe8330ca1e4f9c71af3d3f0415cc01cce4683617579a6cc616487229b5c2ba3702dac222b5ada8abb4281e
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN3RD527BWG:RQyiKa/X+PNBVQBWG
TLSH
T1F0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0d79ac594904ecbfe68b6e0d80d95627ca2ffb8016806d53258467a79566d73c
MD5 86e6c903779055ec657dfc0f6aa47409
SHA1 e1c8c373acabd706da2c654ff39e5f343309dc69
SHA512 d45bd132bf01cccde8702e643115cb68d0e632772c94f5dac57331ab51b8ef1b414b91e1d9e00a7f60acc2183f9289d0c7d48409c788d5c7bf9373747f6585c7
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0GsqjnhMgeiCl7Ge:y68Qg55nhceWu7PNU3/rDmg27RnWGj
TLSH
T1B4B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8034e8135897e2a4484c29791b409c2c30e37268e9b6ca2d9b90cf47d5aafabb
MD5 af8079962a19aea46ce6343fd896355e
SHA1 2290619a18d1bc7b539e6a133d474c04536546a6
SHA512 f0d9f6b137fa3af352f80a9daefec73767efd6a5db48a6d7172e46964f279168e89e8845e2c41c0839f3a35ab33b56f506393290f8c7e28dfdfaab723d928339
SSDEEP 98304:9y5112gYy5azzVvt69nLKnhZuD527BWG:gLIHEWh0VQBWG
TLSH
T1CA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b4f7a7a46dba66dcc794fff3c65083de7eb7cca7bd303b3af85b8248cf097f8a
MD5 c38256ff8e71401387806df9413d220c
SHA1 c77ce88c6c6496fb78052c2998f34148aef16378
SHA512 1720205d7c2c3595481efb0d09808df612570652d1bae321adbce3522f57eeeb9ba2921115a79654a5fe92358fba00c70c2a009752e8c6a15424f49f5328cb42
SSDEEP 49152:yB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWDmg27RnWGj:Au6Jmdxd2dWD527BWG
TLSH
T15DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8584313bb420260bdc58b1a57be297bf95349945abf2c94c94b10e1d87bc0691
MD5 2c70d0c5c5981f17c09eff965d6e31f9
SHA1 01dc7578d10a559468b3eeb11fff7f9cf721f6f6
SHA512 9bad57a178129b3df6201917f12b91c2e6206c6fc6ac245e077653bcbaf46978d44703430d47168572daed592b6bf2b2dc33b5f9b9e062d4298d7c4f3e34613f
SSDEEP 49152:x1hpsNoJpF1A63U44CwH7R4x9Dmg27RnWGj:xmifPWRMD527BWG
TLSH
T1B7B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 37130ca2432219ba63935afdc73957732ec560af65a747febb45c8640d81d676
MD5 dffa2c9b03b08690aed5420d20eae714
SHA1 b18613d6eebb9f0d9149ea6bd7648a5578ffedf5
SHA512 320c2fa584fbe5d243bfc3c8f253eca67b1390bea4c0db7bb40b287dc09f14ac3c0f5a4e045f1a160d9f1cdaabbbe95ace4a74d959a98aa0d0be17df726d8d65
SSDEEP 49152:BSuZQIY0Be2KcRVtOnks6NMHqaDmg27RnWGj:P5dKii61aD527BWG
TLSH
T1CEC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c1991063fdfc06c8e9f2ad3ee0e67c9e16c940da3f5897377752850d1b4d88f5
MD5 5d9e799e4c91c9e1a0aac7654425ee10
SHA1 02315240466d1e24168a06991839467886fe2962
SHA512 a6fbad4e2b4a3582128d10b9fc5d32f94a213ae302177c81b819b2bf43d021c3dd4c53e02b43b1a6f1842cad3f22b701f1dd410b23699bdbb933e6d760f2828c
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5w5Dmg27RnWGj:PX2imphwD527BWG
TLSH
T1B595BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 24647bfe3d8fa54a7705a25f6180e3382a07a1dccf5e50190574dc53b0aa5b82
MD5 e888c1b0a3feaf3260d1f93bf8dd317a
SHA1 93b7dfb575f50fcbf8d32fc6b7ffd6b7da5637e9
SHA512 7acea040450cceb6494e05d7c4b04310844a7d52aecad0d9e8ba2909125e87607b69fa2c8a48d4453033a97f43d1a5b2051d991b503f2d1c216a9e4ab75ce257
SSDEEP 12288:FiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FisqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BF965C41CBE52648B5C3E5F10EAC073E57E92004937A977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dfa2309a2d1487e1dbd9f26a11ed58f5071871a7fb8fa3fc2ad19a4ed025fa6e
MD5 a66d22f16f39fbc018b96b99a1a4d60a
SHA1 5f63708b296fa7ff19735856587b1c828355f5bc
SHA512 d4037aab1a89735c93c3c1611ef4cb89d2732125ccb2de7e4f0826fb3da4fac1ff53dde34286388a8687f6b2fdf70da05bc5c47612d215500ef141e151f689d6
SSDEEP 12288:WjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A4523BF955C41CAE52648B5C3E5F10DAC073E57E92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 877a1b12603e4f226dc9b8c88303939e96a0b69cf58a45b83a40050a98d6896e
MD5 f50ad0f29abc272638a19cb0503a88c1
SHA1 f374d4a03beb64f6b6e20a09b957e351539d65aa
SHA512 58563b586b5c8f182166953635558dfe712ba70e863cc81b5909c73145585e962c774fcb6dbbb1eb58d2213e2232e0cf3cf5e0bc24df09bea7bdaaafd8e9b449
SSDEEP 12288:ghXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ghsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE955C41CBE52608B5C3E5F14DAC173E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4b7aea29941ed24a10aed025e47882a0623d7a0a42ee63165f9532a0aee7ff48
MD5 6c3768289274bdd8dfb381d3efe8937c
SHA1 b0db4be7b059267578b32725b0bbc63b42da93fd
SHA512 c4a3dadae3458451554d680c4da560e754f70167d23afa70c3d2bd8e41068717c472fdb059d2f0f318568bff37e86b9f6d2336de7f45a41561a01de17883f2aa
SSDEEP 12288:WVQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C145237B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7854a2f05f99108433bd0a319fdc04401a0768d1f6b3b8a308dc0c9669e3a85a
MD5 f9a50fda2d51be2273cbbaf4bb63b15a
SHA1 93b90a085869af09acca74fb38ef531924d5c825
SHA512 647d4b2e340f0f153a4a5fa985aba372ba9dbeb336f1fbe9d9cda3185cad71394ff90f5f1bd7d6dbba337af8d864b3953070dae60fb6b798e377e7fa42bedbc3
SSDEEP 12288:PoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PosqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BF955C41CBE52608B5C3E5F14DAC173E5BE9200483BA9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 11dbd95db3c2d5ff5bcbbd2504a8b944168d206a37dfdd8c82c3b5b9a52cc5fb
MD5 b9d1ecf322e2e318afb3c80180f0b062
SHA1 f4f2ecc47ea230307ef3fd030d73853a63f4daf8
SHA512 7638fce4638182c9b2631cb2a2b05379e53f7b93423f3ab3532cc12e928cb5dd0f6e62c96c3c7d571fdf1a9d08972c1c7f0f40d424ccdcf16d57c46924b16955
SSDEEP 12288:BPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BF965C41CBE52648B5C3E5F10DAC073E6BE92004937A977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4f15a9a6ebe84202901cdd904aa9dd1f4d7362886cfca61abac551456a11b9e6
MD5 5515663800997e3d8cca0d3bac0a2347
SHA1 877587f8ea791b08c9c7d2d1d136e2ae4dc13178
SHA512 6cdd8a9fef34f271ce4347f2aff3b78e14857f1c73d9a1a8f5818e2c6eb59835f2fdd125cc4383595ad71363d274a852c9c805e53d7abcf4c5ad2cc7e969143f
SSDEEP 12288:27Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:27sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BF965C41CAE52608B5C3E5F11DAC073E5BE9200493BA67BCBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 18db8361dd5c0e9c4ff5ad3dfbf90178fd1de422099a5e4d6b17a8f28aa65ad5
MD5 4cf401e55aba012f7d94b8283db64b1d
SHA1 e55865e95b9fb6d70c7086589ff48a806541b119
SHA512 15349a48ba74ec11fe298b78a738ddce5c85a07090303d1fe6015dc856d9d174c24e12d2bb979c0d1128e7cc7087e24fab7c72a65b2cf53d59e3f6df21e8fb92
SSDEEP 24576:XZMRzFVSODsqjnhMgeiCl7G0nehbGZpbD:XZMRzfDDmg27RnWGj
TLSH
T1EF6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 35344a11e75cc0807193f4b054a8d6033fea9f71e6c8f2e4aa3d526dcb57cc04
MD5 7f7c0a5e9dab5d21c1127d59bbcc1688
SHA1 9302f9fcb229a2fa8c1ebafa77a16c8452d2421a
SHA512 648354eb42de46ceea8592506ac5761e6ea8777025f00b6f669fbc5e12fedc4adaafb83d0346f22d36b2a43a4c4eff21b04a51bdfae78974452a0af7cf976907
SSDEEP 12288:amXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:amsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BF955C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bf62566b852fdcbd0dda4ae5589b59e42de68bc6c2ed1a8b9cdb84f75ed805b3
MD5 fac95e53a1c330ccc6a68214e05717c5
SHA1 e19e5e16555bf9e4ec63bc98403c071b22cb3ab2
SHA512 2382240caef44da4d209e22db836e0b3f65fb1509d7d46860fa0d785457f79713f07d545b38bf7b54df477f1a3064e852e5fa7f66b3d033e760693fc1077b7bb
SSDEEP 12288:SqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BF955C41CAE62608B5C3E5F10DAC173E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a8c2bd7a8c25479db5e4af24384387e9c0618c6b1f8761e56cc695d731632669
MD5 c3d21a5556e38d1181ebd5dcc9c8014c
SHA1 a8c6fd1343eadb533845494bcab688bae9cb597b
SHA512 e0911ead4028e2b48798bb8aa910040c40a60875cfb6f8f646f60a6d8947852914b51f778a02aa1fc7433c19dec147973ae44fd2d04a24a94266993abcf37c9e
SSDEEP 12288:MyPz5L83Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Vzy3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E655125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6714a59a3b6c1ff8775b3747775ee63adfbd9eb9e64b0238744d368261a84cc1
MD5 3c1008bd3ed103d520f8e6a75edf02fb
SHA1 da385c777d9fa681ad3537f06edd44c03b17474f
SHA512 bc414d10a34eba2a95ef63f8be4ea3b1e9d5224e128f5704318b9706fc51c2a4d4d7155f6c0cbfb28542961b8edaa7f96f9b008ff70b46635028769b8fdf95a7
SSDEEP 12288:gmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c9cc6090ee5260a92100ae96eebcb7de71f2fa02f18f008191b5a9c346f2d1d9
MD5 fc999740547760592b3662e594312e6b
SHA1 6e058055bafec5c694e2343b03edc02ff51191ec
SHA512 37e15e5843cd02672f6a7f6ced29a9e60776630d15c292291d6754397a808995779d52abef8967592cfab4f87551d906b5de7c23668d990800d8b724f5d3fa92
SSDEEP 12288:pmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7e81349827fb5f3099103ee08b95d2e1a5d2ae28827a2eb42d567e2e060913f2
MD5 05fdbe7075b18058fd6f2e72af44f3da
SHA1 03d4e8d1ebc11c9945cbe747369902832e8fbbe3
SHA512 657a48cbfc741c5821e44385a4f4fb378a2fdcd3f6019fc70cd7e64f75c7c8a7a2435836d5a47d47eef93d1a89b03dd5b9ca3d407e28801f332791099635dc12
SSDEEP 12288:ayPz5L83Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Hzy3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14855125B73A530F9D1378178C5A29A06F7337C3247204A9F17A116BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b55b10de2adb1f06b0341a487b83589eea43d79979942bbc3aac00d964232bc6
MD5 7df5c588a829b2f57e7cd33c49264523
SHA1 65fc794840de9cf0071fa2892ed64b7f1a4ea8dc
SHA512 29b2624c78147eb570a316fbbe26b1169964190fac86991a30ee8f9cb059d3cf5c966f436cecdc6c7de8ff02eecbe0de94d2205b3b632b772d17cd6d7af9078c
SSDEEP 24576:HTDaLl3z0zDRsqjnhMgeiCl7G0nehbGZpbD:HTuLlj4Dmg27RnWGj
TLSH
T19D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 cddeda6b7e6b2665879597552f8ff3a301f02b51f6bb23097692cef19a8854e6
MD5 05b1ca45e6e600f6af616e2437a35e12
SHA1 d488c5779d42ad86bb8b1811b5cceefb34d16165
SHA512 62f12c9d400c8629728ff26a8edf468c7e748743edf016b21bc8c25b6429b62fb0d7effc1f82f9ff68a0f006c60745f79020591ae0649d293a714ff506345697
SSDEEP 24576:X3vd9CHKy7GZNsqjnhMgeiCl7G0nehbGZpbD:nvd9CHKyaDDmg27RnWGj
TLSH
T1D375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d7c948085e34e5bb5dfb4191bec3d1fc8800dfc0112e7a87be7912f32f1e8fe7
MD5 255bb58f813d1f31f6bb1e085759cfd8
SHA1 22f27373b3b7ba16d5e63a972fc148d82f549843
SHA512 7c430152e0fa5e6ba1c9635d7a069c34409fd47271826a386056c48085e67fdd6152d8a67c73e7ee961b5ce7aece059ccc461766de89c1153aa7038e57dbb893
SSDEEP 12288:SBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BF955C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4f18ccfc491049df6acaac75340e52aaba517436bdab0b7da33488dce2f4759e
MD5 06f06e22ed4a4faaffd9959032947559
SHA1 0b006ad36680ca0f1ddc128ef87872c8320400d9
SHA512 4d7e78faa070bcc92290582d700a560719a08370acff69d5074478908321fd814fee6a1d1ef64a85fe2b4570ea5c3f1c08e0a73e8b2f17c74c9b5f87a3ce3184
SSDEEP 12288:4XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BE965C41CBE52648F5C3E9E10DAC073E67E92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f977c8c0dcad2629d1dc28f5b426b0bf2eea313a3a2f0c3e41a1dc7ccd0f0fab
MD5 330924b76effe7d15c35018833423bb7
SHA1 9cf393d8f39557bb9c4bf81ce5fc88ab65001101
SHA512 d4bb110c9bef9a6ef7efc74c8f1da47ccad5d88b0a882acd3d3016a5ff892c008076663e683bbabdf7271fa09b54793938e292725e7ae0101da041c316c7f26b
SSDEEP 12288:DkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BF955C41CAE52608B5C3E5E11DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d9f32d6c0dbcdfcd4228a08df55d34f6c60bd1b7420b9ffa8898c816ceed9c80
MD5 0f2514730b8fb99cc3e96cf02e2cbbb7
SHA1 c9570452168372d23a74ec450eb718649a2774ed
SHA512 9dc3abe00133c29361d0af62f0713f8d3448fbc224d4b8c80ce4e4c30875dc5936fbb7fda6fe96a5610d9fb4aa8ced985dd974497bb778609d653f445d41fda7
SSDEEP 12288:NmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD4523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c6456dca958e959ec43db9c2654512da2d1abb0645a4a66e32a440793e5c0ffa
MD5 4fa5ec6033131fd1b0a7623f982f6134
SHA1 3ed4ddf389efcbfa2722044cb4dfff68cf7a90fa
SHA512 1bc6ebd1618a8c3a6f3a74b4e514e0834cf0781f719652e6417c1f9f6bebfe9ae5c0f9ec5383426be542af98d09e61b5e1eb26e476b3627da048823329d22f77
SSDEEP 12288:eBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BF955C41CBE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 38a9a274c66ca3d1f45e7b19deb1555160a80c72344f64f6ee52a747b50c238e
MD5 c9cbfb9b67ab48ce43f52a17a7d51c11
SHA1 3c11000441118d5482851ac78ae7e9da8a2ada92
SHA512 94ca66dc9179f62ffa531c511b7c527e7b4300fbb069b6582c29e968ab80a80e250ecb9d4e663807794c758d63be3cec8e3468b4305ae349fee8aa59d0245552
SSDEEP 12288:Z+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1714523BF965C41CAE52648F5C3E5E11DAC073E5BE9200483BA977CBEEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a2ede54aa42f75ca7da13fa7daf3da7df329ff95dac08928c9b36c0203cb45e6
MD5 706eaded226a8a2e0361aafd8ddb4127
SHA1 7d3cbffb90ca167f8ebb515dc75e5bb82a2ef501
SHA512 906fe16b683965936f4fd799f75ac9207c3202ddab89690cb2450c2358fa01cfcc21cfca7e82a4d842b00288aea0b2b6538ea935cd58574fa770ed4e802d5635
SSDEEP 12288:coXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BF955C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f49ee04c940da9c4cbb232cd17c179cbc0670eb3568cb65650460494e7983809
MD5 bc1e31514bed9d3d06ceee0677f3976b
SHA1 a7e6ca26225940c032f40545922acf6c5a4349cf
SHA512 5a84e1e64605d323b65314c7ac47f15fc721e9c6cdb2ff97f7ccdbd9257e33c4d65b8c3ab8774e0533176aa9d370da17184efcacf4c20b9f73208e624a338bfc
SSDEEP 12288:5pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5psqjnhMgeiCl7G0nehbGZpbD
TLSH
T1644523BF965C41CAE52648F5C3E5E11DAC073E5BE9200483BA577CBEEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4d930edbc7f359ab7bb6e7bad3a21e0f1d5ad53e3e3092bf6f27f553d12b1bd8
MD5 15c5a22c6b561798f47da746dae39582
SHA1 2e4c34304de7b47cf2cffda814cb20a8fbb5237e
SHA512 1b0ea43bbaaf9a431f2ae27c8bb4fc1ce613269b5f88d9c03265c458f3a6d5df6fdbefe0f11edb4ea97335d372c7a77030d389b9dfb6f350dcdd2c378ad0ae17
SSDEEP 24576:ZfwvUk9RX6wkyAI6sqjnhMgeiCl7G0nehbGZpbD:zMnYIODmg27RnWGj
TLSH
T18385D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4f9884f31c07f615b76625be2000df5685bc758c864f5f0520858120f81543d1
MD5 27ec6c6ec3ebc3822df6c759a62fb1e4
SHA1 7d76ae4e3f13b3aec1d730ed632f0c6ca9342b1f
SHA512 f80f8ee0c7ffa36b4d8879aea643d5cc78f719624dd944e2133c71878a9c09a430bfbbeb87409149520e13f77ab9952d242f1a5587111d94b086c5181a68b7c0
SSDEEP 49152:tYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZDmg27RnWGj:gySzPxD527BWG
TLSH
T116066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1e31a708ba71b51e700733664bc919cbcf4313fa3d0c7ac09e9ee7d293295f63
MD5 41b42a6107fe210a9e4166533897f4b5
SHA1 9bd61f5354964f5241df3ea5deca96b55647358e
SHA512 89d27861c999c9f95ece9e5a3c3683c2f78d47deaa808b4560aaade1060b726654415f288a68ebe2d0eeff57c0ace531dc4d4a8a4e6309b600935dfa37c8fdfb
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYTsqjnhMgeiCl7G0nehbGZpbD:D47JUQjTirIhCnDHUPfF/pDmg27RnWGj
TLSH
T1D665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 394c3faf3a985f7147a496c89f3c2184625da1e58d50ff6778fde0b2b7265ed9
MD5 3991e706e2a1f9a62b066d4bec4202f9
SHA1 588fd7ad89870938bc74a9092463a66e945808e5
SHA512 72682946da517e5b22023eb23de80f9dd7db735f4b8d87b2d51d00f9001cce04979a66d374e1bb5327069f104f24a6da78c441d1acaae4775fbf5fd9e70fbe3b
SSDEEP 12288:ebsfWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B55015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 976KB
SHA256 377f738bfd149fd2331885cbf19e163e7ec7f1d4eb7923b4d3deab653a5f488e
MD5 f8ababcc2e06ad6f30269e4b22d85406
SHA1 5b5f9ca3aff0f001af8a5fc79f1183a4dc392d07
SHA512 e860f7c374bcc7f86c60299258faf348921e8a2d5e5164b26b910bb81f694d3c09ed0f5b29bae1f2658234a7c614c04d23eb51a236fda904eb2fd4f5e1589d73
SSDEEP 12288:HJ00U3fczA7QoXhLCtuJxfetr/dvNnmeMQnSWOv7IJQp:HJlUPm+Qtr/dv9meMMSlvkJ
TLSH
T1F22507017666C75FC66D80322E36D2CCA7B07D01EE446F0773C9873F9576A58BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4342c18958dc6de550fe669a113b68a4ed473abcb2fe8742c163e60bd0ed772e
MD5 ad92b8802bd9474af1d0f704527ed8cf
SHA1 4d2ab05aca519d4b8e867295b63ff32c9b0c71c7
SHA512 4b147b194bb6db16c2b6bc3065721383ac7370c37fba4b1d726635579c6b009bc668270740f41213fe1ce1556675c9372c1bc2fb7caf65714b549aaaf32f0b40
SSDEEP 6144:39VMtuJxf2ruHcsl15qYnvsvgf4tuJxflcO9bS+i+hJHlOdp3SqtMxvSqtMxi7/K:UtuJxfUgDvsztuJxfGOlSwEdpYW
TLSH
T10A65F9409437A38FD1BB6031072A9B4CB7A4DC16B7496F27B7C8453AD82AB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dcda2966af467269f3dfef7e56cfa063688090d2ddfa842c7a1b55f973eb884a
MD5 57771ce9eef3d1791d0c152aed98cc03
SHA1 fcaa9fbd3d4074adc4c5d4398a935e245d81eb6a
SHA512 d2605ab028c7091c9ccabdcae6c8e7a16312c4ed42574d93dd9407f28875737caba96ed8a48d89e483e3a79c13231f89b1358d1e97825742d8d1da25a0ef89de
SSDEEP 12288:f07uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:susqjnhMgeiCl7G0nehbGZpbD
TLSH
T10745237B934C518AF93609B482EAE12D681B7E669F1044C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6999393d270909d149d8a8baf19c21cef4b267d653ffdcbc2165949bb04134f8
MD5 f28e92e2408103f0bc060b158efca9ec
SHA1 2d024ce424784384902c4ca9e290dc15396414b3
SHA512 c9e7421f29ce1cd8d0e424f55f2c2ba9b1fe71b4e10dacc367c46a2f41aa4c931119832665953db64e8cd2677dcab9f7d80258cea67ad7eb7d31240fd2237198
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYMsqjnhMgeiCl7G0nehbGZpbD:igb4mBIBhGFXDmg27RnWGj
TLSH
T1AD659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ce945caaf5af490a872a980635596d98c8280493fe6fa55b733ecb04e8dca3df
MD5 54b67379983a886df004eaef44973c2b
SHA1 dcfbe5f47ee374e6bf0723d2fe27efc10b12dd60
SHA512 2fd14a8e4eb0ded17ae74ba1796ef4a3646ccc5d8647b2751f12c4c1f5061db24e78a656facc4e8c0f0f928c7c42b65b0bbcc4a2f1fd7639369f960df089a48c
SSDEEP 24576:1G88u8FpJqH1bzria7/mDsqjnhMgeiCl7G0nehbGZpbD:47ZFPqVea7/gDmg27RnWGj
TLSH
T14E85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 912846280a36f2960f20252e6eee0a492182d4874161d6d4f345bc3575fc0d24
MD5 9d0b40dfdc9320473e5f66a6fb2806c9
SHA1 1f9af898d308050b771c4e0ad673e256e1c3f82a
SHA512 63e7b5066a6c29164be883f865e99223697d1197f8aa698ddfdfd5d8624214263131dc297a4aed851112d6a49d4b6e4dfaffbf55638efbbb83731051aa9a8ab6
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzDmg27RnWGj:uG05lO43b2D527BWG
TLSH
T18DD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 72bb5e71198a83fa584b8ee675c3894d8b0f969891bc8bbbefaa66cca964fbf6
MD5 5a14a716028f5a6f2f48a5b88da206a8
SHA1 f3253763e6b74bc86cdaf6fc1d973f63ffe4bcd6
SHA512 899bf4e6c495aa80ba5af92a0ab0753c1afa85caa4c92105d2fba1b469fcae0f6e3242d3b27b6d6707453bab78c767dcab621913df2572b4d1646534b103a06e
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnlsqjnhMgeiCl7G0nehbGZpbD:ja5POZ3BJt2pasx2+mrDmg27RnWGj
TLSH
T19F65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9b132ee04b9922bb57e374f511f8afb024a6df017a59e0d4da1b1312bb28fae3
MD5 190442a6217fbfdae1717c4087c634af
SHA1 080e4bfa905edc2399e25422cef6dfbd84970427
SHA512 2f801896ea8ec08871ec298bc0c13ea256637530d2094eae655b8183b19bf93a2b130654f1dfb0d279d7645d06fb54532c927e67b00cdb378b85f805d8f531da
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkrsqjnhMgeiCl7G0nehbGZpbD:tNc/zEOVHFADmg27RnWGj
TLSH
T13A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ee6df358b26d2440c9863e871b4a84f37aa26dfd5232c36dc67bd7c99cf2230a
MD5 3028b1e5a0001789e49e61561e05381c
SHA1 44d8feef35380b8fa696e9211875484dad444b15
SHA512 0daa147f8ebba6db371989332e78072c80d5d0ce278401837e9ca7e2cf1c03c0d88da2c9d07544832410a973a4dc45adcf9aa27972511a3cf617a7fb74771d2b
SSDEEP 24576:xTkNvNnaFeYhJNtmZBm2sqjnhMgeiCl7G0nehbGZpbD:xTMwBtOm6Dmg27RnWGj
TLSH
T18555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b6f2f654d4ad6a73d7080de1d566ebdc73404cda189168e777899b626d60d7a7
MD5 f3018570d7e69744ed416ec1b075be34
SHA1 7d726374b06293880b66ebd7a9640d33f5b4cb9b
SHA512 75a1d10a05adbaf763ca89050f9a61a2df4b68da6ee48bc07a63964c09f4529903221add50d9f838fcebcb7b87c45ec2f542bffcb542c4db1bc4572d71f4e7db
SSDEEP 12288:zHvUrBFrEjwaQfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:zPUr+NQfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13065F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b82d8a77f0c48beaf10148d977fca75459e44c4a439c32fba3c3dfb3d48e0193
MD5 a82a44a0709c8225d0d46d0a1b20fbc5
SHA1 f98163f44f1d13f7c27f371f0284672bb491114f
SHA512 209cb7ea28687009a882ce48065e78469750e38d635033738d3390e3903f962e507e14ff0978a4dbbfc6bd33196affaa23b7b86f7d1a05ddd3e6701304b7dbd3
SSDEEP 24576:ID3FHshBIYQgACsqjnhMgeiCl7G0nehbGZpbD:IDVHeBIAAGDmg27RnWGj
TLSH
T12975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-39-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/808-43-0x0000000140000000-0x0000000140474000-memory.dmp

Download

memory/808-0-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/808-6-0x0000000140000000-0x0000000140474000-memory.dmp

Download

memory/808-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/2148-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2148-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2148-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2148-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3124-112-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3124-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3124-120-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3124-118-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4456-59-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4456-186-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4456-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4456-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4572-133-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4572-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4572-127-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4572-300-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4844-299-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/4844-102-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4844-317-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/4844-390-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/4844-298-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4844-318-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/4844-108-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4844-101-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4912-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4912-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4912-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4912-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4912-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5720-294-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-87-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5720-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-295-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5720-93-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5720-86-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5740-71-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5740-279-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5792-75-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5792-81-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5792-293-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5792-74-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5792-313-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5792-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5868-185-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5868-49-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5868-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5868-48-0x0000000140000000-0x000000014020E000-memory.dmp

Download