880f9e8b71458ddc5578f18196b4b72d442353d85c8fe4e793af33cab8cd6130

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.9MB
Sample261006-xtf89sdw9y
SHA256 880f9e8b71458ddc5578f18196b4b72d442353d85c8fe4e793af33cab8cd6130
MD5 96d4c727778c9d83a0a569431ca15bc0
SHA1 c83ce572bfa7d1cfa0efe86828faa1696851ee1e
SHA512 126176a2d8d7ef95a2a8643967f532a84851f6561170170b5bc650ebb9c1f8f85e410ad54ce6b932fa1246df790f48534abfcafe1f6f71216b9275c0f2aee1fc
SSDEEP 49152:EwRhNYq24LpoeNyfIsnTadRnUaqcjLhmR6IWY6TIxLDmg27RnWGjzarSj8RoTCCW:TDUa5OhD527BWG3JTy
TLSH
T129369C1BE6B941E5C0BBD1398A579617FAB2781A873197CB4790471A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2864	elevation_service.exe
4220	elevation_service.exe
5080	maintenanceservice.exe
1800	OSE.EXE
2580	PerceptionSimulationService.exe
2384	perfhost.exe
3596	ReFsDedupSvc.exe
1340	SensorDataService.exe
4592	ssh-agent.exe
1700	AgentService.exe
1292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dcb51fcfe4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4088-8-0x0000000140000000-0x0000000140D56000-memory.dmp	upx
behavioral2/files/0x0001000000009329-50.dat	upx
behavioral2/memory/4088-67-0x0000000140000000-0x0000000140D56000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-10-06.1908.4088.2.aodl	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080530626c655dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072af3368c655dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000835fbe24c655dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bcec524c655dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008904e324c655dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f3ade24c655dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4088	2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2864	elevation_service.exe
Token: SeBackupPrivilege	3596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3596	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1700	AgentService.exe
Token: 33	1292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeDebugPrivilege	2864	elevation_service.exe
Token: SeDebugPrivilege	4220	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 4332	1292	SearchIndexer.exe	101
PID 1292 wrote to memory of 4960	1292	SearchIndexer.exe	102
PID 1292 wrote to memory of 4472	1292	SearchIndexer.exe	103
PID 1292 wrote to memory of 2992	1292	SearchIndexer.exe	104
PID 1292 wrote to memory of 1064	1292	SearchIndexer.exe	106
PID 1292 wrote to memory of 4756	1292	SearchIndexer.exe	107
PID 1292 wrote to memory of 4372	1292	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_96d4c727778c9d83a0a569431ca15bc0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1340

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 820 2840 2828 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 820 2872 2864 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 820 2872 2864 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 820 2840 2828 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 886861c2444e734f44bf26f1daafda3b71776e7cf73c634fa31ac270309652f3
MD5 ffd983051bd79c2ad3b087c1637843c5
SHA1 9b4065b981fa5c5ff89ac84acb445214dde66c48
SHA512 279db25fb133fdbcf2123c804b9330f914858651bc0f70bb2cd2e7423c7bdd59821b970fe1c440248fb59ce63a2a9d9bb8e30153ebdd09d533fb15100c280a2c
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxncDmg27RnWGj:Y3q6sjBvD527BWG
TLSH
T19BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 370292a5931592565627e9804720d83fe52d7461401edf0b037b38322080fa4b
MD5 d796342245a2200a003eab1b6f532c1f
SHA1 81cc55a1e8c317a27d00fd25287771ce72b544da
SHA512 4dd657824b983baf2e470c8ad372b96804f50ed4cded9b8512fbc00745af61f863a24c0c8e794e66dbff6aa3e17212f320e52ba5f247e3eb4938ad9083b8756b
SSDEEP 24576:fXYfDtczAXsqjnhMgeiCl7G0nehbGZpbD:qtcqDmg27RnWGj
TLSH
T138650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3d710fc23a6e14222f8dc47dc0a491473511851ff4fcf8750876e751f69be4dc
MD5 ec2e12ab5d3c300a90e21243e2e43c9a
SHA1 1aed7597075b455cbe7794754535a6b3a9b98c0f
SHA512 30024ecacabd8b83828ed26fc427c2d334ad328e84332766b822ddd265222328c98cc01cba5700745ca3c2f64ab870d1d15a3686def36d35b4619d38d931bb24
SSDEEP 24576:d0Le5ji0hmxxrM4sqjnhMgeiCl7G0nehbGZpbD:dPji0Aj9Dmg27RnWGj
TLSH
T107859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 86822b6ee8b435538bf81e1c7bb9646411c118e08149e401fff86de2fa58d6bc
MD5 ba5ad224d20ef03b3acb35f896cdc534
SHA1 55ae82921b86e339718ce2d13313ecd321042b08
SHA512 28159e5dc693174113c7f87d0ff1edd15f7200f301e791b8eeb2f5ddeff87c8a15929ce9df44473dbad3af6f241ae6dbe445b56c08ad0b3a404c5b995bc01d0f
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyu2sqjnhMgeiCl7G0nehbGZpbD:r/ezSC6vUzPveHjy5Dmg27RnWGj
TLSH
T1A4755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 04da8e214bf4c5bb92c8c47907a4cd14fbb968c64f11385de22db1b10b070004
MD5 ddd52df07bc2c11f6b8e4cff08313c81
SHA1 2cf9acc5c0c26bd36c3de99ca6c9f5a54ff40c29
SHA512 d3ebd759215887e17944f9b9941e110f5ccbe273b7afb00c015cb694cea4fc1cd6090f372a02f954ee89a33fd1c83c8776506b7c11e21428f3e6a41ab414a761
SSDEEP 24576:UVbqPb88hv/l+YLsqjnhMgeiCl7G0nehbGZpbD:UVO88hXl+yDmg27RnWGj
TLSH
T101559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a0ce8e5634bfd51185bfd51427980250aacdc5494869661b49b65162fea9d3fb
MD5 fd842c7620a9c266b7343bb75abe3421
SHA1 e82b6d8577aed0c7c87ed4979a585fce42353516
SHA512 e97a19f3da1c7c669d0e2860f96c1b026d2adfeae59adf7029d60d20db6e228c5b58508b6cbe12c6593ea771c8e67e75e7efafa5fb12c0fc98ee5f439f675017
SSDEEP 12288:lLsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lLssqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E4523BE824C11DAEA7608B5C3EAF11EAC137D5698200C436A637DFDE6B5458CB3D423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 263d04f16d405b62c2d76f132f9f918bfc9867d3dc304789884f7b0092461282
MD5 918b32f96fa31ad6d05926e8c14b2525
SHA1 71ff245661990eb583af25b615f38e335b2428b6
SHA512 2ef11f5790e76b3e928e62baa9af993e32a4151ed0f85d2e4fb8378859ae51b58f04c12d8f7783dc8d7013f7cfe463cefa99dc13a945a365a92bec150f1b1758
SSDEEP 12288:+eBNUbTVO86UjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:+JIUjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19665CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 187d0bf095d6b6fd376ded86cedafd9b758daa00a2ce787bda91aa3f8cad92b2
MD5 df5ae7b9434a8cb99c857564705a0cc5
SHA1 eda30b7e74150a02878fc06d576044ea3e0c45e2
SHA512 147bddf2d97b092cfadd852a722078519e3bc536203c4d7bd1c8b29ca75e3956cbb06f2292366f26e910377ff0baca10fb696d282c4a1d2e05414fb5d3a5accd
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:mQvGAdlCEL8c/DRNw5CKD527BWG
TLSH
T1A2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b70a0bbce02c967d67007134678998f5deae2439d1c2a8dc76abc0430f4271c1
MD5 b0790d31013073450321189c4acdf6dd
SHA1 8d4b8d8acc1ac2e243a0a33f0bbbbdb1ed38685a
SHA512 e3cec4ae0a5f833df8d4b565c4e01ed55ae5c01abc892ad0a8775047c25b353082e205ea714d37b2bfdd07486e64b8f850977d56a5ea1ff61cb70b45f1355286
SSDEEP 12288:AAwSfxL/2Dc3RDLLmt0LDQewsAjJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:V0ewsAjJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18875E031FA74E036C37B0DB20B76D71A682D7A204F6119C3E3E89D9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3c43d7167893d2938f3ad191bc9d296eea381f5970e9c6a6f264d06846d9ee89
MD5 5c46d85838cd520e67c9ddf22af31471
SHA1 1e683272361dcaa9480d3b2d6ca0fa066e4a8a9d
SHA512 e06bf3c15c7de7abe83c031a0cacd2fc661d0ad91aa437a727b1655ba3e0e82168940deb4e1c2e7845b23abec5a307b519b347cf78875b21649e5248484bf4ce
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHFVQBWG:FUEtQevvqc2W1cpV2tI32QB
TLSH
T1FA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 11f7ccc2cca33be985f8f96e332f01cee78a5889fecf730cb8ffdbc25376dfb7
MD5 068b5dcd9b3502ec74c95c5e422205a9
SHA1 d084b87e8354b627d2a3414b93286e0654ca4a01
SHA512 4b4a0ae64d65fd6d9ea85425fd85e7392c189920b63569badedb3325f2b8f053df41a32978be79e7a006597265d7cda98f899bed8b296760fb1dd46bd6e8bfa3
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/ztDmg27RnWGj:joquVjnmGD527BWG
TLSH
T10FD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 da68b8abc1ecea4ac1a889df6cfb9c8fe91d73b02cb557dd934b31b7d8801363
MD5 b2ea421b1807a68b40e923c8b614ef3f
SHA1 c97815c99281cf44138d27773a601b149b9525e7
SHA512 aee15dbe27a351697af273716b59ec28724cd3a247e2dd4c228d4d034965c04d94740e9d30c7f0f858727592d99616297f522cae164fc8183a2f9a02cd178c3a
SSDEEP 24576:bAhGL3IFoiwtA5l7S53isqjnhMgeiCl7G0nehbGZpbD:bAMUFoiq5WDmg27RnWGj
TLSH
T1D9359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1c6d9ac1aaa77bb60d1c291f911a5c2f2dd80c17bbf18692cdce72ea175e8c80
MD5 1c95c84dd69e20307eba23e3a4861650
SHA1 bff2548ce09980bd2b6aefabddab3e5c1f99efb7
SHA512 efd9e0ac33559b452d0e340d7161bc8724f88f77ccafe8a7903421e33698c1fd0d1bab9e8d9f5456b2f90f780b0126d58664b4cd590f19578c9089d4da7e628f
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+CWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Nwu4OWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19665F14A72A81CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 caa7b3bcd89aca9aae75729b9216352d6d906362d16bdd026c0efee46416c97d
MD5 5cc89cdbdf92e9acf04fe7aa5a182205
SHA1 f8fc1fbbb5df57fd6adc955a61c384454a667e22
SHA512 4022e543d63b0b07e79085c0aae599ffd156445cd88251c195caad6d6b61fe33fcfe3a4d8fdae8680ee30887be43c22720caad3b7e7d18300c170cbbe88a110f
SSDEEP 12288:OeZ1IyZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TZuwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D15512AE239820FAE1634178C5E5D609EB337C62673043CF166656BA6F739C44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0e721646e0703460f03e300240df698e05c2b75ff01b54be52144e3ae9b43418
MD5 4ff8ea079ef981a750fac9ed7219ff1a
SHA1 5324571b944c86e2f4549a1372a76051a70533f7
SHA512 a2ca2aff6797d0d7b58dfdc840675303334d64f1f3104fa2d3d8ca34965ef94d5562681d9a8e6242fdfdd4b2d28f117cae3f775d2814e45c5436fe97fa608a7e
SSDEEP 98304:SQRQyi36YOcPbLvw2gAf+PN3TD527BWG:JQyiKa/X+PNDVQBWG
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a215a169948493424a2465c92251a8353c3fa287bb017dd74b321e40dda9c958
MD5 40a2f90763419a89be47bff0cfcf4fa9
SHA1 1991f83369580b4d0c3522cdb6e6355ee7d3bfbf
SHA512 f247a658de84b5a720a3d1e30d3fa9c7be1e1228daf39de1a4e21b138909a0adfdc1330365dd56bcaae8f2aa2445ce02d7aa66c75de517b7c3c95afb48b10a86
SSDEEP 98304:6QRQyi36YOcPbLvw2gAf+PN3TD527BWG:xQyiKa/X+PNDVQBWG
TLSH
T106667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7d81ef21688afc6065737a65ee63ab8c20f3a32866152c263bba63ef8f1bb626
MD5 db30318fdd535f4d33f2f0bc154c082f
SHA1 dc84db0ff325524f1cd78b314f813508888b688f
SHA512 604539eb873ea76e445b42000fb6a5983f2b1023476670285bb2e48a88d788167a7387932ff8d11c4bfb6711fee870e16e0e8dc81e9bb5b41f3c53ab26d520fb
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0gsqjnhMgeiCl7Ge:968Qg55nhceWu7PNU3/9Dmg27RnWGj
TLSH
T1FFB55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5f22d280317c1ee1223bbbee9f24cf96a460f43ad47d3333e0f8a9677e5ca27a
MD5 e6e8d66357d48c40687769087a361891
SHA1 5d4fe88dd9cc4b64861a12d7ba7d0a9d83941280
SHA512 79143c0803eaa2b12a3a84fffe4f908ba7a7697a8b24dcdeab44ee280fab1ec0ceaef8ac3622aef79a6c409a7cb50dc531edf95a41bd4b87b670d493b771e43d
SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZYD527BWG:pLIHEWheVQBWG
TLSH
T1F5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 34188b43d5ba532ce2917395e2807cec385d850a82b970cb6b0b40ebeba6a342
MD5 2f4369d6e418141a0736aed1a4c2b154
SHA1 1a95a5773718e724f998fe847c1e778d61e635be
SHA512 24f22aa50f9603b6e88d074b366350e5fe0ed22187ae3ea26759c790db850ed9008903bceb5bbad997358f5f2d364b3a49142756b057bf23cd46327cac58a5aa
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gltDmg27RnWGj:Tu6Jmdxd2dtD527BWG
TLSH
T1DED59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cee87f0bbecafa93acc3ae74eb0eeaa90412389d74bd5939cc3e022c496536e1
MD5 3d98cbf83aff5fdd0fd7e602150cf896
SHA1 42ed0d007ebedd6e09e9b7608f210e1d985a7544
SHA512 df15b8b4d0d90cf1aee614a4686bd9a6a38c37416e1ffce879c6282ee870125e5ed2474f25813a8b97e3ada02c0bd6a0b8b111ca7dc650ebf8d4f85eef462482
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xHDmg27RnWGj:9mifPWRGD527BWG
TLSH
T112B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8b22da3cc6e9306eac7380896c73306b02adda68c1e551f60635b5c3f337d5b
MD5 8bf42cd30dd40e44cab7a0927afe2a39
SHA1 2e7370e692e5563eddae838090a6b9df949ab27a
SHA512 1b57f542dd915cd831675322a108c24c08356a4e5591b22c3ad733fcce814788f7c7b07373153d2094eb398d9af99465877ba86caf15567509c81a62220727b6
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqsDmg27RnWGj:a5dKii61sD527BWG
TLSH
T14CC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 acac6a3b8f69cd6c7ef1e17e2c15572c6c04e1c9f8f2286a41f75999684b9d68
MD5 29dd742442314ac9a219941e9f01ba9b
SHA1 c17c1723e5d9ca75c351739e338f76421dae56a0
SHA512 34937c60edfa07d67cffbfcda865e0221f3545b7e3d760df4dcac1ad5432842a9b18932ebfa77c1241157f40a331a2449194dd159766abf8c1e3e4212363fc39
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5wrDmg27RnWGj:BX2imphCD527BWG
TLSH
T1D295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 50a07639b7f714decc2942d9beff4c71eac4cecc20ab7b9a8bf0c530826cf6e2
MD5 9b4af91357877b6939215e8feea0fd4d
SHA1 62be7f2a27b80353741c57ed4563114aa8ecf49f
SHA512 ee2cfa74314a3169bdcebc01580d035c913e1002626906496645d22399e5919d39691624679c98e86939e5f73b2dbfff8acfe77fcc81017081737cce56420728
SSDEEP 12288:ikXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iksqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A4523AE915C01CBE52649F5C3E5F10EAC173E57E92004837A9778BAFBB14984B3D826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 09b8cc65545a75331945f506b49967cca37131dee75b9bca3cb36b8d6bc9b9a7
MD5 a428f0e24c81c0ecd6161e68dc2bdd11
SHA1 3a5991cbd922359ec2993687cad2febe089a5309
SHA512 cfc34d7360f5b793fac55770ee1ca5d84b74831fe6ac0d5ceae7a7d3953f0538da6a4ebbfa610c2da784467638a000345456cc17c3cef952408981dd2b2a96c8
SSDEEP 12288:9NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BE915C01CBE52648B5C3E5F14EAC173E57E92004837B9778BAFBB14984B3D826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1a38af276f7370d176d4ecdd1cb54ec671f6531db0d2f4dfbeaf57dead0d5d66
MD5 d213ebb24a1572d535ae14d367b853eb
SHA1 9e58c35dc755f68a67d62056237c20148bfe73f4
SHA512 a6f9a9ac048b4df2df19956d10064769c78b3aa9efc4e3cd16ad42c56ac4cd176736c00f108c661710fabc5734f556d8f90ee44e7876a25ab3bd165a4c9c5d23
SSDEEP 12288:O7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE915C01CBE52648B5C3E6E15DEC173E57E9200483BA9778B9FBB14984B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3856a9148c903fc74ddf46fac1b0f64a68db7bae79405122d821f5b6c3b957de
MD5 29251f047c1a05f25da7b36abf0f05f8
SHA1 efd4ad60c73e4a883d348d1721471864a5d913df
SHA512 be3181045ad86b588b0c6cc98954ff6a3d03d0a0315aed8d021fd2b742872eb789a556fef7d8dee50b6accc16c9f3411eaf672e94729dfd53d194c2354606d63
SSDEEP 12288:LVCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C845236E535C01C6D83285B5C2E6E11DF8237D56EA3005DB6B5328BEAFB16944F3CA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ded95535b2256a31bb1c8fb54da74279f82b199b276a7dae399eefcb78be32eb
MD5 4afcfc02528e07b01b4d26dffcac16e0
SHA1 690c602f01e2bcb7c86a21b6c21a70ca13ea814b
SHA512 0f3e80001be9e61d326e9a44fcef7c1f86f9ec90a0e65db33ee43e534b9b2aa68b4e864f85ecb889c061b195ffad3d5da7ef73f124ccaa118ff99292b67ad7ed
SSDEEP 12288:RqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BE915C01CBE52648B5C3E6F15EAC173E57E92004837A9778BDFBB14984B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b312c1a388f727d481a34214daa8e604c4c60b0dc3257a84059d674e0d3fe94e
MD5 32c3113d2c5ef80011028134c732c430
SHA1 426ff2b5e5493c27eca2b507f9befba3ee0f0297
SHA512 d6ab304414c310fce6060851b2d74d3ccecef7e54f310c796d1182a5e22ce50bb845e90bf5869f5f9205acfe9167a282eb22aad792c0fcea3b7a0fa35b60a5fb
SSDEEP 12288:QBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BE915C01CBE52648B5C3E5F15EEC173E57E92004837A9778BAFBB14984B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 edfdd4f630091df243edf8d21fd332143f4f82d5ad86f6abd2c8aa77ff8f275a
MD5 63758457c458b4a04b92fba88ae29e37
SHA1 4f789ae972923ecba95be74b11c3dc905c8f7b43
SHA512 b8b393816fe50a51ad2b1dfe22ea55ad9b748c409943e7f35d696ffbbae69971e3808350b39ab35b50ee5719e8a3c69039fd1d106b16d01ead93569d6e2b350a
SSDEEP 12288:LVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE915C01CBE52644F5C3E5F11DAC173E6BE9200493BA6778BAFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 438be637fa8a30b27f669e4d3c5cd6d86a331bc7011b7ec53036a6c479fecbac
MD5 062311d83f5432453131d8cf9f64d98a
SHA1 45cf5d061739b8598d57d0c6473a7dc3a38c2910
SHA512 c6aa021cc7e5783a43903fe2b4c76e5647aed12d951806f5d4c2258f35075bc1fe0e07484cbaae9f25e93b9213de6ad1dcc09d79d675a1b7c3fe9acdb0efc375
SSDEEP 24576:6ZMRzFVSOtsqjnhMgeiCl7G0nehbGZpbD:6ZMRzflDmg27RnWGj
TLSH
T1786501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 be015faef4daa95e5dd675afae301df900a5b8526499beca4942631337f6cfd6
MD5 a2f2e27ca4b1faa8309adcc0b5b1aa98
SHA1 c216caa6ae4c5058c18eb389aae04de68ac0dda2
SHA512 bbdd1ff86dedb51f64ade4711fcecc83d0e2a2e7570b4e98e7b36fd28d9fb46bd20baf3fd8e9584456a79b0aab8094d509addcd7dae1fc56794ed08eb28f0844
SSDEEP 12288:1AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1514523BE915C01CBE52608B5C3E6F15DAC173E5BE9200483BA5B78BDFBB14584B3D826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 468e90b597ebecefef79016044466a2c0940e631d5a5b2886b8b0065b9cb7934
MD5 216c2c55b2d925f87e9b5affab696dc2
SHA1 abdb94f37a36e96a6f9c51a9d7a25f6eed81aafd
SHA512 02bd3621141554c7f3c3d4fd3519d52e1cf7bbfe06f5cdd0ffe3d5501e7c0b1b84739e1fb7783e4b7c00ac50fea1005a7cfc1cef8ef2881e1c91c70447d1ece6
SSDEEP 12288:78Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:78sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BE915C01CBE52648B5C3E5F15DAC173E5BE9200483BA5B78BEFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c9f404e5055ff5807848f57c13e385ff34c979ad7bb75e21f7c57de14c2b4889
MD5 03673319b08d4196d9ddda3daf410d19
SHA1 040e77bb4473cb4564608c52ca9904a268324f54
SHA512 d5fcd564e4aeaa613785a37da5f8895bc00806422031bb39385e960fbf0d331576cb44dbe90f54ba518b0297296748dabe7de16970d46d2e057fb10ea53decb7
SSDEEP 12288:xyPz5L8ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gzyZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19955025B73A530F9D1368178C5A29A06F7327C3647204A9F17A516BA6F336D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b651e738b73a874bdc9b75673d96bbed5725157f9788c94a731b4bcbf09f5307
MD5 24f2962ad42040ddb2cddef67bb3ade3
SHA1 b081a1a2859c1b483a09d21c82bdabd67db0bedc
SHA512 d17058b377c88a3426ecf99a5ccbe980f713141470d1c7793cd6a19b5517e337ebc65a4b02f1bf7c5f2e128b3668f0965f683584198d412243b64a29447f3543
SSDEEP 12288:QAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BE915C01CBE52608B5C3E6E15DEC173E5BE9200483BA9B78BDFBB14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 14a2d7f193ce8376e231247d9d184dff66b00533b0a90333e1b91ced35f9d7a3
MD5 7adffe207770bb2bcd33fdd3459eb44b
SHA1 f2677ea31c19d53575e653ed7c86ec93d323c9ca
SHA512 1aef947ea065383c8eeb112a57c6c30da637330d621a4d13a1e24c6bfbb1fa8ffed16f73a9dc65f97e1be1d4b3267472debe791039a530f165746722517ff59b
SSDEEP 12288:yAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A34523BE915C01CBE52608B5C3E5F15DAC173E6BE9200483BA9B78BDFBB14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 13e29cff33f78e24ddc96c3fe821170659815bf81b3b0fd38d4dbf24ece61089
MD5 33010b327817eeabd63aec7469689c94
SHA1 8a389739af3ba58fe8ed3d000d1698b3b7b60ff1
SHA512 ed74bea64f11b3a5cf48f396fe29f6d73c66e8e912d4386301f6453db96d4693b1692278a95a78a3824de67b410f905df36445ed055e89d3a2c31ef10a53f499
SSDEEP 12288:/yPz5L8ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzyZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A655025B73A530F9D1378178C5A29A06F7327C3647204A9F17A516BA6F336D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b081b1fcd72a4027fdb9c1527154d6c6fe214d189a51bf4642fd5d5519f5885c
MD5 67c1b594ad2cd7b6309ea90ccc9769c5
SHA1 5ac3ecbc4963354d57cb5c690db05822cb678c52
SHA512 478813a42e4d57fda29e39a38fa145b06abf14bbc1b34f074058699d10bb215c65cfacfd2659849e1573ef56cf06470a7b59e6e9c6b6cc47c2634a7de70df12e
SSDEEP 24576:mTDaLl3z0zDrsqjnhMgeiCl7G0nehbGZpbD:mTuLlj6Dmg27RnWGj
TLSH
T1E96501A9B35018F8EC67813EC965D90AD5B27C5A0B70CA1F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 892fccc94670e3d4a68abd69eccb94694f68fd4b35e23752fb7b3c4daec896fc
MD5 7f722c0b1b562b263e407a3f9ff1a467
SHA1 87063ed2207bd841c16f99ad32961866f4eee4f5
SHA512 c706c2bc05b4d23b8b3c57973a9a9a6ed2b4a09d9416bdea9cd0ae078e259dba96f9ceeb126251626646ac6673d8502ef5840481725323d6a0e168ef6611ebf1
SSDEEP 24576:v3vd9CHKy7GZPsqjnhMgeiCl7G0nehbGZpbD:/vd9CHKyalDmg27RnWGj
TLSH
T17675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6821a4c03f23d63ae6afb0e2f3ba7f2a991299d1e315b15810ac5e157567a15e
MD5 f68657836517ec9394f9c837b5319d32
SHA1 608a0be833851a9198942ec780d2992b2f0d8947
SHA512 5635b3ba279b879bfdcdd8b21a20005bf71962eb920d8cf0c7a9bd5e609aef5a50695b4df07b215f3d5b4d35c2d81458c77bd10fc1371e387c20832391194dc7
SSDEEP 12288:DbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BE915C01CBE52648F5C3E6F15DAC173E57E9200483BA9778B9FBB14984B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d07a7daaf5c3914003ab4146b4a3189f8aebcab6155bb8c69dcb3b57a3908c72
MD5 808f0e66d7693f35f47e15f3825dedc5
SHA1 8d49e4ba942d08e705bfc1f458b90a930ddfc38d
SHA512 80f6eb4dec2b1837f6454e3ead59ee35ca1ddaa2f145bfec3b83c27a81d366c79bd6e6991eafb2c97be0931e7c1cf7441e79ca382f4f954a30f1c203f0c27787
SSDEEP 12288:Z5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BE915C01DBE52644F5C3E6E11EAC173E67E92004837B9778BAEBB14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ec5e2b9cb4caa31d129b7dd36515707aef4fb09c65ed7c1ffab29d53f781f33f
MD5 b9342629d5d380898940ba19781de841
SHA1 0943aa101ecc839d9ad8117478c3bb8b11511aaa
SHA512 417babb9496d2107d5be69b1826610d251fde1e71a0b37e471527f7d3fbeda43c89d578fb0dfc90df9b4b8acf486398a6a859106fb61f1714ec08b61b38f8ea2
SSDEEP 12288:n+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE915C01CBE52648B5C3E6F15DAC173E5BE9200483BA9778BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6b9b0fadcd4e8106f1aedd6189f6be985979a7cbbf92e3db86f705aaf1a610c3
MD5 6fce994a555a9f92f486fbbeeec4d120
SHA1 4cb4ba8a4d4af2d5dda1ad86133f49ba25f30d83
SHA512 ce90ef196f8509aafe0d4f3ffd3d17235bb4356489af3b4cded5ca1f139e9a3f90569ff76bb43a387dd29ddfec50d2816ae954c7ff3a553d32dee4820fb0467f
SSDEEP 12288:/AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE915C01CBE52648B5C3E5F15DAC173E5BE9200483BA9B78BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 eada9ea1ef31433bd142b077bed540d6874c8f33910975ac2e58be698e807c76
MD5 b81d38f3eca93c618d51fe4fc2ab8c91
SHA1 7c0d70c539176ef3eecdcbc0f7461fa808a6a91f
SHA512 563a3a57740fa06e07333ccde7a0be81c6660510770c5ca076a9e23c38051e9374fa8a746357ec721a7dace533ec7406b8a0788dd7a8ee04f837ed1809867dfb
SSDEEP 12288:WbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BE915C01CBE52648F5C3E6E14EAC173E57E9200483BA9778BDFBB14584B3D826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8e94c5dad6f35b861ea16b6b381df1772d686b322ecf873a946e4102657ab3cf
MD5 f20b28a4aed60178f4eb67e850e0b46b
SHA1 84b484a04dbeb92c4e66d3dfb793d903cf8ea66e
SHA512 e0c643723ee6dafe8f8cb4d1f71124f8fd74e3c34aa9e48e2c85ce75b4d0d00da4261b2d547502d9af02938f02f76dffcc0065dbedc1cb233a21b03ac66e18a7
SSDEEP 12288:DoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE915C01CBE52648F5C3E5E11DAC173E67E9200483BA5778BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c68073cdc8159a52434aa5efc74a9fa74b830fe01a569b4b616433abf849c5b1
MD5 fadea82585e2873b08006a78c2eafae3
SHA1 4845713fb627b89839d03edc0007b0b7053b754b
SHA512 4ee5c5e39903a4bbb298c48a29232b08d7dc095a09ff1ed669c564a0d8d1014e0329f40d4b10641277d570a3e9f02c2d736b5cc9c6fdea11ab5ef4dc45c9816c
SSDEEP 12288:AqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1084523BE915C01CBE52648B5C3E6F15EAC173E57E9200483BA9778BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f68b64b30ed204a551317dbdf730ad37e9f4a358d54252afa1af5efa91e7f74b
MD5 50f10a6c6296fca457bfd390cd3730e1
SHA1 10586dcda1618aab27132148b1b7eccc60ed376a
SHA512 f3507df35cadf583977c0c48ba1776ed2c38c399d1c5fc7098dccf0a32b722734bc82f047048e449082c7b09e6aebcb55ecef7eae57e31d0269c9ea7152ac7a3
SSDEEP 24576:ifwvUk9RX6wkyAIMsqjnhMgeiCl7G0nehbGZpbD:yMnYI4Dmg27RnWGj
TLSH
T1FF85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b1c334ff563a50867406a4005692d11bcb0fee7f21477d2abbb39f8130799a5e
MD5 88531db5167ddf67b477798ef7a793c1
SHA1 6610a5555e8c413e15deb0d97d9ef30352938ce4
SHA512 52d9cad0094912a0e705e3584551d62c123688f8cca53e33f544cf1eff149f2abcc8a1ae98424c299a3d30b85708d12d91b86b0e1e79a4d1d3f25e9d9d3501f2
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LDmg27RnWGj:sySzPzD527BWG
TLSH
T148066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9d5e98c9b0baa264a491a792bbe2696932ec8edc3b22c1bad0d23f93764f0f5f
MD5 02cdf3f7712a81be6011b9cd2bd20bb6
SHA1 a02649b2a995b807add2a98f00da259f4648bdb2
SHA512 63ef5ffce02fac5c3c202683cfe08b2010750be4fd13d797eeafaa0e216479074931ba05de2131f0fa4cee01fca615bade9ebe49069c48e8da73c7983a09f299
SSDEEP 24576:E47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY9sqjnhMgeiCl7G0nehbGZpbD:E47JUQjTirIhCnDHUPfF/bDmg27RnWGj
TLSH
T1BD65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6659a04fc0029af4285aea4c260376f189a41038261c5dc031f3b22be92ce8e6
MD5 46f4aaf6c75c6331d551f2953aba72e7
SHA1 8d13cd47ad7aaed288867878f7eae6dd9c8e5ad7
SHA512 6a302392d0068943e93bd0ba484ef8a928aeb0556c48c9a13fd1d6f000738dca7dfa0dfa1899c5f9fa236cc39bbe7ec476eff586424359848c4f88c46f8c1cd8
SSDEEP 12288:/bsfwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16555015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e407024197587b42f280e6d6f8552acd8c033eac10f19886d922ddc7b1f00598
MD5 ea54460b587ca0fd3f724f5dd8af99b1
SHA1 cd2b7454973f46dcb75a2e5a704b81a3812dd8d0
SHA512 ef147a0f5eeaa253476219690a0fdb8d4a0717f219c5328f86eddb1001d650d205a5ef573bf9ba386c4634f4ae5d01b227ba7682b49f7fd83a968f30854e13c8
SSDEEP 12288:pxEz/U3fmGDFkXJgHPhlur7fzfKJOB3sJtefZxNaOh8gMJj+GYKnzy:pxErUPmGJPPwSYB3EtsjNaU8gM8FKnzy
TLSH
T18E4527407626CB8FC6A940325E36D6CCA770BD05FE446F0773C9973F8476659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 3425af6109475bfc7dde8d9f9038953f5f9a9731774a66cacba7622d18b137ee
MD5 c2ff6d0d75849841521ba1667fb0bf8c
SHA1 3aaa768c3868d6b5181da9bdcd1e0523fb956102
SHA512 5c2da3f1be5d8f81c95aaa6729642a6d59ffc9fdefa0a4a62b2d0992e2dd87af870c53d1260aa8edeea87f5026048d6b5d7f7d6ceca72c8c8d779d58f4c0ffe7
SSDEEP 12:KzvRWEEEEEEE8OZ/XWkEEEqaYREEEAVKsl:KQAMK
TLSH
T17F42C2980B12AA28C52FE4330C5E73381323C0969ED6C7E78A0C20C4ACC01984E50728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c36bba96b4ac49af34b4383418027cf08e705c60f0160efe6ac947b34f8376a2
MD5 df78d53902dc58ed4aa2023dcd1c8f36
SHA1 2e505c53f13e92a4ce54c7d2a9e81921440b4633
SHA512 9cceb229a75b472bf05890712de1ce1b049868930e66a7305ce02d7c4a25a62f7d922210ec3204bc80040ebb45f04e70145b6f65af8539d60ab1848c964abe85
SSDEEP 12288:9IFCXJgtGlIaXr2CpmFizgxWM/cPiYuOKzD4rJXJLFQXJEKTWvHOblZek1t:0INbLYgzvMWibOu2OBYk1t
TLSH
T127552A4065B7EB4FC97A9037173286CDBB746C06BB893F0473458838986796EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9d49531e7705e46648e8b03e83bbc5566b32d249c65b9104430942e66f2275de
MD5 5c4e1e40c9dec0058e1d3a02172a0b55
SHA1 00f2305f00cd28e392e4466590fee99dd88d2332
SHA512 1269ceca4ac939d8dbec4ffa1d6396871c617d299ce4bfa0459439bf31053e6ce279488b0a281b43acb6ebef9d58f7c8d780edfff7e44da665c031ac0762028e
SSDEEP 12288:E07YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A145237A835C118AE53609B482EAE12D781B7E669F1044C3BA5778FDF6B18C48F3C517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 04226efcbd644470e25414af3a3dd0fa8200d4e3ade7e2c18b982616fbba8f08
MD5 6f4ed9cb44945f843c20963c211b46ae
SHA1 0c0a59a9138728a83b215bb52a947b84998f80b9
SHA512 bfb61efe6be8ee75e0ae3e2877a421aea6be3e2328d3a21e419d7c41e24d6c33c195527204c7876e2cd1b91acebcac426d236d23f4d33099ffc3104855a0df75
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bY2sqjnhMgeiCl7G0nehbGZpbD:wgb4mBIBhGFhDmg27RnWGj
TLSH
T180659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8236a600668a5d533a04cb2b130160a2661b7f997519601e9199490261ed7bad
MD5 c35e7b4df3b2274c4756d608d7702457
SHA1 2dbcf053c04917cde84f9e215cbafbc6fcf23edc
SHA512 0abc7c4ecddcfe8b2f6b6f98bfa15e54aa2a34eba23815596fff7dcb6cd91cf9bf1899d84f71a533617178448e288f733227f704a3cfe471d55c39ee00fc1d11
SSDEEP 24576:tG88u8FpJqH1bzria7/mtsqjnhMgeiCl7G0nehbGZpbD:g7ZFPqVea7/yDmg27RnWGj
TLSH
T1C385F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 312f876578fc3aca1cc20cb519f40687fe21c1331c7298af8f40e2b289e28502
MD5 671a63eb7ba34d89a937b8d5fc50bcca
SHA1 525e9b122a775ebe866a3d8f0251446a2567a57d
SHA512 f45504f078600ff1baeb5a8ee480c7da1aca3f351a0520e4378055d7efc2fb6c77042c98c71be4cb8bd4eef0994000cf64e65578af57281e2402b735cd4a7e72
SSDEEP 12288:NHvUrBFrEjwaQRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:NPUr+NQRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16265F12F62AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b4c8f82c42c1b583be29c5cc5e3472812c3398ab5fd8b2fac6aebcc8785b6bbf
MD5 8a18d248233111bb3f49ccaf424363e3
SHA1 1cd2b5d92517ffb096d46a5ef77a92b8c733e094
SHA512 15fe3daf80775242571bd15a6ea4512fc37658db242783ed793af0ae37da8045641932688aaf33ab5c1819c0e0ed3b545f398e4a7930eab966923725e052283d
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVDmg27RnWGj:9G05lO43bQD527BWG
TLSH
T1D0D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0805a5fbb85b2a60c637c4fc79812390812975d53e5a0b820e81fa97efd46e07
MD5 00d95b7df00392c134c8705a36d2e5f5
SHA1 026a078ec2ab8673a98828d7868d666d9dd01b9b
SHA512 29e76c76ff96f14dd92bf381e50f902ded08cc755a88d2dfa9a7e8adc2ed96e857595793c5a503e005babc6ae581935780ef93ac3db68223ba43624cdfde28a3
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn3sqjnhMgeiCl7G0nehbGZpbD:aa5POZ3BJt2pasx2+m9Dmg27RnWGj
TLSH
T1C965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 071b822adae1ab58d57ebfc3b8f92b536ea17d84ab9f60beee12e89a552ed499
MD5 b28a5886a1086c678c627cd91be8b511
SHA1 6cbbdbce83fc6c51346eb176bee876e66ddd3313
SHA512 5b9c915f00ce19a475ebc422ddf617b737fa557cdf1290c6b6c8f8c8ea92849045dd769913cce25cf944e68a39c76a35085197e44f719535d00fcfa6f22f9489
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkFsqjnhMgeiCl7G0nehbGZpbD:RNc/zEOVHFSDmg27RnWGj
TLSH
T131857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 014e0fb98d634cbe7b9409139f8617912916851b10f866de21e84f5004367ba9
MD5 5c3970f1cc49c567f87fe1afd4ce0420
SHA1 b3f65ab20ce864aae8624ab181d59db00caf6ac7
SHA512 fbaeba9e3b1cef11171f19bbf52eeb0df6762fbddc874b28d94579f9ea87c7e5977aa2d699cb64925e0e98e573dc3dbba15cc4292af00706a9a327c01e0389b1
SSDEEP 24576:k6DIWaKngL2jdshRTdG1YxITqvfPkbIcbjLm:k6DIWarSj8RoTCCW
TLSH
T1CB25125D63AA01F4D06BE13D96934506E5B2B6B483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a8bdf7881f43dfa382054ea4aa9bd20704d8443b2c73e56a4c2c59589b890e2e
MD5 c8c1c2382aab105df9ee738737e62fd4
SHA1 b652b278ce50038c2687a88d6c6bb431b62e074c
SHA512 71348f26b92ef7c3450a234b8cee9cdba8002cbcf962cea836d6a77efb5e7d70e3b7d9166026c248e48512997bca0e1edf5af6134cc9efed017e586406863762
SSDEEP 24576:9D3FHshBIYQgAEsqjnhMgeiCl7G0nehbGZpbD:9DVHeBIAAgDmg27RnWGj
TLSH
T16975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1292-170-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1292-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1292-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1292-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1340-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1340-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1340-333-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1340-121-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1340-128-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1340-122-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1700-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1700-147-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1700-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1700-156-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1700-154-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1800-82-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1800-89-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1800-83-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1800-257-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2384-316-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2384-105-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2580-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2580-93-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2580-299-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2580-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2864-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2864-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2864-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2864-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3596-108-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3596-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3596-109-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3596-115-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3596-348-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3596-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4088-13-0x0000000002C20000-0x0000000002C80000-memory.dmp

Download

memory/4088-67-0x0000000140000000-0x0000000140D56000-memory.dmp

Download

memory/4088-19-0x0000000002C20000-0x0000000002C80000-memory.dmp

Download

memory/4088-46-0x0000000002C20000-0x0000000002C80000-memory.dmp

Download

memory/4088-45-0x0000000002250000-0x00000000022D3000-memory.dmp

Download

memory/4088-0-0x0000000002250000-0x00000000022D3000-memory.dmp

Download

memory/4088-8-0x0000000140000000-0x0000000140D56000-memory.dmp

Download

memory/4088-6-0x0000000002250000-0x00000000022D3000-memory.dmp

Download

memory/4220-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4220-61-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4220-62-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4592-133-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4592-135-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4592-141-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4592-336-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5080-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5080-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5080-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5080-80-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5080-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download