6ba36d7eec23478f8cb9a2a5a6b3155481e6ef8347cf5c74698b934b4c232abc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 2.0MB
Sample261011-vfmg1stygs
SHA256 6ba36d7eec23478f8cb9a2a5a6b3155481e6ef8347cf5c74698b934b4c232abc
MD5 385b429c26f11b0269479654a5c40853
SHA1 9133b6b719e7b322ba3694812811b6904bf7c293
SHA512 364d49a71941975746187afeacefd3745b74018a2d41623e6fc00324838e26e85859019c6521dc669c4fd53d8f0250393d903e7712fb2164eac84e68002b7c9f
SSDEEP 49152:tMmi8sR+ft983Dl3gEe8xA+S7SDPO7QD1y37die4h:0R+l9EDl3VxA+86O7Zah
TLSH
T19E95F015B69812FDE177C1BEC9564525FBB2B80687628BCB03A047572F2FAD85F3A301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5468	elevation_service.exe
1452	elevation_service.exe
2040	maintenanceservice.exe
4648	OSE.EXE
5744	PerceptionSimulationService.exe
4748	perfhost.exe
4684	ReFsDedupSvc.exe
5672	SensorDataService.exe
1272	ssh-agent.exe
3508	AgentService.exe
5616	SearchIndexer.exe
1972	240889421.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\aFoj.bin.part	240889421.tmp
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5841bb5fb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\240889421.tmp	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4920-0-0x0000000140000000-0x000000014047B000-memory.dmp	upx
behavioral2/memory/4920-37-0x0000000140000000-0x000000014047B000-memory.dmp	upx
behavioral2/files/0x00010000000093b2-49.dat	upx
behavioral2/files/0x0001000000009323-48.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	240889421.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	240889421.tmp

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efa60e72a159dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076408872a159dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023805b71a159dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d9c2772a159dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc353672a159dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033cf6071a159dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5468	elevation_service.exe
5468	elevation_service.exe
5468	elevation_service.exe
5468	elevation_service.exe
5468	elevation_service.exe
5468	elevation_service.exe
5468	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4920	2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5468	elevation_service.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3508	AgentService.exe
Token: 33	5616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5616	SearchIndexer.exe
Token: SeDebugPrivilege	5468	elevation_service.exe
Token: SeDebugPrivilege	1452	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 5136	5616	SearchIndexer.exe	103
PID 5616 wrote to memory of 3376	5616	SearchIndexer.exe	105
PID 5616 wrote to memory of 4312	5616	SearchIndexer.exe	106
PID 5616 wrote to memory of 3952	5616	SearchIndexer.exe	107
PID 5616 wrote to memory of 4980	5616	SearchIndexer.exe	109
PID 5616 wrote to memory of 5836	5616	SearchIndexer.exe	110
PID 5616 wrote to memory of 5776	5616	SearchIndexer.exe	111
PID 5468 wrote to memory of 1972	5468	elevation_service.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_385b429c26f11b0269479654a5c40853_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\system32\config\systemprofile\AppData\Roaming\240889421.tmp
  "C:\Windows\system32\config\systemprofile\AppData\Roaming\240889421.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 42d9034717fbaa0233693095b23a88a18da3043c8e943bcb01aa166872844989
MD5 a73a0196e3d0f241cc1c5b53bf99bd24
SHA1 ea3d2407e3dd7506d6213b94fd47eb08c82a251d
SHA512 a9b0d85ebfe178aa51a87b9fbe7f7bf97e667ba4b5ae4946e4422df6bfb78a983d1e5771aa274c5770a63d9c0c333a24592f9b980d4d7bf71cb5b11f5c529338
SSDEEP 49152:qb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnrR+ft983Dl3gEe8xA+:c3q60jBkR+l9EDl3VxA+
TLSH
T1EED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cf4d8ee6a665234978dae720d3f60c32790d26f014bc102a410dace28cd1da4c
MD5 2ded122ebb0d7ca696ee4adb1d7417c2
SHA1 fbb1ea3fcae15e22aac6377a4e0e6c763b0da0e0
SHA512 09380660f58025f83c0de1ad7686bd671428be411f8a6f277a9531923527c847fb160276b5696448c0475a19295a896ec025571c9dbcdb121d99d4b3503b1022
SSDEEP 24576:AXYfDtczAYRPWxNs298r3OCDIjG3gE9ow+8xA+:3tcNR+ft983Dl3gEe8xA+
TLSH
T13405F12877D408F5ED6B827DC9A28512E633BC4547A0E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ffa7386b043c731646d0c3bd14171d2d110c0b6ba3c01e436e12cd1885dbe014
MD5 faff8022ada9bc59e674c44de45b6d28
SHA1 6939475d212cf6252ae8edde18fa0ca187cdf86a
SHA512 279e0ec6780b362dfe46f11437b9da1d0608e096022d7efa85d63e2543056865599e2281a6f65660b680b85a75d61e2dcc36accb7ebf67418a7bfae435868958
SSDEEP 24576:l0Le5ji0hmxNrMDRPWxNs298r3OCDIjG3gE9ow+8xA+:lPji0A72R+ft983Dl3gEe8xA+
TLSH
T18635AE15F6788331D073C0B9C5D2A69AE97230865B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6876877aff8dc28ec9e38235c9a768855b5f3de615f2c35b939a0f81ac5d70fb
MD5 26d368b76efbb3610ccf99a1cd959e36
SHA1 6049ea39ab5738644693b8f15f6fa730e2d93724
SHA512 12913364db4af7853777223a2044b964163b7255a7667e155e8f20f6fc02e2eb410b1e035342316e2c7138702dc40903edb881dd8207ddb3bc6ed44610c7f57f
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWr6q8wyu9RPWxNs298r3OCDIjG3gE9ow+8xA+:K/ezSC6vUzPviHjyqR+ft983Dl3gEe8H
TLSH
T12B755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a6d5f8d440d5c22de6b485f5215d691b4496c5c0e3e50d71522235248e56454b
MD5 d0e1a1be04a2d930aea05578c6230ded
SHA1 576ec95e4c633b91e9d4d723f1bc5ade691a6e6b
SHA512 4a80fc3b1bb8bb717205122e754ffeb32ad45780fa4d7859b74150cc48ba1d2509ed6c731a5a44425ec58b4979bb6c5d1505bb390a85a1bf14e8f981025d5bea
SSDEEP 24576:wVbqPb88hv/l+bURPWxNs298r3OCDIjG3gE9ow+8xA+:wVO88hXl+gR+ft983Dl3gEe8xA+
TLSH
T13F55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8b7b35b35e3df2b6ee144665d65e2c7162aa3a19b6a26e8c8be5e784179126cb
MD5 88c5a54b3814a056841a28542946df56
SHA1 488879592096bfe5629c56acad2ac54d73decc15
SHA512 a04eeaebaf7b75b656a644806c383874940402f3ec8689d9a4087000dc80b7c282aa2b8a1f75b3f728401d56e94f8ebddd2a587c20b758c5c189e771a39b70ab
SSDEEP 12288:5j/RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:5j/RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T125C423042D4C35C2DB2F91F599CAF0E2A0339D4D28F939F2D461EAA2AD7D25ED980177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f543f70b2f0bb6bfbda0b4eff90f38c725f9b533738a926b9147cf3e80f8887e
MD5 bea55c808ef2d74d72f00483b3b64e64
SHA1 3563d5edb03895073fd63213baaa566d10338211
SHA512 5fe36c72a25dba076fd173cb2e084a94305cf052e5920683a04c82eeb441bfcc9a28b21b3d81b17673165330a930d65d779e859b7c57480080b47451cdc89ebe
SSDEEP 24576:xJIUMRPWxNs298r3OCDIjG3gE9ow+8xA+:xJIUMR+ft983Dl3gEe8xA+
TLSH
T15405CF3BAE28FCD2C27E8DB95A91C240E77278304F61A3CBD165820EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e1c40df04dfb0aadc659a034f1bc736f291b48be8410c85efede1a45226be1d8
MD5 f106adff79279f3a172adad85fda587c
SHA1 c5d46c7baf8325df343b145a4ba7ee456d74cabe
SHA512 c574fabe57c2ae0c18fc305383bce2342e091c2bcad678b1ff7186ee30a50110636186f8fc65a516955069b07269c0d8610fcba6a46b961fe434975c8ce8a0e8
SSDEEP 98304:6QvGAdlCEL8c/RRNw5CtR+l9EDl3VxA+:bvyEYc/R3w8t4sDlF
TLSH
T181267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b0c9af7e144eb6b85d5f0a97f46a65a4492a3cc2264be8abd3625402692ec8ee
MD5 48fa44dba271610565db0b40356fa17d
SHA1 700f2c02ff7095242fd864513f03d444d2b0b042
SHA512 c56dc5b4d823a64fc4edad9e35a06797bf676f265d792becf6d6f4d49f23df4e47186f2802c6e2686ef114d790fd492f0d4266ca11ee732ee30748e23b027dfb
SSDEEP 24576:uSewsAjmRPWxNs298r3OCDIjG3gE9ow+8xA+:JljmR+ft983Dl3gEe8xA+
TLSH
T19815E030FE78E032C77F0DB61B26D716543D79204BA119C3E3A88E9E59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b05270b2ba82642eba37613e8ff4b7bdf430e35219f41a248095f269bb4b575e
MD5 52db0682ecd778ec3c4b2a8509a709a5
SHA1 02361da6f7d270925bc0a339800cc2824061150c
SHA512 d4ab7ecae49a24387af133cdd0d3d7a1705c75a65575d16113317df1d685b4c4dabbaeb31f1683844fb7824fb2b734ea67fdfe115cc60153f2a822f8ce781e33
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHu4sDlF:WUEtQevvqc2W1cpV2RI32A
TLSH
T148474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a0b60e87ec58d9036f0be6ac0192e09eb3141fbc8a381d8d61b1893c8071c38b
MD5 5e007c3fcca02e39114ca8724e997867
SHA1 9674123f90a86014a47ca61e1a4b1e7ea99c17d4
SHA512 96fc3ef68465f6b727c483e67b9757b9d5c7dbdb230025df754026b71a9c5ea8405a4e7518ee4e5101259c42dfc2f345e17ef2f6857a56c9748529281ec6e7d3
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zGR+ft983Dl3gEe8xA+:+oquVjnmhR+l9EDl3VxA+
TLSH
T1D1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ef6b0b9b9a02bf797d6ea9fb038b126874bf2940b9cc1d1fd4c4211b91fec24b
MD5 70d147087f3d33093f88c9ef4915fb68
SHA1 10c3c317d9621d8d300d17c8b334aa141c653b6e
SHA512 24239291af07141c31c73816d42284f93967bda1888a48154edb535e32a60aee453dab3da64fccf62a265712822e6b07f532eb47f6848996058cc477f840828d
SSDEEP 24576:BAhGL2IFoiwtA5l7S53BRPWxNs298r3OCDIjG3gE9ow+8xA+:BAM1Foiq5RR+ft983Dl3gEe8xA+
TLSH
T17235AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1237668f2f42c3370aada4c51a6930b1b4bc6d2c1ca902cee6dfe7ef6da06af8
MD5 adacfeb0dcdb095d0ca05909400945d7
SHA1 3ebdc61ce5dd2db949df52c3a5647786b33f8419
SHA512 c08b302514b7e18fe57c8f0a9a2b72c0525d3f2e88de6c3694033c837021f1dcc371d7de26098c5d3bef88b46067c7a782fa6f7dafac87e2cc664178283870c9
SSDEEP 24576:nwuXOWKRPWxNs298r3OCDIjG3gE9ow+8xA+:nwsOVR+ft983Dl3gEe8xA+
TLSH
T1CC05F14536981CF5E96B81788687D132F7B3BC022A75DB2F4760C65B6F37321AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 62ab813e7889d27cd09b939b4f9c75c46381bc8715bc3e0ea6c9a83e9c509044
MD5 02937039b183d609e79d423964306977
SHA1 5039f704195bb9807e1292ad2c592f6d738dce3c
SHA512 1f467d0231837fda01a91773cab725d7f54171553877698a80aa2d7bc9b36e94e8510daffcff976756a778683c04ca3d9938badfb6d27368c963c00cffaedeee
SSDEEP 12288:Q/Z1IyWRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:UZubRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T157E412493A9C30F2D66B82BCCDD59141E332784627B613DF542186A66F37ACA9E35333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 805fa9dd3d7590725f04ede397573f3283cb85021d4178c87c29a00e12439af5
MD5 db906b9ac2e8aca28399203c9ba3abec
SHA1 fc25fdeac7a47366e5c01c3d7de580b427688f94
SHA512 1d3f496cb4425727726e1a7ebeb393f1a3088671a519e04a82ee3fe402a07af1520ea3710dbd6b19e7c42bf1ea254228e6af90943f1b94798de8c5b0153d4070
SSDEEP 98304:tQRQyi36YOcPhLvw2gAf+PN3QR+l9EDl3VxA+:EQyiKahX+PNg4sDlF
TLSH
T1AE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 35798c031c57e0f093a362a66109eceb306a7be30a6c47fad90d16056be629ba
MD5 e89d79f5f538a331a34a0152cda7ef01
SHA1 0e90741fffb15c93734f99416592d0642bac466e
SHA512 113047e10fbf4eebe35cab6b900e167d2e944561f079e1d410ddb61b28a08a9125151c78f1fb22d079ee5ed85684d0418bfc44b2863525d7b557111d8fa4af6e
SSDEEP 98304:jQRQyi36YOcPhLvw2gAf+PN3QR+l9EDl3VxA+:yQyiKahX+PNg4sDlF
TLSH
T1BD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9caaa6fd7abb3a9ad1d7bb03c984ca3622a0f4da3b1856b1383e4329facd7aa2
MD5 e664aeeae5b9118c81250c206c59595a
SHA1 7e165d523068cc4def90416a2410836da791403f
SHA512 16e59f5245235af9e85755c324bb2946e41a201dff1e14ffe4faf0623a6ea85a00d5296d5ee88ad33799d4f36308a276da3eb70a9a68dc45edf2e0a325f9484c
SSDEEP 49152:N68Qg55nhceWu7PNU3/2R+ft983Dl3gEe8xA+:LthLRc/2R+l9EDl3VxA+
TLSH
T101B55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1920a10683eac37332666688a644a0cf80aeea81aea83da59a31093230294686
MD5 86a880c0c90eea30f5673b75f5e3c5e9
SHA1 b3c3cecde87c24c4c02e0c8f368812f319e6a174
SHA512 ab10c1d73ab26702fb88a4cb61cde57645c213540210cbe53c70eb84360221c3db59cc8591581f065716b748af49022e06cc2146a8ccaf747d516aa0d42e3d75
SSDEEP 98304:dy5112gYy5azzVva69nLKnhZ/R+l9EDl3VxA+:ALIHjWhJ4sDlF
TLSH
T172167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0a941c1784d147d54bb590ba2334ee733f7fcea613a4d509b7906a2cbccb53f3
MD5 72080cfcf15216a9cb1ebeef8e861e02
SHA1 b122e448179090c3c20a465bffe1df10c6149b55
SHA512 908aad79744ad424c4c4ddfb8ae16fecd2376538b67d99fa2864f9330ef4594c632b87964f60569fbe82833a1f68990c961f581fd22e0716c9de1fab43f99834
SSDEEP 49152:CB+taZ3usBWOBr4tEG20bqx0z+n217aau1glBR+ft983Dl3gEe8xA+:wu6JmUxd2dBR+l9EDl3VxA+
TLSH
T1C9D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d41dd8e7a54e322a16a5df03cf1cfd3d247cfccd638b6cb4e54b5a0c66298289
MD5 27c21e195636d56ce4fe8624d57ee632
SHA1 d2ade3428be3d7b312de04a90c8b97e0de1b65ac
SHA512 1353a79f0b1242143c2054b6acb16a861b87e42dbab15ec3148f23c76f85e3b9897cba062dbaffa36d0e33b8f69ae8a2fea8fdf87eeeb3a1049d6e73013d158c
SSDEEP 49152:V1hpsNoJpF1A6BU44CwH7R4xsR+ft983Dl3gEe8xA+:VmifPkRhR+l9EDl3VxA+
TLSH
T1A0B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 319bc184ce4a40c24eb7a6a2a72d0616980c4d8d6dbbdc16e4e22b810a5879e3
MD5 b02a97af3edfdd2b340a3c931436584c
SHA1 67b8ddc0eb5f643a4789a1595e4440d1112c6869
SHA512 9047103408dbfd38bee1f19cac7caed9fc5a0b81b1ab1dfd667980fc8552ed527f7063e85494d0d884a0944b27b642876c8dd1531f1b344f60e6598d8201aba8
SSDEEP 49152:cSuZQIY0Be2KNRVtOnks6NMHqbR+ft983Dl3gEe8xA+:e5dKvi61bR+l9EDl3VxA+
TLSH
T130C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac6520e3e0fda13e3e584229f716f688a2835fc9e5a4ec5dfd2ea9a7a0d3c904
MD5 8b403820c4ea2e8817f2d12e70e1da1e
SHA1 a7aa15ffcce9791b7ad42186518d15ec373c55b6
SHA512 3c2e33ac03e7f62fa1c2e8a49aa9b8aad3b95888d70a58fae16055bbc7d61c165fa147daef6ddec3e5fd91c4ed943eb321c6e08be3374cd40786433ea044d389
SSDEEP 49152:ahtSn8EApI0figXgiDn0AP5wYR+ft983Dl3gEe8xA+:bX2iyph1R+l9EDl3VxA+
TLSH
T19F95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 8aabc9ec80250c4c5f49d110ee37cd24b5bcea7b9fc00efdd3c59547cc54718b
MD5 c1db5845b98c1542dfda1dd1deb84814
SHA1 80bfbba5f3a99c310fc62425e0ad0f34a65f93aa
SHA512 0aa15a91a34cd9efe6f5e4ed9ba81aafe44e659dddf5bd979c9e4bd053025dd2879d2008e1cbcbf9f9380149304511b26c2b9beca8163bff6766746d0e447ede
SSDEEP 12288:H3RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:H3RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T15AC423043C4D25C3DB1F81F59A86F0E1E0375D4F78F925F2E4628562BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b69213e42bbe39215ee54ef378caaa9a5599500757df922fef19536bd00750bc
MD5 e8b273edb5ce1113f6d871ff207aef9a
SHA1 c66798816ca08a690fb380fb98c5ad8195e62c62
SHA512 574e248fa8472a5c24ce92ade2e0e1979429a60cfb973e50e8dcdeee96cd4815ab9eb5fc7cbd8b76a57cf72465271d2ba860e97916351418f72a4f92c0b31d9a
SSDEEP 12288:syRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:syRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T109C423043C4D25C3DB1F81F59A86F0E1E0365D4F78F925F2E462C562BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4117b44d00f52effbf7e643c0adb445cf04b3d0b76071cd4a22156d2413a9383
MD5 bf258ed32da5712065a9e12b374138ee
SHA1 f14599e3fabc716e167b8004fac3542e32195e60
SHA512 7463356c57d2af712154f4c2fbbd9f731f971b66307fb5caa1df439317f16a3b05e87d078e17b87fd8be2828595e5a5fe1787fa8affa18613a455b569a5fba58
SSDEEP 12288:OkRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:OkRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T104C423043C4D25C3DB1F81F99A86F0E1E0365D4F78F935F2E4528561BE7A65EAA800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3ef78ff132e5b595c54283899d639e0020588b99d478536a87c2f128f31537a9
MD5 4f4979bb9c7f922f1c1e33ca2ec72dbf
SHA1 3baa5eca54a55191392f0b51c3e31dec536d48fa
SHA512 e7259503dc3307277ccec8de22796ede39bb8434033d9c06b8a70b02bd87e2557fcc95a872f57502714761b0dc034a4080b89796dfc75ecec4e39129727ab468
SSDEEP 12288:bVhRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:bRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1CAD423003D4D20C2D92FD2F9CD86E0A1F133BC8E79B626FBD41149626E7638DAD60676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 bd97ec988cb8368394d773feacb4844e07519c80e0754a835558051a0b047934
MD5 32195097338b98785473b409b4d77a49
SHA1 d69c0caa955b59c60f9db4f760758c4a44b12a71
SHA512 82f4c48dd687f0dc9ff490f6c809c9c0ba84094ef20a374284ee63cf4bdc3cb6cd9bdd59bb99f65e2caec746e0cc65177216dba28d99829acf97f46e69dfbc2a
SSDEEP 12288:tpRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:tpRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T195C423043C4D25C3DB1F81F99A86F0E1E0375D4F78F935F2E4528561BE7A65EAA800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0e1409ab21c81487cc2b6e06b92f6ee3be6477a0afe64e814f7681948f984b4a
MD5 fd3482be6c18b9ebb813a3b07878c61c
SHA1 eb1340fda654ae5de33000a060858a7c47b04ab2
SHA512 616d87b05bcc2300298763f9326105d89d5caf7ec25762b3da0173c4e103ceadfd2c67719c41041dc625ef40801618354bde1073b7fdd9d6457c5e67b1303b9e
SSDEEP 12288:EeRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:EeRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1D1C423043C4D25C3DB1F81F59A86F0E1E0365D4F78F925F2E462C562BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 75711c89c0fa2d7a876eef8651e1329cbce6c4d875b938e1ea2dad4d20c70d85
MD5 1ae34675bc3dfd18aea74c9b7ef727dd
SHA1 3594f8994fb27a6678787dc8e07fc364a780ef08
SHA512 329c6d143b7889fd56aabbb13c0563651b98d8997dad3384875729ce2293d37e547d1a74476a30ccf7f6e0993302a427c008d87bcf1187de42eaff56445d5cad
SSDEEP 12288:RaRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:RaRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T11EC423043C4D25C3DB1F81F99A86F0E1E0365D4F78F925F2E462C561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b1653cb9f38e1fe4dc492a9f93976f60560d8873b49cdb1fdb6ba635aee6e2ec
MD5 b99555601eac6550175e9d30d58e0fb2
SHA1 2cbc5cc797e5e0294a865d7899e17b6629869b44
SHA512 06b36017f1cc3ab796892751df3ce18af09a27db272d7760f9a643e7e78a5753295a3e185050f1a38312aefe3032e7282ebe60c649eadc80acdcaec1e74003d0
SSDEEP 24576:iZMMzFVSOSRPWxNs298r3OCDIjG3gE9ow+8xA+:iZMMzfOR+ft983Dl3gEe8xA+
TLSH
T154050194779418F0EC6B817ECD559912E2B27C4A1AB0C65F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 388f7bfa0f16bc162ca884d3fc2e5167c9e6a87d902ddb5f1658d78d33b7d762
MD5 5701d9a0b5107f680a218c29dfaba617
SHA1 339bcb168ce81d82f2bb3088aed8316028928a59
SHA512 17366f957b2f7cc329da9f044847cfe5ea3b9f3af5797f9e45b57c977eb8249147981b4cd8287020e81f99e6874a2ee81d265f0105a1083379efd9f3506eb7c3
SSDEEP 12288:VLRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:VLRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T109C423043C4D25C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8bc6000814671cd3d2f5d68c33d808d0e6af0c7d92100f6e7c92fae8b75873a4
MD5 696ec1bed4c552c2006c0945ea14402b
SHA1 a062fd81ff08b80d26bcb905e7fdc17608a2364d
SHA512 b8b1d72cd253cfee74934be24c82a477363f7cbb70e7da7f6b097cbe1aa3c6a26b8bc1e5adda306cc45010f34dd77a1bc5fe88f2cf1e06636526ac69c198e725
SSDEEP 12288:vvRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:vvRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T167C423043C4D25C3DB1F81F99A86F0E1E0365D4F78F935F2E4628562BE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0b04e2bc45d09a84d250e9eca2e130e460afce5232424bf5fcea8c9467b9665f
MD5 808e3e741dea4b5d17e1ab8a7eba3e7d
SHA1 c935007242fc6a1ab38560e4498bf8c8b49d72e1
SHA512 dafc071138649dd2fa4659ab2dac6773b8468903195f7c2a409f39283693a35e230377d50b820acab3c5c2d1eb8a8fec1df05e8ae1caae038df79107ab8ebd12
SSDEEP 12288:FyPz5L8WRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:MzyWRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T10CF412073A9930F5D13B8278C8925952F332BC361B749AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 92e12ebd8ba0189b14ce035d9ded6953611cfadf7a9e172f469f03b268651bed
MD5 087b24da3dda41554ea6379f5cfe4b77
SHA1 c2a7f54ef5ff9b757ec0566f147609f8790f2559
SHA512 fd4a6ffdbd7fbd202e6412be65a105ca7432171300852a032bf2d68b1a9b1ac878cbf3958f60c544a51efe88c3f24e3a67eeb48ab33747ae49ffb4c263de50a7
SSDEEP 12288:2LRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:2LRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17AC423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ca592c53007ede6e77a5fe1c2a8e2a7216049e23eb36c67312cd3c7796dce2a6
MD5 7ab0f05f4528d6180ff7a90256aa0688
SHA1 d5589a321b37a9039d25dc621471d9e5621e73c8
SHA512 84eda8ecaa9f70751f0ec328f3e4617a922f7f4b9522f32696d465a839ab8d1ca4f2af9e3b57d8b7102274bf437b77dc9a6fb37206932deb5277482adc5ae8d0
SSDEEP 12288:2LRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:2LRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T122C423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a3f1ed40557c68bb1a06c40a4ba3944b0cac3b4723fa9d32c559f1711505e409
MD5 d886bcae04e4674237409e0b851c4127
SHA1 5c8611fb845f0b90828107d88ca677d1cc1391ca
SHA512 9ffa3848de88dc7ea520f9a12d4a6682059291528a16349abb713f93567f797e297b39ba748d49150053fa8b431dc4af6e14933dc11c4782307f647989a90deb
SSDEEP 12288:fyPz5L8WRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:SzyWRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1B3F412073A9930F5D13B8278C8925952F332BC361B749AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e90b1e587c99688ea153f8cc8b1590003d36a4ab2999b2184b20697795fc3d2b
MD5 e5000c5336e3887dfc21ba2abee0b392
SHA1 7ed7b15482ddde30550264535427b0e6ead3948c
SHA512 5c67818b79326d06dd2786b0a5427bbc23a9f8173a0f40609a9a7d5437c3ff5bbdf0f85e95ed6853b622a362daddf1e4d71f1665ba9c1d3240d3a0c1d4787748
SSDEEP 24576:oT9aLl3z0zD0RPWxNs298r3OCDIjG3gE9ow+8xA+:oTQLlj9R+ft983Dl3gEe8xA+
TLSH
T16F050294779418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5fdfa51291fc5a561e3acfa94540e4029a294776d0a1feee40df0f93165aa26c
MD5 ad7b00ec09ed7b1e5e1c566fb067a3bd
SHA1 a95645b2393fe1544b9ab8f3aeafc5f65d38639a
SHA512 29b5dbf2b0525ff5cac2e3d7d424006bb14969502c959a20c731b3edc869da80cb3b09e1738cf3af12aa660c5a4c0794ebf17130717df40af528b23abf4a5c23
SSDEEP 24576:/3td9CHKy7GZwRPWxNs298r3OCDIjG3gE9ow+8xA+:Ptd9CHKyaOR+ft983Dl3gEe8xA+
TLSH
T15325CF90B7E810E4F0B78A75CD669512DA767C5A1B71DE8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 510ad55dc451253e57d1b0b57da268f1b6dc7248eae3337349d62f37a98b5e1a
MD5 5a543117eef1b1edc24a8a05779fd5c5
SHA1 fd69fa8bdc4961740fe911b2431e6c5cede0692b
SHA512 335324edab4cb726ae3dd697a2ca565c4c12c02576d194b39e21700f98d9ae5db0e53c7d1a0fa4961a7fe65c92462881e7cbb20e27f30ac2dfd2da66af1044c3
SSDEEP 12288:LERPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:LERPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T12BC423043C4D25C3DB1F81F99A86F0E1E0375D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2f0193822e7c7363ff1b1b4edd2e9e2e855f52420502c99eb1ad9392f96d1b68
MD5 b452596b55647d06bd1e67fb576eb40c
SHA1 1a55a9fdf09ebd0088e97fd78928642df9056e3e
SHA512 11d666d5a0115f2d99d9cd8b481a2040bc98be57aea84e173341de067cc7e0e4755169ad03deb6559b4cf30b3435909803e79807997f588ed1c32359ceb7cccc
SSDEEP 12288:B2RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:B2RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T140C423043C4D25C3DB1FC1F99AC6F0E1E0365D4F78F925F2E4628562AE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 175c892f3703d9316a6401216354212da887905b892dd0d321ff4a1d0191d159
MD5 25f31acbd037dcf978554ff34a8b224b
SHA1 627f0da66b659219852dcb0a9c06012ed89e38ff
SHA512 12a32de97b30bc352bcbf567ae8a48ce271f3a4bcfa019b63493480de971b6619e62be1ab036a741fafcaffa0f7ccd31c04268bf73db87302d5bb080a6d79d3c
SSDEEP 12288:LlRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:LlRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T10BC423043C4D25C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 4b2aa5ffb7ab25b31798a09e329b633b39e51277f2da377a05c9281601b82cc4
MD5 f3a22f403634da539a397d260208b4a4
SHA1 f55404e338b0a9f99dd781c14a252b693f8a5e80
SHA512 2293df40e6d47b0c0593275f67ec450ae8dbd23985b3cc1199ed178ba912e835ccaf41c0eb0cff513161ae567d2f0527ad801efe025a8c0738964547671cee4a
SSDEEP 12288:WLRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:WLRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T148C423043C4D25C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 9915ee55c4bfe1768b18f8a3fc9f09d27fa5f06b1a8b0abd6ff384406646c12d
MD5 b677e37083012cfc688d8b95ac167546
SHA1 6e2af1aeae440d552164e2fb2e7f884f1ba566b9
SHA512 d8a5cb302321af5e1da27418a897b3b1f123cc350ca83e1e3e98d21c91b4c64381511c391cbe82ff065983a011c18361dc7c1fbf774062818cd46213ea4f5bca
SSDEEP 12288:QERPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:QERPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T188C423043C4D25C3DB1F81F99A86F0E1E0375D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 1156fcc5f2752230ef35144e64d74308c1c74c43719fcf48bcd0a80982eab6f9
MD5 8f6240a7ea59aefb5bc9ca3e3bfdcd16
SHA1 d00f7dfb5e2e52a986be208d7bbfd0379d9b56a9
SHA512 0505c8b6e73f8a5e37ba6c602e01845230fed813ad8d828a6427b712001481bb6261c4f9f6ea37dc292be6d60706d1f4197f492a37966efc4e285cafc0c0d8fd
SSDEEP 24576:bfwvok9RX6wkyAIfRPWxNs298r3OCDIjG3gE9ow+8xA+:9MnYIfR+ft983Dl3gEe8xA+
TLSH
T1F435DF29EFDC04E1E177927C89A7460AF2B178591B31C6CF029653AD0E37ED4AE39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a18e27e3004efdccfe69dc2aa04ec3a990286717d9a4795762f7ba260d630ff9
MD5 5866714e34dc860564d0dc0b4b54b005
SHA1 ca5d3f5bc337ff179defc360ade096b4d919961d
SHA512 aab99d4e469a82f6e6b49103ac2a87e8c7a5035b0ea7a8f8fd9a19d3a9b8c964bff2617159ddc4d64705e97b8e5f539a9c840b178b9126577496dbf0c74f8c3f
SSDEEP 49152:EYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04R+ft983Dl3gI:sySzPwR+l9EDl3VxA+
TLSH
T129066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e7298b53066937e5acba02d162e2f5946ca886995d5a1fd38aa10c1e9333b4fd
MD5 d70de0a7d14f2e67e190e32a96285de8
SHA1 442fb7e4fd312e2bf2f917fad4361e5eb1a58d38
SHA512 33f7dffcbab13d47b3d2392ffd28f193d179c8bcd7ccba74170b0bc3f2dd975e1a419c04385d78e8b9cae349848dd74eaf7aaf338c779d69c7efe0207b961810
SSDEEP 24576:z47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYCRPWxNs298r3OCDIjG3gE9ow+8xA+:z47JUQj4irIhCnDHUPfF/oR+ft983Dl1
TLSH
T17A65AE1DA3EC01D5E1BA927885158A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 99d7b553a186a95db4e4c932f749312d73c4d9014cdb11d02221af943a863be7
MD5 a00621c348cb1f623436041610ce6293
SHA1 3c07b2c020840bd12ba7cde947fcffb677c95839
SHA512 3f654b48c0a6ea9c57ff312f0498fb8adb83342d7256f41e2d5c8d28838a7b7a4090b873205ab3b38b896c0f295a2ed3286ce36c1829f87de9805584ac83649d
SSDEEP 12288:uGsfbRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:ybRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T168E40109D68812D1C02FA1B9CB469681F3337C1A97F1A3CB92D0F53E1F7A6949DE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5eef5eff4de83b49948904749791147d42b98d76bc3d9812b71de84eb78c9385
MD5 d34a16259de86eb129bb391e52eba46a
SHA1 7cfe07e7a32446f98fd43a03483a9335a2ec2828
SHA512 c7831e6528ec156cc87e8336ac556b2213b67eb968d382db6f44dfa4ec196eb9cadd98be0ef5fb1f3cf4be10b9ac5ba98f2682727575b35bf5230430276a3f26
SSDEEP 12288:EnrHzlvSwjx13Hqfspq7tWc8266/SKhUSxE56:EfhSc3Hqfh7tWf266XhU9M
TLSH
T18D3518017666CB4FC66980321E36D2CCAB707D11EE05AF0773C98B3F9576659BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 452b5283c9f393fc3817beb4a0c6fdf2bf49854b49c8e93988a222bfd0acfd2c
MD5 ed939a8ca9f25de6045e6067fd63907e
SHA1 20b1c6f21aadf93d785f3f36f4ac4cf33d70c8de
SHA512 85812d1527199b391d57c413d1edecb214d341ff86fb2b0b3bb8cbc9741f77c7ce0419e880fcf5f168922e2dfc844c8551fb1abc13cfe62f8e4dc23d1ab5736c
SSDEEP 6144:gXZs4n4lVtVuV9lvrzglfb+A2Nd5v4YaybhcBtMxAIBtMxABI7o042fxx895FWq3:WG6HA2ROybwxG9fWQ
TLSH
T12765F9816136E7CFD1F76032072A5B8C6B64EC07B7495F26B389453EC86AB51A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4f6cb1693b0570d7682fc3d7fc0c8041948eeaa0487b6925ace9f9ffecdd9ac6
MD5 c428736f48342613fda9b9ecc9b069ad
SHA1 21ebeab05b84ffaf6b5c6023aa3b777f7b1697d9
SHA512 f2efc9adf9744f3af6af55eb25ce1a1ccfbdf915b3ed5d9e413499471faf08cb1d03aa28893fb6ece5cc88b8e2ba1901e2d0272bc14bc3042434c596da73683e
SSDEEP 12288:P07jRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:8jRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1E5D423002D4C29C2EA3F91F4598AE071B12BBD4E6FF464F3E41186A1AD796CDDDB052B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5e125a3d1571e73a15a03bdbdabe0d544d96215ec128f50a0c51b4cb6344593a
MD5 508282ef3319889d803b2d4b8aebeacf
SHA1 e14c46ea328389f7d87a7bfefd1a16eee8fb6895
SHA512 881e2ecfdcc75c97f5f4400ba4bf8da557f0b50666f11bb85b03a59dab4d637841a2a8f955443030264a1ea75436e965b9bb028d44c12940567099a9540ac5e1
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bY9RPWxNs298r3OCDIjG3gE9ow+8xA+:hgb4mBIBhGFCR+ft983Dl3gEe8xA+
TLSH
T19865AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9fef6c34dc85776cbfcfadce9c706e7a533d286952bf75120aa3df8d60eb413d
MD5 9da7be394b1e143902660ef4f537c07a
SHA1 3d258dbb14c8f07f2841e409225dd7e99370e53a
SHA512 1b47bdb08ff62dff833c95b0ade4633bee9893bcaf00c382a9f0092a344b4b964d6255eb753b61888b03dfa43971f8760025d6672f3af0f40704ee7933f2ba73
SSDEEP 24576:lG88u8FpJqH1Wzria7/mSRPWxNs298r3OCDIjG3gE9ow+8xA+:I7ZFPqVha7/FR+ft983Dl3gEe8xA+
TLSH
T15A35012576E401F1D47BD1388A824663F6B2B8151374EFEF06A88B511F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 ac5e58def3bb5a7b78ab0ee7b00675fc2b49c8f087ad10a2d59cb3ec83e5eb9e
MD5 74f639c46bc46b1c3c90f7988c58be71
SHA1 cf56799bac6cdcd12a94bf2b70d4ac834a668ff1
SHA512 64ed91cf505a4537dd382424d873ca59b705121d6b913aa4f7dd69c149e5b0656e70c05d68c82195c7450de67527beda1725aee4af2e02f2b20965948fe9a3ef
SSDEEP 24576:2PUr+NQORPWxNs298r3OCDIjG3gE9ow+8xA+:2JQOR+ft983Dl3gEe8xA+
TLSH
T15B05F11F269C18E1E67BE17D89828219F372B852171292DF01E0817E5F77ED8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b584cea2aa7e5afdf693f226b088119dddb9bb63f4396bfdb6921795372535ce
MD5 c0c8c57f9aece83674a35532e23dfe16
SHA1 a1014b07a2ae1d1115afed2b5597f04c5d05f316
SHA512 63e2a99ab2b98169213a8b90743a9ef967dd680b08e493627c54552438e32337a8aca26942e3f53264ea99a14c60df412a832b5e42495e565d88acba01234bc5
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeR+ft983Dl3gEe8xF:mG05lO43bnR+l9EDl3VxA+
TLSH
T162D5C06E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 80aa6c83a7c3237f71236887b4590435d17b31f117445d6349c3dd01b0944981
MD5 1d17f77f245745f6c89493542df4b1af
SHA1 a4d56447be076df83f7b49aecc255777281877cc
SHA512 04f1946af426f22739bc93ba23132c5864b8342ba42a8c0ab59c6249799f9e1a39cd805bde9f0920cdf37efde2b86149b9baef033b0eddc2dbffdc43049e335c
SSDEEP 24576:kfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn4RPWxNs298r3OCDIjG3gE9ow+8xF:8a5POZ39Jt2pasx2+m2R+ft983Dl3gE9
TLSH
T14965BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 645a35222fc3f91f0ca593dc4a5aa5da16ddc0d6624f33092b88e07c50b09a4d
MD5 24ee770db44825548f088ea6e9023c16
SHA1 95392d16e6971405dcc0babcd5531c5509364f06
SHA512 3695ae2a547cf5333c415c7f90aa7b6c2d4a9908e58eaed781e32960ccec6efaaf47fb9b0725aa2376063dd99f3abd228f92a2d43892c71a368801ff5b7bc80c
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkqRPWxNs298r3OCDIjG3gE9ow+8xA+:3Nc/zEOVHFlR+ft983Dl3gEe8xA+
TLSH
T1B6858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 952KB
SHA256 7bc7840508ead9f264810092e816ec1f4fb15a172c6fbf977ac544cf1b7e95c3
MD5 e448f7ec53d9f391c38129456f0e554b
SHA1 1a0bdc204e92f0de1aed399c67d81285edfbb9dd
SHA512 80f83b72770efea83dba12a6b9b27359bc17f5204cf398d5283df67f754c687de687e68228663573d36914773618b0345ff7e62501ad9361ff540216a6b9ae5f
SSDEEP 24576:y6DIu7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:y6DIu7SDPO7QD1y37die4h
TLSH
T1BC25014C676720B5D077D07DD6920219E2B2B07187625EDF0798C87AAFA7ECCB539E02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.1MB
SHA256 f87f3ee576ddc2da15c6c71df717f5e1e6ab8faea3295f93d2672c0344f17295
MD5 a049b7c2f8dd9e5da078bca8555c3ff6
SHA1 7aacce3346e010dc6ca092b86bfe2b421f6d38d0
SHA512 bf2aa085a9334f3ba086ef42678efee5f4f21ee3a75bd9a8fdadda4dbf986a11a5399f4029d76617f5e47bb6d50d9ca52af5d00f3c780ba455e2f1061fdb62d4
SSDEEP 49152:qSMwBtOmf7SDPO7QD1y37die4hQR+ft983Dl3gEe8xA+:RFb6O7ZahQR+l9EDl3VxA+
TLSH
T171A5E12EBAA806E0D1FEC6B4DE238116F6727861173253CB4290C13F5E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2a327395bafa9d407ac8168cf44e3ec17e1613b74d5580e016de6b5bfa2b0efe
MD5 e612297842aecf2d587b2c480cbe62ed
SHA1 7fb1bec6a89d4a84fa6ce4fac7634379ee038118
SHA512 2702e728b0743dadab9261c1484862413f95737cf78f5f454aed213620d717dd772481c802b1f9ff4590cb08c2771ccff95854c3db7b2c46ac6b0e62ae8a44a3
SSDEEP 24576:yD3FHshBIYQgAXRPWxNs298r3OCDIjG3gE9ow+8xA+:yDVHeBIAAXR+ft983Dl3gEe8xA+
TLSH
T1D025E03DEA9C04E1E57BD1BCDA538606E67238A9033266DB0190C1B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1272-139-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1272-331-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1272-133-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/1272-140-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/1452-160-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1452-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1452-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1452-63-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1452-61-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2040-66-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2040-77-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/2040-79-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2040-73-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/2040-68-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/3508-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3508-151-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3508-145-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3508-153-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3508-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3952-346-0x000001D6E1720000-0x000001D6E18FB000-memory.dmp

Download

memory/4648-316-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4648-81-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4648-82-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4648-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4684-348-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4684-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4684-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4684-107-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4684-114-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4684-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4748-104-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4748-328-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4920-0-0x0000000140000000-0x000000014047B000-memory.dmp

Download

memory/4920-1-0x0000000002180000-0x0000000002204000-memory.dmp

Download

memory/4920-7-0x0000000002180000-0x0000000002204000-memory.dmp

Download

memory/4920-9-0x0000000002180000-0x0000000002204000-memory.dmp

Download

memory/4920-14-0x0000000002C80000-0x0000000002CE0000-memory.dmp

Download

memory/4920-20-0x0000000002C80000-0x0000000002CE0000-memory.dmp

Download

memory/4920-33-0x0000000002180000-0x0000000002204000-memory.dmp

Download

memory/4920-32-0x0000000002C80000-0x0000000002CE0000-memory.dmp

Download

memory/4920-37-0x0000000140000000-0x000000014047B000-memory.dmp

Download

memory/5468-132-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5468-40-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5468-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5468-46-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5616-168-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5616-335-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5616-161-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5672-332-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5672-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5672-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5672-126-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5672-120-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5672-119-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-327-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5744-92-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5744-100-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5744-94-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5836-424-0x000001BD7BA90000-0x000001BD7BCBD000-memory.dmp

Download