994b6f8f780dcc00194ef4428807d547a20224a8aff0debbdea119dbd2e9acbc

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample261030-e6zx2adc36
SHA256 994b6f8f780dcc00194ef4428807d547a20224a8aff0debbdea119dbd2e9acbc
MD5 5338aae805ac706e8bd17fa7a54afd65
SHA1 aafeff4cdaa94a5a860b8e0d112bc390f4061f1b
SHA512 a93b7e0ff6848df193d245545a1232d0104090f03215848136c3fbf05efaa7682ec0c614f5fd16c797d6696980df62da7c5aa850bd99c2efa795f5ce5227f37f
SSDEEP 49152:gSX9RXNBYfzjV68NPYFs/6iNyGdqacTLhmR6I/GOTM1M0VY3vSi+ttr+Ekw7n2m:XSdq5Op0S/Si+ttrsw7n2m
TLSH
T123167B1BE6B940E5C0BBD1798A579617FAB2781A873197CB4790471A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4240	elevation_service.exe
2908	elevation_service.exe
4864	maintenanceservice.exe
1512	OSE.EXE
5308	PerceptionSimulationService.exe
4444	perfhost.exe
4832	ReFsDedupSvc.exe
1248	SensorDataService.exe
5912	ssh-agent.exe
5920	AgentService.exe
1468	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6c4404cc4b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098380bed2768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cb139ea2768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcb653ea2768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebf86f2d2868dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c8ea02d2868dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012fbd6e82768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1412	2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4240	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5920	AgentService.exe
Token: 33	1468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1468	SearchIndexer.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4832	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	1468	SearchIndexer.exe
Token: SeDebugPrivilege	4240	elevation_service.exe
Token: SeDebugPrivilege	2908	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 3548	1468	SearchIndexer.exe	102
PID 1468 wrote to memory of 4316	1468	SearchIndexer.exe	103
PID 1468 wrote to memory of 244	1468	SearchIndexer.exe	104
PID 1468 wrote to memory of 5284	1468	SearchIndexer.exe	105
PID 1468 wrote to memory of 5864	1468	SearchIndexer.exe	109
PID 1468 wrote to memory of 5832	1468	SearchIndexer.exe	110
PID 1468 wrote to memory of 5924	1468	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1248

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b0376fbea00e7bd14bf168bbecdd560955a3679e6dbced81a4fe565987540717
MD5 7aec1b47fbede0ce08ecd5b59607de17
SHA1 a76ee889522f881c4f76924acaca1f7b078e99f0
SHA512 2b719837e4dca6a0591b3e6a31f9ce423b8e32adb6ff6989cd46f3d1f000aa11dcf84b9928633657bc85160c99340691b8c743de176e1e1114ffd6eb5391e609
SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnU0VY3vSi+ttr+Ekw7n2m:q3q6sjBl0S/Si+ttrsw7n2m
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fdb7382264c30be0e97163d90910fdde866839e7af6e7bd919079774dbad441e
MD5 6367f4e19f898acaa89eeca019723e2a
SHA1 e6caaf8389d143c025b34979634582e9cdbb06c3
SHA512 c1c816013dc4efd2da0556ca55c55e1de8e6f3463a804f57118f3284b619bee8180f887cdda37e18a74b28e89c461a49182b6848c0667c8dfe0b6d493c6dc66d
SSDEEP 24576:vXYfDtczA50s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:atcS0VY3vSi+ttr+Ekw7n2m
TLSH
T1F565F22873D508F9EC6B827DC9A28502EA727C558364E7CB03E4A5261F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f539f8a948bb7f598da91bed3f039c967fa3b85ec10abc7142346562cd9b55fe
MD5 10dfe217f17b9d3efcef0976120ad071
SHA1 3a64f8bda83a643c3cbef17e318c631d5a7b0b55
SHA512 a648a84648ea78f7fcaa732c2faf18f40dfdd8a82ceca14bc3089c780ccb5f9d030b6a7bf27580fbe56da2db845c961ae7cdfa81fc6c7b6a261efa8f7c6c3dac
SSDEEP 24576:W0Le5ji0hmxxrMa0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:WPji0Ajh0VY3vSi+ttr+Ekw7n2m
TLSH
T11D859D16F6788731D073C0B9C5D2A68AED71308657308ACB4286D77C7F6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2da610f17331f60ad13c8f246b72d0b1ac1269f4c9e835d049dd4fa6f339b7e0
MD5 ab1a82c7ed69c928b6cd64317c0ec289
SHA1 6485cb95ea4e538ffac09cda05d66a620d1394c0
SHA512 c8a06eb777ba500e734e45cc626deac140d143f2ea29ae981756ba00458a1f0053f25abbdc341d9861de80c4cc4af1e8881190e9b319bae02bd820972d5a8018
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWn6q8wyuE0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:F/ezSC6vUzPveHjyV0VY3vSi+ttr+EkW
TLSH
T1FF755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 52a7c10336acb69cd1a3d95fb090d5b48bec76703f875096a0e4d2a32a00d507
MD5 ab996cfef158c0a81208a33dedeec48c
SHA1 41a4463e6c672b8901980c6041e93874e6583d90
SHA512 39511dd7bdb28793fcd4e1714319514eaa6c2e7c4eae66201cc53e3f1e36bee392ffa5d66855821e57626f98e47380c25f5a3e944a3487f237d78d0608d31897
SSDEEP 24576:hVbqPb88hv/l+YP0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:hVO88hXl+80VY3vSi+ttr+Ekw7n2m
TLSH
T16A559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1268bd13569887deb46ef2cf32c131ab54845d81e4d2176fa615325fb17a5be1
MD5 3944dfa18b9394afb33f6509bdb5e557
SHA1 46f5cc8d925cc72b6c4ec8d19a1970e716359c75
SHA512 816c16bc263eced81107c8dfc4785834914c56675b30c327ef341f60ac39e8a38ca3f5aeb6186f539905f87652aed4a6cfd935392a3709c3a6cd4d9bb12a9d20
SSDEEP 24576:pLW0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:00VY3vSi+ttr+Ekw7n2m
TLSH
T164452301E78F8835E8AF9B3523FB95C6D878ADA8D0BD41423458741B7B3C1E4E4522BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b1cac90d95869e8ede9adf505d26befafb4a67bd7d49516d38ae9300323a955a
MD5 d2e99e486935f620b41afa7a899aefb8
SHA1 ba629b62bb63af7c5024453463b229393207a65b
SHA512 f9413882ab49d14a870aa9c215265b93b7b4df9714fae52526ef57d3da6bb94e1e191937deb8234cf01b70b23d43d2551494d1698e4cab4a87f7f0bb699bbdc9
SSDEEP 24576:5JIUX0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:5JIUX0VY3vSi+ttr+Ekw7n2m
TLSH
T10F65CF3BEE28FCE2C27E8DB957918640D77278708B6293CBD164820EDE275E05D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4d1accf2ca4591f610ec6ba3050751f9be6558c0d0ec4df458e15b1caf15d2b9
MD5 3a9fa20a2680cc26546d67ea8eb6ed05
SHA1 4538812a47430a19ac028f1049496ad520cdccd2
SHA512 920d3362853ac4c7651a599592d3ccde5e0b2f1cb28ad8d1d33dd7b94cdddf2638513ef8abe99faa01bff61bb119cf1992fcf76ddb4027044996619c7288a707
SSDEEP 98304:KQvGAdlCEL8c/DRNw5CU0S/Si+ttrsw7n2m:rvyEYc/D3w8UNaxt7n
TLSH
T145266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 49dacd18c37fdb243b19029e8ce147ac0fa9230ed71808b3d0ea2ca241a3cb7e
MD5 c61ddb564a9fec2bc9b4c914a534932f
SHA1 ef553088fc97bc21cf73ebf268edacbe790f6659
SHA512 6a79b885197beb8042a815f22f6b9c219b68c966464d5a84a536416f042cfd0ebf7b1efe0b764478f67bb626cedeff08b459498110394a0de413fbf2910567e9
SSDEEP 24576:n0ewsAjx0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:0ljx0VY3vSi+ttr+Ekw7n2m
TLSH
T14C75E031FB75D436C67F0DB61B36C706583CB9208B611AC3E3A89D9E59342D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2c75147851e3f51fa0b239a47f166b9d80989d06c4eebcf7735c650c101b0992
MD5 b2c4dfc5e000ae071114fedea3c919dc
SHA1 7aa838e12e0cda83633ea6a95743962299f2f966
SHA512 825710b916744fdbea6270f9a4e77e1ecb960ae8b570459157eb012766717e5da1fc9b1db3b9921ac607c47fdb94fe885b2dbb21435813bd5b92c8e40c81d9f3
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpNaxt7n:2UEtQevvqc2W1cpV2tI32zaT7n
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8e0fda8de8decc00412198cbe5993ac84de57fecfbb8bd851d90d735be8407fc
MD5 ff806dc1583fd1058085791f424d6965
SHA1 21f723738de44a950005271214be73e20701ccf3
SHA512 ae490c4330b44ac925191ba0549e176c690dd6bc2b2624e97629d5dd16eb9e186d828b1bba6665028d1b8673d431487e6c6ff01d07fe7cab485fee71211a64ca
SSDEEP 49152:6CbRquA/m2yL5zTfFiV+XenmE3/zR0VY3vSi+ttr+Ekw7n2m:PoquVjnmo0S/Si+ttrsw7n2m
TLSH
T139D58D0976B8C1E4D1F6C77886A2C647F37178158B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f37d951a51b26cb0562dc71eae8cef79cb332526750e0efc74cf607c88a529de
MD5 26692d30bbb7242e3531a11e6b6659ff
SHA1 6f2a606906a215b9ad3492790507a313a4424cf3
SHA512 023276db33276d946b076abb93dcd9bf0b1371ad432aa6c61825fcf6212b31bf27361e69d68756e290901ae681210dddcb13633b6a690a55f370a0a9976e2973
SSDEEP 24576:vAhGL3IFoiwtA5l7S53I0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:vAMUFoiq540VY3vSi+ttr+Ekw7n2m
TLSH
T1E835AD80E7F945D4F5B3AB7899B68171EA76BCAA5E31C20F2150D11F1E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ddf46aebd23dcebbc495e61c30c0838e571f8f67141e9e9cfc37d5a6c20e88ba
MD5 7ab2a8aa7c8b1e51549442208d6a3f74
SHA1 9e9f800c8a8a3dc8e21594063cb44be919ba718c
SHA512 80872057f30bc027ebdacc106a6615586106f68f3f2534df60b4669214b9d5f403b3620c72b53b341ee59c68970ba9d5dadbc707cde8d91b27e04dc7061297c7
SSDEEP 24576:xwu4OW10s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:xwvOs0VY3vSi+ttr+Ekw7n2m
TLSH
T16C65F14573E90CF9E9A782398697C136E7F2BC112625C71F1760C61B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4111f44ca6b1de5c54e3662ab54c3c403f757893062c6a7e8be91dd67d422a1c
MD5 96b9914a21ac2dc326f601593a502f8e
SHA1 ccc0627309e0b6f5c38a4aa6a32cb561bf7ab62d
SHA512 e61ac29aa3e5afe87649ebea472cae47c2135a97c3a8c00e972aa86832afc1cd89de188bd8d642e99f471973e2717356791b4f2eb6a34b409482c9e3c39da3bb
SSDEEP 24576:OZui0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:u0VY3vSi+ttr+Ekw7n2m
TLSH
T19955120933DD60F9D4AB833C96F24646D77178A6A37A43CF2124626A3F36AD15D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fd7b9a866470ada323d337033544d7af4f52ef761aa916776050c30491268b5b
MD5 c8522f5a69a730e0d622abe5b3d03880
SHA1 70cba6f7b97dd7dad7cc1043440f1f0f704a8edd
SHA512 2fd3e1c31e8b4d66e5e06aefbe7cc921a98089c23130c2b58f0b7c2f00647170c08b11a0db8ad183529fdf4fe5c9f682e526077f157a30cecadbd9a6ab7eae01
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN370S/Si+ttrsw7n2m:UQyiKa/X+PNrNaxt7n
TLSH
T1F5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 91ad1fabd543bbabebfdda1c6ee2fe38648254594864b7060a6bce2b7a56bd6b
MD5 2142108947fa3c98d5b586ab8d07f527
SHA1 6de0cc4852db3d244e9a89c235fc3e63082b4322
SHA512 66109f2e0d1cfdc544a8b3cc04192c25184564ceec46b1b5fc4a4894b537d2896b1ddf0ee19942cb91d69d9b664f8fc0be6def5ea3275821e62df2663a3bca48
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN370S/Si+ttrsw7n2m:zQyiKa/X+PNrNaxt7n
TLSH
T17B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9a13a46e4575270fbe7bba291d78e279c8c4e5760449ad2f2438759a91d99743
MD5 a785541870afb164c1fb54f2e08e13a4
SHA1 610835205a0dec4ee235bae8077e20c71ccdb128
SHA512 3472b25e87ad118901c1d998566a54c4487cbf78b4a692de1dfd0a0cbfd378d646b24eed94400fa687f5598aa34fcfd56681bd5555843d12a7e2e0acaa21e9a6
SSDEEP 49152:h68Qg55nhceWu7PNU3/h0VY3vSi+ttr+Ekw7n2m:fthLRc/h0S/Si+ttrsw7n2m
TLSH
T1B5B55933B2F600A9C44DE1769F4A872196D17C75CFE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 864e5a036e3aa036074d6ac039dfcdbe4fc228a8ce235c36f4c57d02194f28f3
MD5 73894ed18c7a6fb2bd6f1d9167893e0b
SHA1 d8ab2a7b57fe31745b46f4fff47dcbc6cacc5201
SHA512 729cbd157efa10bad198f5fe90b7fe3876ce5beae106d4d914c2b13008696eec99cc7e0d04c4502ac8f233b0efd6f6c339f8d20fbec5c5c39ef9212b35832dc0
SSDEEP 98304:By5112gYy5azzVvt69nLKnhZW0S/Si+ttrsw7n2m:cLIHEWhgNaxt7n
TLSH
T162167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cb06d90df4a588d41568b1cbe0e1a2b9bf3741a7d7331d66ce76a92e51077e85
MD5 bf31709724737839af7392f92bcd805d
SHA1 60c64e65dca9a0aaea99536b8138df4ef548953c
SHA512 4a1a25a6fb16759371872c79c871931875a209cff9704cbad99f1d8d2fb49915e6656c20f7890d84bdbf68513ab576c40f652ce35c6a62d4bee499d8e1d93d45
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJ0VY3vSi+ttr+Ekw7n2m:Fu6Jmdxd2dJ0S/Si+ttrsw7n2m
TLSH
T15AD59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b4755c6e61e97950224e536af14485ce9d1976e9f6348f12889d54d0fd2e200f
MD5 825c57debd54fd711969a4d8298c66ce
SHA1 39d3b9bfabc03a53f9c095479e652d35a3a7e8ed
SHA512 340671b908c75bfcfde148df646b3aed4dddcdf2d78e941cac8321851e8be54d5359ee79c319cd924064ec469b9e5bc0b27fbf7e1da8458228537e3c64b45d61
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4x30VY3vSi+ttr+Ekw7n2m:hmifPWRo0S/Si+ttrsw7n2m
TLSH
T1B4B5BE13F2D900E8D06ED17887569232EA61BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c7e9d8c42fd59b80581a8ce5967d8f86b7dfd3f1752771bc63697ccf7ebe60f3
MD5 576e261630afce7c46223cdfcdbcbde8
SHA1 1d2d9b5fee85a5d05d978b5ffafe8bd43e8578ec
SHA512 3d9f7a544af1a5d4e897f56fc385fae05c17b90a8aca8860802428b38f6f13304fed08c020f56f050965b2ccc0e8738c39731ec6d67210971a870fbdff4cc53b
SSDEEP 49152:3SuZQIY0Be2KcRVtOnks6NMHqi0VY3vSi+ttr+Ekw7n2m:t5dKii61i0S/Si+ttrsw7n2m
TLSH
T12BC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eb43364950126ac21e2e79197ccbc3a7f5c534bdb7155b649886be9b57fadbb4
MD5 e5c75594c30a5ffb94665e26197ccd4d
SHA1 7ec446673c9dfec4888f7e413482c92b24bd12af
SHA512 cf6f35252cbb3e81371a0ca4bfcc52bc7054b2d82ee143d05e9585ab0c646582828a50b9ef15db2d91715bd21e5ef21061945b7c8262c883d514be0da4e43edf
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wT0VY3vSi+ttr+Ekw7n2m:XX2imphM0S/Si+ttrsw7n2m
TLSH
T12F95BE13F2D900E8D05ED178C7568632E962BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 01aee244f4767f66e8cb0e133f8728f66b5bda5cf1979e29903a1a0d6556554d
MD5 4d09a6cd065b4d03fce4184c87c10303
SHA1 b19bcfe964fee5753ef8eddeecd0ec927c1e82b3
SHA512 d8e8a180a1807cfb7e4d5e7806140d4a2770f83261dedb8fea75096f30607a4a268ab58e2787d8748b5454d120df61db7955133c1b22f6c2a97f0c35fa924025
SSDEEP 24576:/e0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:W0VY3vSi+ttr+Ekw7n2m
TLSH
T147452305F7CF882AD85F9B7613E792C6D86CADAAE0BE4146345C70177B3C2F464121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5b8704d883106cf484d133eb986190bb6bf6aace5a18598cada4e59eaa7ceaed
MD5 e1be181b7872f18f2d630eb2aa31a790
SHA1 4bdff3bda0b5efb54c85a141cb76349887f29039
SHA512 bfddb6e48d940c8a390753f69016570ce28fe5599527597603c4348f0283766b2645eb0c722d30a46ca55c2ada8ee4ac01bd66a92bda0eedf0947c6fd0bdedca
SSDEEP 24576:bN0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:R0VY3vSi+ttr+Ekw7n2m
TLSH
T1F4452305F7CF8826D85F9B7613A792C6D86CADAEE0BE4146345CB0177B3C2F864121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d6e840ee6059e34aa8a5d5c2925aaa0f7b3a0796a80ae3f8d1c605ca983b2553
MD5 072c438c418544ac75ddade8da8fcf35
SHA1 3af4aa4a3e7060cacbc30ca0ac8270214d9cec5a
SHA512 e7cf18b1dd6c21de535ec45c6e14ae2a0caecc6078d6ef549479bc4197cd3bd839531b1a8e16c60e1a8cc6ddcf4a1f64fac569f886de6b64053d218e5d41205b
SSDEEP 24576:c/0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:Y0VY3vSi+ttr+Ekw7n2m
TLSH
T100452305F7CF882AD85F9B7613A792C6D87CADAAE0BE4146745C70177B3C2E864121F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2c8df6d190cd611b878e89a8861cb307ed99108e88470a1e5c4462928e12a357
MD5 9fcdba13d4dea4c0106ee528a9eacbcd
SHA1 c52260d38bcfdfbcd9737fdb5b3452a1a98c17f7
SHA512 3a4bc96959ab924104a553d1ea93a5630b9026e5a51335388a1bafe4658c2f82f70dda93a623caec2f9295fcf682b5cb119c650fcdda1086ed8336f5539ea255
SSDEEP 24576:F0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:F0VY3vSi+ttr+Ekw7n2m
TLSH
T100452301B7DF84A5D86FD77993B39186D5B8BCA9E23A428F6504341B3F383E468317A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 901429b5ac6c60eed6ea48eb040f31063405c5b5efd54eefbcf748a353bbabb8
MD5 b3146d6e915b5320d4ef06e38e34bb45
SHA1 07c4eeb53b35588bd1c39401974a48aaa2bca44a
SHA512 4eaa49576f09264f718c40472723e39238568b959e2b402b8097e7b900812b97a9092a24f8d82e803b86991c8eb907f589f6bd30d406f71d0be357dc134c6d35
SSDEEP 24576:bA0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:00VY3vSi+ttr+Ekw7n2m
TLSH
T14A452305F7CF882AD85F9B7613A792C6D86CADAAE0BE4146745C70177B3C2F864121F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4d9dae30d253f42ad068766a88f67a150134d7f0e6331c48327502cf93499e83
MD5 21b2089300d4f3e57fcffbf616e86da5
SHA1 20dc545201ebc9c302aeee12cefa85bd63fa761b
SHA512 9a0fc71cd11fe21623262b96d4edf3aac5f27b179a0d6060ecce059ecfc4ee570aadee12c66372314b70aac0cf55ece8227c974cb320e3e3dfd90d8fb8b60c63
SSDEEP 24576:M50s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:o0VY3vSi+ttr+Ekw7n2m
TLSH
T137452305F7CF882AD85F9B7613A792C6D86CADAEE0BE4146345CB0177B3C2F464121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7808ecfd6f1fda95a7e18e2b920d4f8aec5025ff95de9cd2bf3fb83dca0909c6
MD5 04cafd43b2ce679c8132f0f8735f3808
SHA1 cd8194324c03a26f6832b5b0047a0eeab581a47a
SHA512 61ff3e3e36d6e97e4ae5c1fab239fadd7ea0cc87f08ca6d98dc9c4bd788db4a19b7ce0a7a70886b63572a8ffee8096a2f486c934a546776c52cf7cd885d977c7
SSDEEP 24576:kl0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:O0VY3vSi+ttr+Ekw7n2m
TLSH
T124452305F7CF882AD85F877613A792CAD86CADAEE0BE4146745CB017773C2F864121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bdf0ecbbddf29cf26baa5d96106fa46713208a01129b4d65afafc782e48981a5
MD5 b46e25d07c346ee09ce666c6139fbf56
SHA1 86ad11caf56c319e3d2fba83d8476368cd3e1ade
SHA512 1914dbc7b5c9eb636683e3a4059c6a9f0ebab920a83da27effa499fe7c2e09014993106287804a0561c5553d10916dca0aa6b1eb53da514c195f7f8d2b7e9f9d
SSDEEP 24576:FZMRzFVSOt0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:FZMRzfJ0VY3vSi+ttr+Ekw7n2m
TLSH
T15C650254B3951CF8EC67823EC9668946D5B27C5A4770C20F13A836276F373A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 551c36e37765439a0dee77ce4ab460154b70842cc339859b180c08dc265ffd1e
MD5 f4d766a3a112b57ddbd9976767c6c2ec
SHA1 866b7b40f8999ff9b537148cf802f6a5a9a55659
SHA512 433c564b004e7ea2790d53524527b18d956ee423b714a10def9527e31e09aa42329fc9b1eeac78baa393fe5accec8c305e428f815210afc24dcd783fcd83873c
SSDEEP 24576:vy0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:60VY3vSi+ttr+Ekw7n2m
TLSH
T178452305F7CF882AD85F9B7613A792C6D87CADAEE0BE4146745C70177B3C2E864121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f3a7bf403f4687cea85de5dd2c7a0bff00f7bfae6c48f86ff964f4adf62bd40f
MD5 df204588b0d1009875a6e9e5fbf9cfc8
SHA1 302a747cc8e0a6c6a36047b3f52da26b86f31a93
SHA512 cc52aa676b2d82096384de103c424a12bb43b96b659d50d041c784cf4036359bf7ac6d93a775261b1700f8ffa7424b22bf2718da3aac4cbf7b94884a5053be31
SSDEEP 24576:xm0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:Y0VY3vSi+ttr+Ekw7n2m
TLSH
T10D452305F7CF882AD85F977513A792CAD86CADAEE0BE4142745C70177B3C2F464121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c9bee0592f67e15f4da421a6137e4c996917dbc09f342dc75f51eab374726d3c
MD5 feef398a0b9ea23481cbce7c6947fd5a
SHA1 5bb084f9953c7149cd214f9d764b16f957818b6f
SHA512 557a0c51fa8bc838072a17889962e9a653787012178e4499db9abc8e8d7dbbd21dc36a249b03ea964cbe480755240f80430ff22002e10f170e5fbf820811ef4c
SSDEEP 24576:yzyB0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:yM0VY3vSi+ttr+Ekw7n2m
TLSH
T112550207739A20F9D47B833985A31A42F775BC768734869F226462772F362E09D3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c9f173982ad9051546c1774f1c122880f13c13105d8b229e5a288daaa4aa9e89
MD5 5612127db9861fd2619b9ca465636b4a
SHA1 46bc03847623b2cda1068de965f70d3090baa228
SHA512 6624fed9d3dd43bed219fcc4a92422f64bcda3c3a4ae4ad103173b23e16e7bbe1dfe54faebd414258360623f704cdea3376b34bbf83a785f4df59ec4ef579b37
SSDEEP 24576:/y0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:K0VY3vSi+ttr+Ekw7n2m
TLSH
T161452305F7CF882AD85F9B7613A792C6D86CADAEE0BE4146745C70177B3C2E864121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 494d9b9a770f59503a7ed82685d5ba371e081647e512a0a2327a75e364f585aa
MD5 e3664bed9b01afef95b67605e1bda45f
SHA1 f40f5c026da0421a457e4939b3958cc3a27ae6be
SHA512 8af48747307c5867fb5893d6df359c1484e47c6457638354fc5b87dee90806228438050d18e87874e19a09bf98c77f3e478543fba453be4e934a36a8fd887358
SSDEEP 24576:Dy0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:u0VY3vSi+ttr+Ekw7n2m
TLSH
T128452305F7CF882AD85F8B7613A792C6D86CADAEE0BE4146745C70177B3C2F864121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6804ba0868acd60fdb25bfcadde17dbdf3f6e5b0697b6f52b75fa7e456a74edf
MD5 c1fe0127cd287d441f6babebd694bd24
SHA1 ae628f3bb283072a983071ee9f158f100f387078
SHA512 fd8044ed958026d34b37e4f5ccbd0b2144bd2f3c203078c44eb4e9979e924de6bd55bab950709a47886fb991f74a9ef23f4f577c92f98a8327d2d1be070eacb8
SSDEEP 24576:mzyB0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:mM0VY3vSi+ttr+Ekw7n2m
TLSH
T1E3550207739A20F9D47B833985A31A42F775BC768734869F226462772F362E09D3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c38c7824779d8a26064dd2794079d039ac13b1b175b5157a53a87f6f7a0216eb
MD5 5af70a6c04fbe95f13f84af56cf5a278
SHA1 e6b2d011cdf41b79fb29638a4cf8e6d6b6c40e9d
SHA512 ad94193a94efa4fb1fc0c4b3d1d33e7809fbdce750a282efe8a688aad5b6d3f7f4ff80a7f93ead9eeaa3002f63f457230d6c8b87625ab43e1b481955e59e2f91
SSDEEP 24576:/TDaLl3z0zDv0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:/TuLljE0VY3vSi+ttr+Ekw7n2m
TLSH
T190650254B3951CF8DC67823EC9668906D5B27C6A4774C21F13A836276F373A01C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e8a522a2438f933f831912bbd571477eea3c58673c988c0b26983772ef2d8837
MD5 b9ddcca6b516502273f5c289ae8db242
SHA1 d50bf506e71c38e9f504efd26b74a690bb580fb0
SHA512 8c437f7a865dfe54a8deb9a6d9f0c95b50e5855c161b2b76f138112ac209aef4ed6029b2ccf0ab9d0c86dfa9b6c0684b79dd46ecda5b2569f8413c175d817542
SSDEEP 24576:I3vd9CHKy7GZb0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:Svd9CHKyaJ0VY3vSi+ttr+Ekw7n2m
TLSH
T1CD75CF90F3E814E8F0B7DA3589765501DAB67C9A5B31CA8F13A8251A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 357848426565b353475253484dd6fac2e90f4cb6df27a092552ae3046af8fdae
MD5 3a88a7d07e7235d9589dd364fbb1cfd5
SHA1 3794c78342a23b017d250f6ed6acb680d5910fad
SHA512 3dcc06aed6b6297c2075865ed31636c539d91e0b29ad0cdb3af41413947983c8e934cdd0ef31cba577506d640c6fe962385f90817eb4d7218e1d521e5865db37
SSDEEP 24576:4f0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:s0VY3vSi+ttr+Ekw7n2m
TLSH
T14D452305F7CF882AD85F9B7613A792C6D86CADAAE0BE4146745C70177B3C2F864121F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0f26b2c8e66805048856ae1cb2aaffe3cb0020c34667e26cb1e296f700382833
MD5 07a792458a44d08c8e3ed12826697635
SHA1 f43a0218fb3114a07953ed0efb27b565ffa840b5
SHA512 4035503459f3b0527be67ba2d11c8263193d6c01fd9cced2def488bbf6942705062db7451a59b8e8d2532f5acf47fbe24fe25f2c1994b6a0dfb42f127f031b49
SSDEEP 24576:ah0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:80VY3vSi+ttr+Ekw7n2m
TLSH
T19D452304F7CF883AD86F977623E792C6D86CADAAE0BE4146745C70177B3C2E464121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 45ef8517aa406d9e01def79bf625369ce63c8815e0cec656878d54f0cf25dd8c
MD5 695e3e91b988bed375778690660c9337
SHA1 1dbfdd2c4a45287b49dbc928b0cd9ef8980c4a4b
SHA512 425e43bf05987b5b0ad41f59228b69da7f69f492a371ba5b257e220f388373f85ef442fd508f06079be7445bfdb661d1a67d38569955cdbe5ece9abaf4ce9413
SSDEEP 24576:sc0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:t0VY3vSi+ttr+Ekw7n2m
TLSH
T15E452305F7CF882AD85F8B7613A792C6D86CADAEE0BE4146745C70177B3C2E864121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f0e1219deb9c54686e1996b58fae08468b1b5de5413ce656f5e23b1bf8a4ee62
MD5 b3202ab19fccb82ddc61c5f949852680
SHA1 92e251602f79d8b363f420794ee93258a0aa3c58
SHA512 db731860badd331f5b9d35c539a5743be35027ee58e35fff0e053fdfbe321d7747770b1100ab15efa8e490f5f0267e01e5398dac24b4868383681dd95c895c80
SSDEEP 24576:2y0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:Z0VY3vSi+ttr+Ekw7n2m
TLSH
T108452305F7CF882AD85F9B7613A792C6D86CADAEE0BE4146745C70177B3C2F864121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6cb5daccf8d1cdc2fe0235b467807f9d157924a57932f05b22d8a613effbbe0b
MD5 180830cd0b017107b1c1d6fc0db4a76b
SHA1 2151663ec64a4e048d7b4d1aca1f60c11adb02e8
SHA512 b7b5470e3d0f38dff811f77b95bc01e9b8394b8c404b3da1423c3c8439541c71fa7a761bbb5b41f31aee0fb4056c54db07edd9c3fad4c9a2b0d6a328f38b7de9
SSDEEP 24576:ef0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:e0VY3vSi+ttr+Ekw7n2m
TLSH
T143452305F7CF882AD85F9B7613A792C6D86CADAAE0BE4146745C70177B3C2F464121F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 badc0fcddf44ad4ee4fcb10ba210529df9a795170faf3384ee3edf000f9f9644
MD5 120625763dd8dc0294999c08817ccf7d
SHA1 2258329361736c5ed165434afb981a9af811c0b9
SHA512 3b5b5345aba155566c147b01741d9930af057e7b15d5bf022119ea85ccbf0c6dd81339d1421d3dec4d38ff972d3bf317eec27466bc6b091f71e11519d90d836a
SSDEEP 24576:BK0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:s0VY3vSi+ttr+Ekw7n2m
TLSH
T184452305F7CF882AD85F8B7623E792C6C86CADAAE0BE4146745C70177B3C2E954121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3212f4ac84f01b7eb40b19145c317391395604b5b6d73574dcf7eae89781fe9c
MD5 2f6957219cc03576c2ff3a2a5c201990
SHA1 727b4efb51af9c08b6b6c37e9f0af8556b932248
SHA512 98b7ed036ecefc7bc255a8f1f1b0271f63482bcb51a3a480a58428058605387070e8f13134e75810aa3fc99f2f2e54c436137165f88516973c6a506f94c98962
SSDEEP 24576:BA0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:C0VY3vSi+ttr+Ekw7n2m
TLSH
T19B452305F7CF882AD85F9B7613A792C6D86CADAEE0BE4146745C70177B3C2F864121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 cbb07f11223594bbacf465c6f638860384219bf9c941942883d66fb9f44dd2f0
MD5 38b1692473409ed771e30d65262274d3
SHA1 161988c0a18543a419431ac94c99903d6f5258ad
SHA512 6522eca7230ab0f96fa14b0cff1903aa62982c6f6a0606a5ed2561c51b52efe1449f888346319cdf497f570de1a327b24df52c4493b268403414f5fd3c3b0595
SSDEEP 24576:+fwvUk9RX6wkyAI20s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:mMnYI20VY3vSi+ttr+Ekw7n2m
TLSH
T16585D029EBDC44E5E0B7923C89B3460AF6B178695B31C2CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c0c51603d6171bdd5f16c1c7c0f1cca554d7d1ad5c88ce83aba8a223100a7138
MD5 5f69daca2259d65d93be7eefef0d2599
SHA1 21b3fba252dd7dce54b39d66c8792daa75f19833
SHA512 e41411f98c59c0884e105fd0930f645ff3c845b04e0c7899b95acc2e60cd0216b44196eb3491cca12a56480d2ac168676cf4bab418c29951de89bf234e08f45e
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0z0VY3vSi+ttrv:tySzPb0S/Si+ttrsw7n2m
TLSH
T110067C56A1AC01D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9ce5ecf417b54f6e1a05205875a612621e2fe8caffd8080fd4afd9c476e87df3
MD5 6c983e416e4a2e334ea62bc45e2a2502
SHA1 0d6fa9b58f01819f2cb018857db8e15940b45ae9
SHA512 eddf9520bb07fc563ec40d79bc855bd6bc029b541b8d9e787cf7516427661862dac6fedca9332dfd4dc741886ed4ba8066b06b4d485ba913616182b37e26cb67
SSDEEP 24576:d47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY90s8YsWb4KSi+ttr+EkZDOs0tvbbUK:d47JUQjTirIhCnDHUPfF/D0VY3vSi+t9
TLSH
T12165AE1DA3EC01E5E1BAC27885154A5AEA71782E5B31C6CF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 dd29847e74a138317670a39b414565eed00213bbbd9766fb5c92f8868071d6ae
MD5 cccb62611ddcfba73747a28568f4a02d
SHA1 cfcd48c29603fee46d98aebd875ac858564dcb20
SHA512 5d78460eedbf0e940259084df17ccb62c119052005d3d717023ccb819e68fe6e4cec9e0c74eae2abef2e9fe6769a8790442aac7b576bc0a37ee56d916e05acf4
SSDEEP 24576:Si0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:l0VY3vSi+ttr+Ekw7n2m
TLSH
T15E55F009E29941E8C06EA279C7968681F7377C6593E5C3CB22D0F43E2F392D09DE6653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a5b9cd418dbcf6c7c0a76b39336467173c678992a9dd851b1af44438365583b5
MD5 7457715ec529527923be772d8b6ae232
SHA1 4788a8de310299e9ce3a8565faf1fa0abb19b193
SHA512 55b7bd582c59e593db6d5408c2cc84b46d2c689c0cbe55b41c310ecb99ae33da3f4933849bcb9ec6acd892e8c08c9acaf2cbb3f33d39dc5c215249748d1e6ac8
SSDEEP 24576:AXjH9UPvDxGpDwKSWsh5UXodhostzKkv:K9UnIpDeW8+YjoezK
TLSH
T1FA450701722ACB4FC66940365E76D6CCAB707D46EE046F0373C9873FD476A59B6E2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 29d0ac4a07ae4d4d7907d5710172b545e0bb6a6a4c7b53b5467e3f699003b6c3
MD5 5d6d06034cc58ffb610a7e668abd3551
SHA1 7e3a9428401cec8ef2aea52423f6796b331ec805
SHA512 11df980d827db240c85eb2c2d0aacaec4fc7e9690be054e59e8c3101d14a561e808a01bb880f206922787887af04437703b6638d908e96d2a9cdaa4a0703299d
SSDEEP 3:OlH/lFYjeIzW/l4YE1qqlzAaljl3yjIl/lllo3mCllltGlslslslslslsl6xQY:KKzGmc+AaDOIXymCtEEEEEEEYQ
TLSH
T17781120C47C41620EA9AE035180B4BA83722F61CF588E7EF320412B1CEC026D6C73738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d0242b913ef26109762be5c24212dcb51e57d4bb65e6dbc6318109bd226bb55c
MD5 7fbe50a5c61ae1abae7cc7eac08cab25
SHA1 05b87b4605343a55cf3a4fcc66960f45595447ea
SHA512 54100e479460a835fd9ba2978da50301c9d4687ac9ce4072a2f2821a3fe56bf1bde3c16381fd6015174dedf5ea81dc6b53c4525a80e2d633f8909246580c273f
SSDEEP 24576:dcTKLiszG1DetlOqN1Z4n6D2hY6x2oc7B+e68gjAe:5ftlOqKXxdc7B+eHgjR
TLSH
T147552A01A5B7EB0FC97A9037423286CDBB786C07B7453F0573858938986795EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bc88b84d1c095c3550427235b0a6f349fe02d7db8a1051704b4460ff10a1f331
MD5 e14a797fac91462baf79ec0c35177448
SHA1 9782333157d7bf53e8a4e27034aea42763527342
SHA512 47e4ba4af65860cc4c62e3118368ede216e18261d3d4d461ddef24d38c9200bbd79d598cfd44d3d450df1b1f3870f0fe4e2762348cfff819185f0553d316189d
SSDEEP 24576:l60s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:l60VY3vSi+ttr+Ekw7n2m
TLSH
T159452301E38F8C26E87F9B7413AB9146E82CBDB9D76981C37408711B773C6E49D72269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0738976128e8b6f3fa27978b762cc1649128d251cc879b203dd31559e980c7ad
MD5 8b03074898bac4e0f43bffd8dd4e6f3d
SHA1 29ec28343811043360df16ce02cffd3dd1a352ed
SHA512 5ec59a11d97509a693557c88fa83a792c87f5c4d183be4307f7fbc842b124796d9893f0bb5385db13874bcec03dbb2d5fd8237eb7d2cf18f4040d844b70d5348
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYE0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:ngb4mBIBhGF90VY3vSi+ttr+Ekw7n2m
TLSH
T18D65AE1E22EC02F5E0FAD2B89DAB4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 14e61bbdfa86b14704601014849df4616a4575e2a49243192604a0b9d00f1409
MD5 dc7100b93964dcdc5dca783db9e776b5
SHA1 eb833685832448d2ad13efb9b33426272f9333ff
SHA512 647025d7ee8865bf4010e2d1e61023fd13d3b64af44c809628eeeebb44faec2eb0aed473bbfa7b0ab54f7bfa75061813a07dfdd0c3b559e41465b6a0d8ebc836
SSDEEP 24576:1G88u8FpJqH1bzria7/mt0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:47ZFPqVea7/80VY3vSi+ttr+Ekw7n2m
TLSH
T1D085F12577E501F0D47BD1388A874653F6B1B8250364EBDF06AC8A562F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5a60030e2f830e11ffe00d3f505f38545495376c40b664ffde638086179bc717
MD5 e03df282e1e0abf2cb15e45847ab1531
SHA1 2e8691c92e0c22d3116a2965d2f97e8426990952
SHA512 f8d1d6c7cb6100368e2c32fd9bebf66978cfb68550bb60dad504d31b60a0eec2c61a6b0234e4fae2580222ec08a7ee249c4b8e4fac0529d796a43def6b4b4d99
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj50VY3vSi+ttr+EkwN:dG05lO43bu0S/Si+ttrsw7n2m
TLSH
T132D5CF6A62EC11F9D0BBD17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 548b9592951c688cb2841ceef013821a714bc11708653e43f668b0e99dec5316
MD5 88f7bb96af8ee510933727d8ffe41a7d
SHA1 45503e22baa7019c7f1c0d92e8536c1a8c025cdd
SHA512 29ddbf09ea3152b398c9d9a222b4ae374471441e01e70bb37ab6d436d21f37635b4fc87f0dbcc24997d89c782343ab07899d7e4af8c51c7be44f52c98b8481a7
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnz0s8YsWb4KSi+ttr+EkZDOs0tvbN:aa5POZ3BJt2pasx2+mh0VY3vSi+ttr+I
TLSH
T11265AF5EA7FC00D5D579D17DC683860AE5B1342653329BCB112182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3b832bcc10a3d0dfe50ec2f178ff7df8e8138de3c3ae915d379b4beffff63dd5
MD5 424f59d028ec1dd6d8a9f837b7ca82ea
SHA1 ee65f16af671306b92fb23903de4214921209cd7
SHA512 ec89d41be0dee9eaf4fdbeece75085687e277761566bfe7e3d3f03da661dd4fdb22888f79ceceb152711bcdd10057b79cc48a588c9664c10efa7bc5d42c25dde
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkV0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:2Nc/zEOVHFc0VY3vSi+ttr+Ekw7n2m
TLSH
T113858B1623E901E4F1BBE1BE89779546FAB17869533486CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 894f76335a694987ed2a825b126602105e481fda46b89e6226545a72bec665f9
MD5 b8039bb3da1d5a353e559d2d283e0ece
SHA1 393245db434d7493fc04e1efdd2cda6665c2eed4
SHA512 025da4de564a0dea5e583cc6cd0406d0111210ee3aed4257020ce8ece48c5102f4fb4cd361059a8d2af9d5c2ba5752dfe60591073e1abaf6623dab5934bbdb4b
SSDEEP 24576:GTkNvNnaFeYhJNtmZBmt0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:GTMwBtOmt0VY3vSi+ttr+Ekw7n2m
TLSH
T17A55AF2EB6F845E4D1FEC6B58E238512EA727861073293CB5290C13F1E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f579b4106c7bd35a622d861111e43cf572e042e0b380e2e252ee01c42f2b07ef
MD5 45f056b4284ea2541fa684e8f1265c99
SHA1 1ee67711ce6377bd806a759c1e16d7405a54b838
SHA512 45a629676c2b51179fa809f3dfabf71e3e16c501e337c6f338c9b6f6d3726e776f68f7cf12d1f7ca2d510c5d6176c4ed860b8c3a0c77d868468e73c85ff3aa4f
SSDEEP 24576:GPUr+NQJ0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:GJQJ0VY3vSi+ttr+Ekw7n2m
TLSH
T1AA65E11F62DD1CE5E57AE17D86828709E771B862531292CF02D0917E5F37AE8BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 54cbf9a0b3b72be00c9d02e74c421a268878c9edc5bdc924f1743d46d9814197
MD5 fa686ec1bc6b52b21d486422bb83f69e
SHA1 395859ce5938c05fd3fce7999c4dc53a27db53e7
SHA512 ba6069c36fb8c04fb21bb8ef6ac28966b1a16092f895e0c4e6d372ba8573c4ae5aa8af8ccf34aa5436d9ef56025db0cbb4778b0adbe64b3d4fabcb9bee26ae62
SSDEEP 24576:PD3FHshBIYQgA+0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:PDVHeBIAA+0VY3vSi+ttr+Ekw7n2m
TLSH
T19275E13DE79D04E4E47BD2BC96638606E67138A9033256CB11D491BA2F2BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1248-317-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1248-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1248-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1248-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1412-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1412-88-0x0000000140000000-0x0000000140433000-memory.dmp

Download

memory/1412-48-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1412-6-0x0000000140000000-0x0000000140433000-memory.dmp

Download

memory/1412-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1412-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1468-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1468-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1468-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1468-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1512-283-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1512-72-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1512-66-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1512-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2908-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2908-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2908-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2908-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2908-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4240-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4240-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4240-15-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4240-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4444-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4444-89-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4832-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4832-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4832-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-334-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4864-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4864-61-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4864-51-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4864-57-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4864-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5284-331-0x00000216CC4E0000-0x00000216CC76B000-memory.dmp

Download

memory/5284-400-0x00000216CC4E0000-0x00000216CC76B000-memory.dmp

Download

memory/5308-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5308-84-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5308-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5308-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5912-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5912-125-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5912-119-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5912-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5920-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5920-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5920-139-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5920-137-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5920-131-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download