ddccc18d55b8354b6b267d715bcd63f1fa75d3d84e4dabf5806454f8142613be

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Size 1.5MB
Sample261102-e5tpmazygz
SHA256 ddccc18d55b8354b6b267d715bcd63f1fa75d3d84e4dabf5806454f8142613be
MD5 ea9c28cb9336ca64b5ce03b32ce16043
SHA1 1c52a114bde36258c3bacc8857269d6db51a9a09
SHA512 4e3570eb36d3716128e2ad22ca3f55cad6afff0b757da00b9fd4b62eacf90ddb217947518313ca016d2abd2b45f0a029466edcd2387c5792b87a1cbe8dbba9c4
SSDEEP 12288:zS8NtgFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:OcmgPvod50p/TXM2s0espsODZjB0IP
TLSH
T18465CE0396DC3CEAC13A8630B77B87C0D72EEC6553A1D58E43D046A6897E5A37E267D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5356	elevation_service.exe
5828	elevation_service.exe
6036	maintenanceservice.exe
4540	OSE.EXE
4396	PerceptionSimulationService.exe
4464	perfhost.exe
5860	ReFsDedupSvc.exe
5508	SensorDataService.exe
3188	ssh-agent.exe
768	AgentService.exe
4216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\afaff63df1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fe2e022836add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091bfe71f836add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e90c720836add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052763665836add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007efeb020836add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bfbe1721836add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005aa76364836add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c8eba20836add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000344bbb21836add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe\" %1"	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5356	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2204	2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5356	elevation_service.exe
Token: SeBackupPrivilege	5860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5860	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	768	AgentService.exe
Token: 33	4216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4216	SearchIndexer.exe
Token: SeDebugPrivilege	5356	elevation_service.exe
Token: SeDebugPrivilege	5828	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1476	4216	SearchIndexer.exe	100
PID 4216 wrote to memory of 5840	4216	SearchIndexer.exe	101
PID 4216 wrote to memory of 1444	4216	SearchIndexer.exe	102
PID 4216 wrote to memory of 4412	4216	SearchIndexer.exe	103
PID 4216 wrote to memory of 4156	4216	SearchIndexer.exe	105
PID 4216 wrote to memory of 2332	4216	SearchIndexer.exe	106
PID 4216 wrote to memory of 6068	4216	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ea9c28cb9336ca64b5ce03b32ce16043_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6036

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4464

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5860

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5508

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2804 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2804 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 58da72f234d02ae46158013c1d6ca8777aeec05c9a8ebb926ae4a62b4fd56e69
MD5 39f58b7f941b944d889dc9917eac625c
SHA1 71d36caba28b2132b7523ff66e6e1f941850aa14
SHA512 6db74395d7b0854d142dfe76b744927c3d812ceade14972b1a828066f0ad38fa754190f4aa294da390004d42bc6228548ba55f4fa274a155b8ac4a37c6429981
SSDEEP 49152:pb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnO0vo05s0eusONlP:/3q6tjBZeD5s0JXP
TLSH
T137D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5a8ed903cf7098402711ddbb9bf47548660e36682b5552b0aaa72704dc1612b0
MD5 dbebdd00ffa76cef0bc6a4efa2fa6436
SHA1 64ca749f0a4bb44ae7ecf44ac0d0dea21088b13a
SHA512 9796c43e27777c411e8cd8b88c4aef8f637cdade89f2209b5e947fb9966dc15b20402b916a58bca8b3d0386cce5f71450c8279b5d8cf1d8028060d989824a96a
SSDEEP 24576:KXYfDtczA1gPvod50p/TXM2s0espsODZjB0IP:Rtc80vo05s0eusONlP
TLSH
T1B775F12867D409F9ED67813CC8A2C521EA72BC5547B0E78B03E4956A1F337E81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ff4ce5276886b37ab7511d9e790e3872257d296048f082177c2affa643b5e437
MD5 44f837d767c39a2945bc8532a2eabacf
SHA1 4eb2833fe0828e5efb49972066c7d68030cfb2a9
SHA512 8cae3598d235a92d02081cc33cdc6ff1d94933e78191c0fff309af430b280b9eeafaec2fb6c91b55f5ab6170ed4ad620e243ddaa6bfea70d138e4471376892ff
SSDEEP 24576:g0Le5ji0hmxnrM8gPvod50p/TXM2s0espsODZjB0IP:gPji0Ax50vo05s0eusONlP
TLSH
T1DC859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b6f2ea8ab525d9f611f678103f85f13b6c15f97e665b618f10ea7b32a1fcd761
MD5 ad9d9288ac65e44534ebcbd085681b29
SHA1 c7ee1f04e1cb05792d72631b628cc0f3d5f270d0
SHA512 b6efc5de2578a239ce9550ecd2c3df51ede30c13928f69cb241254ba0e765655124f7506034035a3965e4f4a73accfec59ef63cf991baf319114b241874e823f
SSDEEP 24576:+a7/ezSC6vUyDZaqgrvWx6q8wyu+gPvod50p/TXM2s0espsODZjB0IP:5/ezSC6vURPvMHjy90vo05s0eusONlP
TLSH
T11D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 80c0b3633c45eb9d2bd9fe3a21b3b2eb3f2d6982464efabf524029a91e296dff
MD5 816deb7daa23090791b3d78ed627ec10
SHA1 797900821f757843ccde8e3ac1acae556fd5747b
SHA512 3947d9a2eb780b512c4eaede0b4e1fa76794341da1eb8491c81cc949821371b39b49fab62d9f51d0454ddfecc5da78ed11068eda8cb1759130333fa9f7f9266b
SSDEEP 24576:uVbqPb88hv/lV7vgPvod50p/TXM2s0espsODZjB0IP:uVO88hXlVr0vo05s0eusONlP
TLSH
T113559E66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6357e967fbd2f0aec19698f04aeb87edac20e03899cff5a046544299a9d95e98
MD5 12f38635e6d130eb5ff4b3dbae02fce8
SHA1 a913f07da6145cd93135137a51730b196080e7e0
SHA512 80a70cfcca523493d2e76e240272dbe6c002a7a691efe931267ef6c7561e51421fd585061549b107decb924a482f228f197feca5f2dcb919fda73a799423368e
SSDEEP 12288:BGaFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:BGogPvod50p/TXM2s0espsODZjB0IP
TLSH
T1EF5523424A4C1181DFBF0831F4ADC9FAD464EC0AA7F09B4B47E4B66E947CEFA4606671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a9a7f8294a2fc32b2f9d48bcd0e55db985dde4988972cf731b4c2099fbaef83a
MD5 5ddb0bd47b625c415f7a1c87d68f6d64
SHA1 9b0ee0660a4676f81482a3cc45b16de8ea18b4de
SHA512 335e4c9f5f32f3ec3124a98ded639862c1b6ed3f8ace47d28532ce2f54be22e5e72807dcc543f7fcf99a8e1fd9d801217af8a6b3105a8e8e1c03cc87a4a420dd
SSDEEP 24576:VJIUngPvod50p/TXM2s0espsODZjB0IP:VJIUn0vo05s0eusONlP
TLSH
T14E75CF3BAE28FCD2C67E4D785A91C640D77278304B62A3CBD165C20EDE235E51E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 690ff432d1a8922c17fcf468778e13c6b648215ba7cd7e2ac6c9c7ffa838b7f1
MD5 15e25d43dade0432bba007c36f32b0cd
SHA1 6f6a52ecd3a85906a66f9237fad5a929961a4df9
SHA512 50773123f605d73d814f6dc351bd7d1fb6e11df30700fe31af64dede4b985c3e66927020875608079b7a58b67f848efdfa44e5ef37a14a38295453566954f7cf
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THG:dQvGAdlCEL8c/pRNw5CueD5s0JXP
TLSH
T102266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ec507c66d75f845a207a5528600b5ecd25b721a6256487c9f77d4555a75cf4b4
MD5 8feebe212e725a929b08820ce198945c
SHA1 576f5cbe7bc2b6640eb1277dbbd57f21d3352c73
SHA512 b4c139975906240b5391deedfe56aad95b1ff787c66d38b7e7716ed79d310175543b308b94300d8a2fa373a6a61b21cc3fc00cff0bdb837731436a26197c7cde
SSDEEP 24576:5wewsAjpgPvod50p/TXM2s0espsODZjB0IP:Cljp0vo05s0eusONlP
TLSH
T13975E031FE74E032C7BF0DB21B25C716547CB9204BA11AC3E3E89A9E59746D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c10e4e1fc410de16dbb576f552c286ca4b217c4405c53f5eafc0c35073343081
MD5 7b9a71d7b0364145482dee4cbeff20b4
SHA1 6c41d5d1f081d0a71434de100cdcbd5844985598
SHA512 454ac6c5db2729338d9f8e3702093112b36c351a93f3d6d7a36e1ee46dbc438cbd80a6ab26bdcf3532166f86cf1eb50c2899cb07da52d4c54ed34e49106c04f8
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHE:qUEtQevvqc2W1cpV29I32E
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 35f4f2409b93176e885150633f9981e3852ec4d8dd7c6e2098233d16bdad1955
MD5 52e124fabe27cd13aad592a1fce4fc5a
SHA1 7bb3bdb81eb5f1f8534fb7e261c7a1ae71719eaf
SHA512 d7fc3fa276d778bcbc048c067f669a8abbac8e0066731c3692d129dadf75e4953b7bcf8de1087ce10920fe38d3be337847988ac063c5383f0e2f29f79b2c9bc5
SSDEEP 49152:WCbRquA/m2yL5zifFiV+XenmE3/zJ0vo05s0eusONlP:boqHVjnmieD5s0JXP
TLSH
T1DCD58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 663b6cc4f23c1ae1142d941821c6c5b737d015edc1e023d6d65486b2701c47a7
MD5 e8ff1b03b90ab8d661a3a61570d2c6b8
SHA1 d15b6da30a730274603e13b544f75851306cfd77
SHA512 075983e37298825b67107b35ba6941fe28c368ab8e948e94beb644326450790dc9f40e707e6a1a96cb00ff5481f056bf3aa0714064ab8c3ca77ff04293af50fa
SSDEEP 24576:NAhGLmIFoiwtA5l7S53CgPvod50p/TXM2s0espsODZjB0IP:NAM1Foiq5S0vo05s0eusONlP
TLSH
T15D35AD81E7F955D4F5B3AA7899B68171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4580f46b27fc5e3beedda4f446d7f56fe63a1b94ab962f200befb501e89f6837
MD5 d2b4802287eab8f4629c6a091ecfa907
SHA1 6d1cb6e89d3dfeecd01fcc4b7956112d94362023
SHA512 b2504a96f7568ee1ad8028f37f3018485f91cf20f70b47e5bfd9e90ae809cc213aa9b50f6a81b49ec808d93b2fed3033380f9d69e20a51439b58e9764a645fab
SSDEEP 24576:swuXOWdgPvod50p/TXM2s0espsODZjB0IP:swQO20vo05s0eusONlP
TLSH
T12C65F14626980CF9EAA74138C597C536F7F2BC022A71DB1F07A0C65B5F373616D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 483f073d94b24362ccf1801be9cc954b55617b2a2929e2b705d19939e03ca12b
MD5 0f60d1d914f64943bf89bf68a116099c
SHA1 8066601c9300d4e7b88a7071ba208838e3069a39
SHA512 f35e126a879cbbc2b32947f6f04a9deeabf93e8ca61d7c2e02c9d77b3a2ee4f5f594163077823e02351c434435887573d02348cd4b514c68b7a3861fcf01ccec
SSDEEP 12288:FbZ1IyNFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:hZu0gPvod50p/TXM2s0espsODZjB0IP
TLSH
T19F55124623C820F5D6B74138D8E58AA5D771B81663B143CF03A4926E5F76FE60E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aebc7885ef36ece5bb125d3620ddefe24c1fc9a084212542c37fa405cfcdce57
MD5 cd5eef6c705ba7b54df016126af606ae
SHA1 4c3442ef0dd0c8d1fe8a90aace2d5a88de3aacb1
SHA512 52ee1d7648588f12a5bc1840021bbc7f68a84e3b04e88037549203999ad5fcfc2e43b2c4304abc6680fbccfeb1a06537ab6d0aa91483d7d4125c44d2241a0821
SSDEEP 98304:IQRQyi36YOcPuLvw2gAf+PN37eD5s0JXP:fQyiKakX+PNC
TLSH
T1B8667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 90cb12a4caa63a4ea66945eb93d399c6887d9cc689f7de55c53035ac1f7b4aef
MD5 ee44a715d63bdd34994f52b3bbc97d0c
SHA1 19db11103f3c980733b3d69b90b6cec405cfe7d4
SHA512 e1816ce8c5baff1a925083bd8c32019d00b917af3094b44240137466339743d00a2106fd2c2f4134e2bbc8e3d12df55e2907988849849efa9c737cd44a4f3bc2
SSDEEP 98304:lQRQyi36YOcPuLvw2gAf+PN37eD5s0JXP:cQyiKakX+PNC
TLSH
T179667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d943bf59945dbc77007009d7300f17f13dfaca92d56f168bd73e2ac17631297d
MD5 407df212914d0cd9d0bc8b8e323241f3
SHA1 7a4a48b55d74b894213a84a5e4bb1e08c5121f8b
SHA512 419ba26a7704982d78e45920f23b6b60fc6add86603beeae7c413bcd27ebd76f4380d99baf61177a5e973e3431dcb56ee3a5d676f604bd3e9515a485419346bc
SSDEEP 49152:Y68Qg55nhxeWu7PNU3/50vo05s0eusONlP:ithGRc/5eD5s0JXP
TLSH
T139B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d0e720b1ce558111e59b2d1566a8235035998d4342fc2da289b7d9b9dab549a1
MD5 0dcfdf0c7588e7c9704071a6563365c1
SHA1 db08d0534602ea130c0f13e89d55b71395fe9cbf
SHA512 926d759320052e56e788981f1c36928c5358654d1fa845335037c4e2086b7a469afcf9e151cfcb56b4311653e228ede667de9eb58d93881c0b0f57ee27f32ce8
SSDEEP 98304:8y5112gYy5azzVvD69nLKnhZoeD5s0JXP:9LIH+WhH
TLSH
T167167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e10d131358cd196051dd6315db88d469f333afd9dc2a188dd5326aa12d05b688
MD5 98b51a32528d0aa39766253066423f1e
SHA1 6589e215482460c587b5d5ca008040a7050852c4
SHA512 29e49b6c7f6e3171c75e97c32aacdf684a8251329299a219079cb1047dca0754776f435eddc2fda121d46b58aef64eef55d53e4afc9552a0c95c8915036dafbd
SSDEEP 49152:PB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gll0vo05s0eusONlP:xu6JmQxd2dleD5s0JXP
TLSH
T10CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aa48daa2a8704d4f5072ae8103d7d910ecd96759ebed23acb4ae950a2b4b5e6e
MD5 16ffa5efe1233d2f55c0e5704bb7d0ae
SHA1 c2591d9790f1a7507ec3f4bc867c53852fb0dae9
SHA512 c216d5c1c59a295afd78a0412f7aa7065a091b95ea4a3240fcddf5243864f8c69b44988c3c7fa66a07ebfc4dea47ea907e0e3dded9f0584e7b971dbd375d9131
SSDEEP 49152:s1hpsNoJpF1A6yU44CwH7R4xH0vo05s0eusONlP:smifPVRieD5s0JXP
TLSH
T1ECB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f29e91de289d9feff11ea43a26f326069f943a6aaa9afb2081847eb414d129cb
MD5 e69b8fb5d110ec66a12dbff2d89dc6e6
SHA1 5a07ef8a5e0db217a2f440831c5ef194cccf1cab
SHA512 91fb27851f06cd2d8d90946c8605952e8327bef6063243e7b6163dd81dbd0495483fb7e954723514a5d99acca640e9aaf3ebc6d8be9d3da4020d193811f04f76
SSDEEP 49152:CSuZQIY0Be2KIRVtOnks6NMHq00vo05s0eusONlP:c5dKOi610eD5s0JXP
TLSH
T18FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e16a4b7b046e1c8e30954790e37ec9c190413a202875ed29a64e44296b6c18f4
MD5 832e54b296d1c187cb3fed21817e51c9
SHA1 e131c6c178ba87fcffe64e31dcb1c2b2999ed8d4
SHA512 bf6868b9ab8d181fe68a45955b615de330d7d85cc398dc58a650e4fcad97dcc7e364d4f7257f644a976803cdebba353fd660ee58d6c2e26c763e79923ba85017
SSDEEP 49152:4htSn8EApI0figGgiDn0AP5wD0vo05s0eusONlP:pX2i/phWeD5s0JXP
TLSH
T15995BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bcecdf4dce7f512fd9cd4653dd4981e77ee70d3171f80c6ae191acc23ce14114
MD5 f19f943366aeca7a6550c6ca31ff3f7b
SHA1 2788f8a745af0f181567bb76f51c65866bbda0b7
SHA512 dfd16e4fe9bb487fc5ae9df25999f5fe69151713efd314e66d481c88ca1ade00525a89b302ff093af9294dc709ed406c0989b963a3b091ff3ce966f2ac3a87f7
SSDEEP 12288:HCFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:HAgPvod50p/TXM2s0espsODZjB0IP
TLSH
T159552341098C1285DFBA0971E4A986FAD468EC0FF7F1574F57D8B12E95B8FFA02066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b733f10e8439dabf68e8d861202af281bee85927081eb44592ad02ddd6afb29e
MD5 f67de1fbddfce299e67a682d7abdf646
SHA1 f3db0eec03f8905854c50eab7c7270ad26095a7e
SHA512 d89b3d5b258f431a57b4462cb42cb513e55cb9dd7a02ff55606e58a0ff26befe89d9ee27ee319d0a3dcb519937859fc3ac968c740260f777c93f5bc3a4dcd702
SSDEEP 12288:bBFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:bFgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1AB552341098C1685DFAA0871E499C6F9D464EC0FF7F1578F57D8B12E94B8FFA0606AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8a8556aa9ec5d6fdc8952edbf011134ea42c9fda4af5dda41085966cbb1e0ebb
MD5 88df1ad64b7d3a1be3f026b561ec0876
SHA1 aac53e32e1509e9712af946ab674a2f8b9c391f7
SHA512 73ae11f2f784d4b87d4eb32b1c6a97f35b73127d86daa877d13275a0e18883f70b00df76cbe071f1a54d491fcde3210e022f29694ff54c96aa46a26e42f5bf7b
SSDEEP 12288:4DFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:4/gPvod50p/TXM2s0espsODZjB0IP
TLSH
T103552341098C1285DFAA0971E49986F9D864EC0FF7F1578F97D8B12E94B8FFA06066F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c842b2abff252403eb64da696a7c1e6536872f113361be5488b3db6ada39e817
MD5 53cbea38bacc6567534585aff92ab0e5
SHA1 d92e879cbea9efb2a75733b24f77defde73c5395
SHA512 b49992099c314cfae82ee5820fda638cef85306bb719ea9c48243ef4dd21bdda6095a2e4759038c923275fac8aaac55e8862fd4d00012685b94623ac9b7cad0c
SSDEEP 12288:0VkFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:7gPvod50p/TXM2s0espsODZjB0IP
TLSH
T1115523020B8C11C1DEBB8534D8AAC6F5D4B4FC0AE7F1578F8790652E59B4BF91A25BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dbdbbe4d902cfc903a38f10fc2012695c25c5f43fc377e685f51dfc9f8eaba8e
MD5 235632820be6971ac360f96b6b486802
SHA1 42ac628571efab6e2a2190fcc48298fae185176f
SHA512 0ef1d0f36ef4a8b10517a4133e822d9515882bc0e2f85df60dd576bf894e5418edf94a97bc84413d3b761b334c3213a5dd2a3d4a0943ccb5493e8a1bcfd66095
SSDEEP 12288:ZcFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:ZKgPvod50p/TXM2s0espsODZjB0IP
TLSH
T186552341498C1285DFAA0871E49986F9D864EC0FB7F1578F57D8B12E94B8FFA0706AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 70d96a1eb55c4246eefdc8113d8bf4233104c1f6044e69d33f0b98ec2973c56a
MD5 6436b66072369b76bd7aa45af988d105
SHA1 6b569f1bac5bbebb0d0b4c1d481af2181c2002de
SHA512 6b394c4c57ce85a7f4d43d7d31e5943cffb7d95b8fd64e65ec90f7d3c1714f3be04f58f6598ce0cb8dfd2c38745e01b10829425b73dd859d45fbb2fce85a465c
SSDEEP 12288:KlFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:KBgPvod50p/TXM2s0espsODZjB0IP
TLSH
T126552342098C1281DFBA0931E49986F9D464EC0FB7F1578F57D8B12E91B8FFA0706AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b088329b7eb9b3f78b6a4954a9ca299b8106148e3eea35dda7dc291965050735
MD5 75de1b65d86b1781597227ac19742fc4
SHA1 c74d007ce60ded4cd9a23f412a6d53294448d3c6
SHA512 8cce2606264d278c56da22f523810fff3fc31ba17296f090f9234bc985cf4f639d75eb43e937c5a2ebbb196f12f6ba93efd1c3db425f9e20e3b27896f511e712
SSDEEP 12288:W5Fd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:WtgPvod50p/TXM2s0espsODZjB0IP
TLSH
T168552341498C1681DFBA0871E49986F9D464EC0FF7F1574B97D8F12EA1B8FFA0606AB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f39195865f6d60a9c75922f6ceaa21eeb31091c2c48024c564d702db648e680f
MD5 dfc8099248e0a176503ab20f0eaa6b34
SHA1 100081465a0cd3b019d2521d834a24e42fe050b6
SHA512 90ec9e8ea26583c5c5659d6c456d1637752fe52919bd17ab3401bfd1b8e5993599a4f630ec3d6099d7153f9bb1657bd7c2b6ea08c236ffe48edcac1b0fda6f13
SSDEEP 24576:BZMJzFVSOlgPvod50p/TXM2s0espsODZjB0IP:BZMJzfx0vo05s0eusONlP
TLSH
T109750195739018F4ED67813EC8658966D6B2BC1A07B0C71F03E4362B5F337A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 92f4da79d4d63feaf2fe8b94674a58c3724f7790eda5af291b15fc0b592d5467
MD5 5fbf356ec7452b7f8ab7dac3c03c38d2
SHA1 93ecbf1c33254b9207ce72f5a5f980e292017c82
SHA512 ac6f610f00d3e5962e0d48b7ac260368f642b017c5b240d8cd87fa03f65f5fd79767a8233d4199febf987c23cb9fa86e7c8460e2b91f54b4bcb9937708fcc759
SSDEEP 12288:tOFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:tkgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1D6552342498C1185DFBA0831E499C6F9D868EC0FB7F1578F97D8B12E9478FFA06066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b807a2bf9ad46b8f4de706eba64c2137197eb94d9c2a61f67b866363c5b83645
MD5 21fab82d42619673e6c099aebec6e003
SHA1 49ab7449057ac18400cbb39344b027e3ccc3dc03
SHA512 50426a4ad17d51d3fb3b0155bbf88d27b14b911601a870431e370f9e17d82c6e34b885ce34996846758cde3a665abaed468cecaeb0b7c51c17c42325f7ae13b8
SSDEEP 12288:SqFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:SYgPvod50p/TXM2s0espsODZjB0IP
TLSH
T164552342098C1685DF7A0831E499C6F9D468EC0FF7F1578B57D8B12EA578FFA06066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4395d213c0e2588fafaa9117e519b57368d4d17834c0782fd5b967753184df2d
MD5 0261504d3a8dd6529962329ba892ae27
SHA1 f4f3b727e5b3f0ffc34b2fe3e882bd235949f666
SHA512 b5d02e437c016293cae1a1a5090593379c7a0877ff8b146bb8e02136fb982a0bed837103d1cc1ba5e280c0ca97b5b51fde2f30089ba7faa76a10fc4bb6b31754
SSDEEP 12288:2yPz5L8NFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:LzyZgPvod50p/TXM2s0espsODZjB0IP
TLSH
T143650203239530F8D5778234C8A64A62F771B83657B08B9F13A4527A2E377E15E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5096a4db4488f7c0d0bf1a3785900f1b5a8466422f6ac6152a39525da16fcc5c
MD5 a3c56f378a9d847e10da553b59db0400
SHA1 f482523034fa931b67a91d92c2e6af5cee667ae4
SHA512 9c79523fdd94d8915168361d675ffa36c7956e7ab146a9d5e914a30fb02ffa8d1a2d3a1d17ef009007ff50af3cd94f7feea9d3a0efc4421aed9388ddda3cc49e
SSDEEP 12288:aOFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:akgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1DF552342498C1185DFBA0831E49986F9D868EC0FF7F1578F97D8B12E9578FFA06066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 abfe45abac5089a0ff92770d37dc348c315fdf92b6c814c2429c1445b4cd1582
MD5 0290e02730abb7c69b54f39acf195782
SHA1 07b588942603121aeabdc580ac79d241c0a94f3d
SHA512 febab2e718f6a6fa8bc8e0e191e6c53d9ec88a08bcbfbd852170402a6119d9b78377c3749bbd7892e414fdaf983191cdfd4f3f0a069b0c749c9b29c22fad63ca
SSDEEP 12288:SOFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:SkgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1BA552342498C15C5DFBA0831E49986F9D868EC0FB7F1578F57D8B12E94B8FFA06066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c76c8bf98156b54acbce54c481bd6edfdfaf74dbb7885fdb07dd078ed47159da
MD5 8b9556ccebde2bcb98f23e46d15c4437
SHA1 5970bef8075fdf5db6b76021ce85806fab35ef86
SHA512 cd68861011f7be92f804684054ded55f7cbb3cf9669a8492b0d1873c3792e883e12ab96cb602ba055ca5e07861cab6842566cad31fde563361a498e2f54feca8
SSDEEP 12288:OyPz5L8NFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:TzyZgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1E9650207239530F8D5778234C8A64A62F771B83657B08B9F13A4527A2E377E15E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f7211330ba0f01d845a3cad2539a4cffcdd9a44dcf89ba51f368edd97e556563
MD5 fec74b99f3210e164f265716bbc8d677
SHA1 b6c597b51e3e5689e8106a7c37ed84aa2dd6e063
SHA512 75d2c45becaf262f266e206f1e1e5cb254a6c7b10cd3ea24c43d86397143c07d3e6ad2407833380f2d74a364306a1bdd77fff631af13c95432ce950b14da9c56
SSDEEP 24576:DTuaLl3z0zDPgPvod50p/TXM2s0espsODZjB0IP:DTdLlj+0vo05s0eusONlP
TLSH
T1DB750195B39018F8DD67813EC8658966D6B2BC1A07B0C71F03E4366B5F333A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9d9e4d47770728c51986a904a0ea0b511eeba0d9ed4face488676049fdce67e3
MD5 622a6900eb39586311857889b2fb7f40
SHA1 95302ecb40c5b10da5f8efa8ba4191a9921b1b56
SHA512 b72c72208836bb24bc32613c744bd2faa29a5a0eedcb02d3c07ea719155a784a2c40b78bcb573f40bc2abea3320c243800c60a31365b876a6aac4880dae3b5ec
SSDEEP 24576:v3xd9CHKy7GZbgPvod50p/TXM2s0espsODZjB0IP:/xd9CHKyax0vo05s0eusONlP
TLSH
T18285CF90F3E410E4F1B78A35C9768511DAB67C5A1B71DA8F03A4661A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3797c40e1c03961dacee1191875480c002436f4becd7c8b40383d3ac38d97bee
MD5 1c10d4dbdd5690eefa059789c0973ee8
SHA1 5001f7dc42a4013a02c166c3e7de42678b2cab68
SHA512 e552502a0422a78f7b341f1a116646f32c3e58540501b9e878fa685220154806a8c74a282925ae923b9e4ef1fe09ae1d82ab5bddf5dfee9b8ed0cf2a365ac3af
SSDEEP 12288:tjFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:tfgPvod50p/TXM2s0espsODZjB0IP
TLSH
T128552341498C1285DFAA0871E49986F9D864EC0FB7F1578F57D8B12E94B8FFA0606AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7e01939ffed80c8381c2889d17720aa054a214f4a76b6d2a7e561f0ff39c6b93
MD5 f612d02c2fb8f82749c2fe26db4d999c
SHA1 78dc5557a53f7953c0468e467fdf16ca0ab14d05
SHA512 eca45dbb612221bb002c931c6fe325b7cd677003b60dacf57990fd2399dc0e0785d89a565982ac2f12631434eb9c45b90b47dc6e65c722f2a7f91d9b9a7b7601
SSDEEP 12288:itFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:i5gPvod50p/TXM2s0espsODZjB0IP
TLSH
T1A1552341098C12D5DFBE0871E4A986F9D864EC0BB7F1578B57D8B12E94BCFFA06066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 07b2bf865011c8b392f7dbb5f2932d395f318f0cfd969578192fba97329833a4
MD5 c5ffd4980f13dc6521f72244b33301a4
SHA1 f9ea4b455abcae487761985245b435fbac385927
SHA512 69a27bfc2a1c52c988e92d349fc3213bd0785a72fce3d559c0c6ddfc4766d1f531731d24b213457516ec47101b5637e75390b2749ef13ddf999d4a73a2523a02
SSDEEP 12288:zAFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:zGgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1CA552342098C1585DFBA0831E49986F9D864EC0FB7F1578F57D8B12EA5B8FFA06066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 70e6e5527eb0ac3cb4735ce844b65a87a52a295ff3f114c6875627e98cddcbff
MD5 22d409943385c71adc1ed135c6e369b9
SHA1 bca0612ae9ea2460ed10ff5f6302221b014f2a65
SHA512 afa821d388373776b0e4d229d6930e4fd84357209e4dc511be05b0cd9f9cbd306a22266d198eb30ff55fb8e5220c3ab1de17f4c566ffe440dff81e6ebaf7ab93
SSDEEP 12288:+OFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:+kgPvod50p/TXM2s0espsODZjB0IP
TLSH
T14B552342498C1585DFBA0831E49986F9D868EC0FB7F1578F97D8B12E9478FFA06066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 71f8a2eac831f2f22e0bbeead0f16eb34291f4d915d52bc7a888382e63c0672b
MD5 b16639d75aa9cbd98a8dc00bfe049692
SHA1 02f8681c9253c73697e9b65619b2b53cb1e38c0d
SHA512 f78dcc16ec3e46ea428cddea7188d3c50ab4c90dc6c1b66ed98454ecde4daca1cd293db937b8f789b28e10028e34c9c8b82b7e19e0de73726369d5b5d878ee5e
SSDEEP 12288:wjFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:wfgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1F5552342498C1285DFAA0871E49986F9D464EC0FB7F1578F57D8B12E94B8FFA0606AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 01708463d6ddf644ffa53ac2ff896102324888f3f4e65669fd810b58efe8f2f9
MD5 3f637fc0c902ec01ef222d0eb0777e7b
SHA1 9293ca1c484aea16f8300344a729ec53973e8f88
SHA512 11fbea5c2bf0ab3137fd89a58397ee453070e77a6132664bbba5c6c6a2add8eac2bf0b92f6d867cbb040e262d49e08b089af129c2a607db99b46fe900d31d3ce
SSDEEP 12288:cmFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:cMgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1B7552341098C1685DFAA4871E499C6F9C868EC0FF7F2578B57D8B12E9578FFB02066B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5e6956b8d245f543192ee576350ba75fd81116c05bfe8bf908cb4b7b95344dd3
MD5 50a8cd56521a2b57041cb56a150703eb
SHA1 98c5f50e03fad22defa3cc3a756dac37f0e351ef
SHA512 3a9c02349cb4b0cc4f13001551346da09dde61fd4fda5dd2fd605856ff62ed64e37bea86262e0fd312750623deb320e0d69df0c093c5718e4dced4aa879a4f93
SSDEEP 12288:DcFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:DKgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1D0552342498C1285DFAA0871E49986F9D874EC0FB7F1578F57D8B12E94B8FFA06066F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9f2476664102786eff3d161945f3e32277689583a5db35d9e4c76d205d9720fb
MD5 41479cce20e7da0d983130004eb204e9
SHA1 b5bdb1146d4dace8947da034d20d2be4d415cf97
SHA512 8796821788db39f474b576bc9d03f2092aaa630683ee1611ca701fcf25191626e2b608e2dae37766176ed251d3a999d7819d92e16bccb7c633c94b947c4dc625
SSDEEP 24576:YfwvOk9RX6wkyAIIgPvod50p/TXM2s0espsODZjB0IP:GMnYII0vo05s0eusONlP
TLSH
T11585D029EBCC04E5E1B7913C99B7464AF6B178191B71C2CF029A536D0E37EE45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 839fed96fec5c72c8a17cccbe4803c9cf107f99c54b154962b549624a4b2bd40
MD5 5924eadbb7425f4140816370a97f5eed
SHA1 afdb50ffdc4327233d9133b12fc3f7610c7abeeb
SHA512 c0caea98dcbadfaf7da39071786c2696980a480f51b6204326b138c3cbdad01f4b8b77431b7ee19ca23002972676f7a477bda7f3660ddfa2ff3f035e6dae93fe
SSDEEP 49152:VYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0j0vo05s0eusOf:7ySzPbeD5s0JXP
TLSH
T1C8066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d48b93c65d5d115925c743b54f57f916b4637fba8961cba4223eb2b65b664eb4
MD5 a7a1df0890db012d1da54185a232de6f
SHA1 97ebe6b9d45b1ae6fce3aa70c155d520418e4393
SHA512 fa7a8809186ff1f794392b1bce166f1d6baa2263cee6b469dfa3a7d9dd622963492c3a9fef0e00d079545e72b1e2582509033301005c1dafed8a3b3c15d19e52
SSDEEP 24576:K47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYVgPvod50p/TXM2s0espsODZjB0IP:K47JUQjairIhCnDHUPfF/T0vo05s0euP
TLSH
T1ED65AE1EA3EC01D5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e85d50351113b1568df6d86fc210e246f0680350d5d83811b5f55c84a317e0cb
MD5 fae10dedc76fecc14816690955eae520
SHA1 a59b12bd3e8d30caaa805be39f0222dd977f2e7e
SHA512 d07c4e38cf2a2c06de954be721312352f6d9473d3f7c4bcb97bb5083873528827b3bab1fed423283d8763fa4cce24c99c99a41b67cce83cf23b7a29067822176
SSDEEP 12288:Bksf+Fd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:x0gPvod50p/TXM2s0espsODZjB0IP
TLSH
T1A265F00AC28802D8C56E5135C7568AA1F3337C2693E193CB53D0F53E1F79AA15EEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8adeb9bcc6619d5a0798c6fbd091a0b909827be2032506ea29ddbff912ff5106
MD5 abbbe0c25be629d66221eb6364eaff3a
SHA1 d3b3d14e8726fc7d5e4c03bc5e10ab875edbfd47
SHA512 4a33278cca29a2f549c6aed6261590e8f3353f19d91a8ecf74db9a8ccbe8671f243ad0dd691bb0f2d9fedb1a662f75ef18e876ce672a8886ecd20a7f42f61756
SSDEEP 12288:1OYuHvwU3fmX0lZ/47p0jVStALuyO4M8GulkVO8E1:1OzHoUP3Zw9AI9v8zlkVO8E1
TLSH
T1E53508007626DB4FC6A940321E36D6CCAB70BD06EE45AF0772C9873FC576659B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 755d567a6f767d8ceaf34057d3cb4ce46d60f17aa2f363afe6cba125e316408a
MD5 941f91b9f46cc3510c7b0d013c285eb9
SHA1 1ab8e1f112d891a9158c029b92e5363fdb17de09
SHA512 871ba6af1097808008cb595fcbe31155b822ee6e562f99d333f319fe3f45d2c3fbfe0f35353da5c10d1499268b288a140c395a2f370992a676d49538afa6d096
SSDEEP 3:OlH/l7vebmblylllveGdt/Bl3yjJ/llS3mCllltGlslslslslslsl6klll/:KpeKbg/vecOjlEmCtEEEEEEEh/l/
TLSH
T1D28112149F403A38CF71B5320417D7091363E2403C88DBEB12A010364D3DF9C0C02738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 647ab83f5e42250647b62e9c924e5cfd7e3717a310d29590e716897d244e0307
MD5 73573145965d32e2b29ad5e98a93cc3d
SHA1 359d4494b8afd4c6a17ea2f262f91429f4a8ae0d
SHA512 70c98047c121c5102dec64f530a8d4df49b0e9703c2e89796ac7f5d64d6af572c92b922805f02d59ca551eabacae1b29f7f3f57c5ac1c570960b1c83ab4f98ac
SSDEEP 24576:Sr/fAMhY63M/iLSwRUWoYpOkh4/aWMsnVgpDU/HCc5a:8fAB/izVpDUq
TLSH
T1DB753A015577EB4FC57A8037073296CDAF78EC0ABB852F056385883998A7A5EB1F23D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2db9c7969f627b6a4b42515b53a76d82bdf43b03abc3fd067838fee66d054bf3
MD5 67971cf908875ece0218105a40a5be08
SHA1 1c44927020527ace653b701c9d4e717a38e4ef64
SHA512 445bf88f10827308db05988605f386634af2045e665eb32a42c96cae4c666a6aa9e752fd30196e57f45e263e71befb7c06fac04d5a890e2a2e3f85b9df0198e1
SSDEEP 12288:7z7WFd+fPgClCd8S0CH0pxtpMAXM2s0WBjspAoqBODZ7HB0IPK:bcgPvod50p/TXM2s0espsODZjB0IP
TLSH
T1C2552302478C1541EEBE0530E4ADC5B5D428FC1AABF097CB9794B26E9478FF60E35761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 42416f0f2e110d6a481992532ae85595324701dc46ee967a91c1149a56e90bbd
MD5 b8828fb423ce47b197316e493795c6ed
SHA1 dbfc51c1fc9ebd8e390f8cb4c0a6e6aec41f6cc7
SHA512 a7b8cfafd110b2048528445ddb132d2b46e078e55cd88ca1ba7dfca4a253933789a92960af7b66bf4faf10605e49830a94b1e758faae437ba43c9466a071be24
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bY+gPvod50p/TXM2s0espsODZjB0IP:5gb4mBIBhGFV0vo05s0eusONlP
TLSH
T1B565AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3ec685c5d87387b3cea274f63aad563e3cf6e099e0569eb818e86c9be8a90e6b
MD5 182d477d38b513ba6332ae435962985c
SHA1 38f711bb75e60693e5eec3be3c9810e4ceb544a9
SHA512 a67f008b7f2f54127173bb350434bcbaa1b43ae7ab57b7b6d7e45c912fc32526a29897ab9b68fc03e4694441320ef80532145bb372f6d4ea2b4db21f80444479
SSDEEP 24576:nG88u8FpJqH1nzria7/mlgPvod50p/TXM2s0espsODZjB0IP:G7ZFPqV6a7/m0vo05s0eusONlP
TLSH
T15085F16566E401F0D47BD138C98646A3F6B1B8251374EBDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 932ff2c03705a5b24b433d1d2db9041556281217764b7b934efa75af4122b94a
MD5 c02461db7ea1edd032b4192314edfece
SHA1 fc58215b3ffa0681f5eb4a49384b42d2123b023d
SHA512 b6e64f6329c89205330690da66f65de089ee539a944dfdf27a23fcff8158e0fac633ff64afb05f6dde35d4cec3e37a5f9384c25e4f03331b94e3e9767d887058
SSDEEP 24576:VPUr+NQxgPvod50p/TXM2s0espsODZjB0IP:VJQx0vo05s0eusONlP
TLSH
T13F65E11F22DC18E5E67AA17DC5868719E771B8621352D2CF02E0817E4E77EE86D3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4dd4d0590639dc3813bb2eb9e856c87d4f2ec024bfc3d761a100cfcacbad54d2
MD5 3d80787f18bf09d9caad9ddbef1b3869
SHA1 39b09f9b8a531b719f4bd85c64ea25ae56dd384f
SHA512 1e8eadb0c5d267b85de3af001fbd6bde2a959eb06daf48f10768f7c5b92604295737ec63e16f65801a5d4696bb4ab18d9af0c574cc263dc62b97745938f503cd
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjB0vo05s0eusONlP:MG05lO43bweD5s0JXP
TLSH
T10FD5CF6A62EC11F9D1BBC17CD9C68A0BEBB23815033556CF02A486A91F27FF4567E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6bb36c9cf51116e58f336d9dfcd02ae7dace9c62abfc8f1dc33dca4cb9ce7f7a
MD5 658d0d50208cf9b846ac1c3eddcfff00
SHA1 4d6b2c11a374d4c0f4d6514ee9ba8e5c753ac78c
SHA512 3298d6cca550c6eae75d78ef337b35dea2c22fd68b8718403180816143719fd84fa46b4f7498d982cfffbf221bb94e8324a712532dd17d73f3f18d744b56611e
SSDEEP 24576:cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnjgPvod50p/TXM2s0espsODZjB0IP:Ea5POZ3hJt2pasx2+m50vo05s0eusONx
TLSH
T1D765BF5EA6EC01D5D5B9D17CC583861AE5B1342653319BCF022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b9ad5ab02b0cc5d6a77dbedee8c0300d26c265318e15832e3957aded8ebe0650
MD5 33b1867b3c3261196517c258a578cc71
SHA1 7cdd9c160dc2a0b46dd0db29bc348672e9c62389
SHA512 6d4505ccf713dc75308b120fe8644caa978f09aff540a14c8196266ad09d6392976edc4fcc803a2d64ab0ab8183ed7ca4e3ab268daaa87e5841668be6b218869
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7Fk9gPvod50p/TXM2s0espsODZjB0IP:lNc/zEOVHFG0vo05s0eusONlP
TLSH
T10D857B1623E901E4E5BBE1BE89779546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 516c6e1fa1c1dba27a9fa1fe52aa00b567e9b74b504ee6c347046256be7c4797
MD5 0b19e994b799b0cc6469b4a914d030e5
SHA1 ef48b32c5c31d0825adcaba090e0ae44cb39b778
SHA512 d98b839ae64d7cb6a2c1d7dc49f82d24d41bf724b508691b03678853dc39f60cad76c46c4ea686beec6762122d9f5dc4d3fb6af18f9bcf725fb3d4de3b0c89de
SSDEEP 24576:F3kNvNnaFeYhJNtmZBmBgPvod50p/TXM2s0espsODZjB0IP:F3MwBtOmB0vo05s0eusONlP
TLSH
T17655AF6EA6B806E4D1FEC674CD238512E6727461173293CB5390C13F4E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d1d5bc1701a1177faac9572e00fdb163240517c7386763e4eda9c5655cdc0fe9
MD5 fc629cdc5d63296ec8865dff7cd8b123
SHA1 5c2231aaa823b10485619f134886893bc810b029
SHA512 be6162f31372afe8163cb34e573d2c10d7981ece3c6de01f65f93d743284ee104200588d1f540e056b72519c873e840f48207a3035d79199ab72dee2b943ea13
SSDEEP 24576:7D3FHshBIYQgAggPvod50p/TXM2s0espsODZjB0IP:7DVHeBIAAg0vo05s0eusONlP
TLSH
T1E575E13ED69C04E4D57BC1BCDA638A16E67138A9033256CB02D4D1BA5F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/768-138-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/768-140-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/768-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/768-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2204-6-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/2204-0-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2204-52-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/2204-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2204-49-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3188-317-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3188-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3188-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3188-119-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4216-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4216-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4216-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4216-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4396-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4396-70-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4396-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4396-299-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4464-82-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4464-83-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/4464-314-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4464-88-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/4540-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4540-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4540-283-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4540-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5356-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5356-15-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5356-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5356-21-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5356-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5508-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5508-106-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5508-112-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5508-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5508-318-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5508-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5828-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5828-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5828-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5860-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5860-332-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5860-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5860-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5860-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5860-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6036-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/6036-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6036-54-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/6036-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6036-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download