4289c85e385c2171ab2bbebadfb2f6a1b4049691f2bbb6ea87d6cdbace1e0765

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample261102-ty4ctadw8m
SHA256 4289c85e385c2171ab2bbebadfb2f6a1b4049691f2bbb6ea87d6cdbace1e0765
MD5 80fc59325aa397e872f77d1ef7b59274
SHA1 e8caa440441ed537b203850500d22c097d9813cd
SHA512 b5b659a1b515e6c04b94f9fb153c26b06dd3266ead58f7fd2b8f6ac17449041e3a50ef25293c3a1078e74f59cca3781bb76cdcedbcc1dd670e45b3d11a501df8
SSDEEP 49152:ESpSp3mNmtyxPCL9ggWiZ2kP74iIk7RmQVQc0OxKyCSYTXezp6Q/lFTjN4:2hLNmqg4vLm
TLSH
T128167C17E6B940E5D0BBE1398A579617FAB2781A873197CB4790471A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4856	elevation_service.exe
2868	elevation_service.exe
4236	maintenanceservice.exe
2356	OSE.EXE
5928	PerceptionSimulationService.exe
124	perfhost.exe
2376	ReFsDedupSvc.exe
1324	SensorDataService.exe
2796	ssh-agent.exe
1592	AgentService.exe
2476	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\941992d99600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-11-02.1628.4296.1.aodl	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af4d954ce76add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d8bb54ee76add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abc6d04ce76add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008e5fb8ee76add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a818978ee76add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4296	2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4856	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1592	AgentService.exe
Token: SeBackupPrivilege	2376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2376	ReFsDedupSvc.exe
Token: 33	2476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeBackupPrivilege	2376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2376	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4856	elevation_service.exe
Token: SeDebugPrivilege	2868	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3084	2476	SearchIndexer.exe	100
PID 2476 wrote to memory of 1908	2476	SearchIndexer.exe	101
PID 2476 wrote to memory of 4672	2476	SearchIndexer.exe	102
PID 2476 wrote to memory of 4804	2476	SearchIndexer.exe	103
PID 2476 wrote to memory of 5316	2476	SearchIndexer.exe	107
PID 2476 wrote to memory of 4340	2476	SearchIndexer.exe	108
PID 2476 wrote to memory of 1168	2476	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_80fc59325aa397e872f77d1ef7b59274_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5928

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1324

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7da6110a792fe6bb225d01497a34171d50a824dedd2fdf74ce9019cbc76e5c49
MD5 5602b5d82bac1c2c166f6839de31f11a
SHA1 8265fac1180ad1234e98c5b82c44e81d813a2307
SHA512 239720d2e5e05b79f93216e9228f2bb3cffa59f863497d0c12280d0897c1eb6d32817404e00016539162dbfc65f144b72cc7e25dc62e4292d1d497df61804802
SSDEEP 49152:bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2Q/lFTjN4:p3q6sjByLm
TLSH
T174D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7579f53336bd6047861759d9b905169e2897e687663961cea4fff50e4d3f576f
MD5 6b74c86b0bf078bfc069876b9e065e34
SHA1 d242de8fac133dab5b4cc55f81f3d84c83c1f71d
SHA512 d3fc865840b20bf543fb67be127d3ec66e9e1ef08892c33e78c2085acb41c754e0782927a4df0c2133d002790a3533a980e9b73687ed58276980808faec03647
SSDEEP 12288:s1XLsswWkxy2lRq2czAZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:aXYfDtczApnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T15F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 80ebb855bd9787dbebd8469bb028027ba8f6c97e776d51f75d07b922f8d3675f
MD5 31a6c5b6f49a3bf708d0d720c76d7539
SHA1 263241a9f4bba14628176b1ed3f784facc582679
SHA512 65113aa20402e3f7ab2642f3c144a015768790fff48c2a6e1f6efeeebe78fbf3bf16f62a53502298832d8edf05f1da77d330bc6bcd71c9736323dbb050768307
SSDEEP 24576:n0Le5ji0hmxGrM+nQ/tbw/2Mkjy6Fr7g0oy:nPji0AIbQ/lFTjN4
TLSH
T15C859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 310ab653116a4ccad606173f46d2405848cae4fc2c84600549c72ee9b7adace6
MD5 e5a070cf7c9b233d5e625b2db9640c03
SHA1 011e31cd2243a21260b79087c026a13ca1219864
SHA512 daabae22d08699d69f916263a13c6dabb43761beff3acdeb2f9aafcb751ece7ac2756489654ee783c68041b27962ece09a753e8175450072bcef77374fa9d944
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuUnQ/tbw/2Mkjy6Fr7g0oL:v/ezSC6vUzPveHjyvQ/lFTjN4
TLSH
T156755D15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b8d2dcc2726934cd8d83cf299c056d4f079ec32f3596eafca9757d1dc78333d9
MD5 7d34c6dc7f8fcf4a5f30cc303c552e0d
SHA1 b77c09fcc61ed9d12be570208c4fb362aa63d015
SHA512 b403b93ec539a62e197b8326723ad6c39bde19b15c2aa5aad60674d43617b413f38570611bb3c0ba66f133952032f3823606937b7c920dec70fa23e5b22ce686
SSDEEP 24576:BVbqPb88hv/l+YVnQ/tbw/2Mkjy6Fr7g0oa:BVO88hXl+8Q/lFTjN4
TLSH
T1F0559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a4e43f11e521215dc2bcda20c574f23fb2b6db157cbfc9dbc01a6936de5c734a
MD5 18b7bfbe23f1e8d880600c6eed41541c
SHA1 52024be1fee690b2b402ed43de674636991b5cd6
SHA512 d2e740bc33499b5eca95bb00518a45e9410e1bc112bed54a08cd092189f0dad68e083e72d26308f7d3347b0e512de99f894ed2a4741ddca1288d6834657e854a
SSDEEP 12288:lxqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:lxqnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1C35523696A24F897FF2B06B15CC285826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9828b90602cc383e338185473c92aadd2e4eb68f2c2cf675ddf0a2917cc4b547
MD5 542ee4a82d1a0f13b7639b9b4c8a7dab
SHA1 015fbf5fe33f2490dbaeb9179992aee4f459f936
SHA512 cbfa68233303d1908853b804b201baad401abe1515c4a171f27ab5b9f4136185c3ea7e4bc38663d33f3a7b0ae2ac6d76ff13d010fe34f797c2dc288dcbf2f2d3
SSDEEP 12288:peBNUbTVO86UNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:pJIUtnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T16675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a0bcc36763ce9fd61ddd2e50765c8239d94756dfd1253518ee02c27a58aef977
MD5 45786a554f0b522c5f3c0b7e60e0f720
SHA1 db682d5ca34e925789eefa0855495d97c2d6a1d8
SHA512 abbd806a32b4fd5ed577ac562bb6167cf322ba68f945c12a66ca3b83766173319ad013041be2f3e1cdbc8af9c15139522a5f49f90e5a159f090ca62fa1a9e6c5
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:eQvGAdlCEL8c/DRNw5C3Lm
TLSH
T14F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 63367afd334333b78be48e84192e09015d07f30da14719c0d5328897b8ddb12b
MD5 bf28b6b01c89a83da1e6d05dee3ff601
SHA1 a129b96cfbf47b80abb84b0a03b1516a076880c2
SHA512 0a8a143442a717c37ad404eb7e0d776f3075e8946cbcc87044fa6b9249967246e0d53351e1d7b61f5e0ce60e1c448168169c3b6d076a7252ff5c12bb7255a916
SSDEEP 12288:9AwSfxL/2Dc3sDLLmt0LDQewsAjbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgw:uBewsAjLnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1AE75E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6575aade2730a98f9f3c12d758176bfdc4b5fc8f5e5c990e6cfeeb82ff09b9d4
MD5 f0fd9e9ec4de5a49dd7e344128958433
SHA1 844d4eff72550398bd5a224daf1f5fd7e874231b
SHA512 2f2c2d3a1214ceb9a5f7879d55576383467201d3f361c47f2b41d72e55da4a2feec790bbb76200673cded05f500134c159f665a4ecaa89071b00f86f31363f65
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH4L:fUEtQevvqc2W1cpV2tI32
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0178f4c4f581747d6f5012919768b140d6f0e79c11ffb8d4215216798c59fbfe
MD5 872e345ed65e722fb51586fc5c25daf5
SHA1 f8bed450f41d2fc685b8729a7dc33cf02ef38c4d
SHA512 a4cac2a8df4496c7acfca2454d8fc837f63a1e697e0d0e0736fef51b02bab015005030d3306634b977dbbd2232f0e6ff3548de1a4191507c8b71c950b57a20ef
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zrQ/lFTjN4:poquVjnmLLm
TLSH
T1A4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e8d2d5eff50d6d9a1578aaffd4bc61be39a55f6d00a92eeea68f354675c0df74
MD5 a90d7d9493492129f8299501e9b25dfc
SHA1 9c97ee41435afdd5388168faeb78b981856b5ee7
SHA512 2fbd5a14d670314f9bf3ca61256c4fe2e9c907448a3812e9ad24cc5218cafecda4c94d18b7d4972fac56c5016597076e5db96799c1c687d5036589812dd757d9
SSDEEP 24576:xAhGL3IFoiwtA5l7S53InQ/tbw/2Mkjy6Fr7g0oF:xAMUFoiq5YQ/lFTjN4
TLSH
T14735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5770dec15268124495244ba5c8410a45a992a1168305de2752ee4b8a55197c01
MD5 7e965573f0846208ffbc6f2b14008339
SHA1 2c060f9df1bd824043595e61f48bd2d0f706cdcf
SHA512 8a62bc4c0581c40d166cc94c6728896c514f541e8a46927040d8d804193c6d580f134880d0a43e6ca4dc0c91fad82581c17d3c4c8eb899f3d69c165628ec6f61
SSDEEP 12288:Kmw5HEjsChNcBFgl0WDm+CUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMI:Dwu9OWPnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1FE65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6047143f287bac178be4c346184df969a7c13892a12e4eba6835d16141e8d40c
MD5 d2603ffd8607005e023e43a8e756412f
SHA1 b481dd27e0d05aab433b6542f0741ace7ccf533d
SHA512 2274a9bedc009dc18803314bf61c7715c9fd09643dbd1829a7214c2a3dc6852b5722ee25e2d47ff1a442217c308294ba06252baa1471ef19c9f655b570f8082c
SSDEEP 12288:8gZ1IyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:zZuWnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T13555126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e6173d81bf401154262670471112056031f5004b29e63b0d8c181b656e3ee3c0
MD5 73242ee11918a6a7a49d9c3b989b8c88
SHA1 35addeecf2babf67af5461cb707096473f501980
SHA512 2faad68fb90327571f9b959d40a12073dca365555b335e0b3c4a9b78ebee7d6460f60928177b2d69bccea5fe3f3e76f276cf924c335ed6b86d1fa1fdf724fdc5
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:jQRQyi36YOcPbLvw2gAf+PN3GLm
TLSH
T172667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 68a6ef2ac60af79ef5076c1b1bb4fe6d2af19a847d256ba84b9eb063deec9491
MD5 7f2df73811d31acc5d3bfc5244bd39c5
SHA1 da9d3285a77f20b28b031ad59e7c00db1ff01255
SHA512 595bfa293eb811c15548cde31d8f1d4f901322edab57b03e99d42629745eee060a5ece02dc40e2c3803d461952ac7c68d39ba64ef0b90cc48ea797ccbd15b8be
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:fQRQyi36YOcPbLvw2gAf+PN3GLm
TLSH
T14C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a10d1429a92e75d02617645550b93680872e1d32cb93b65a4619884cab8b8be0
MD5 23e23abe329e0de80a02aa785bc377d4
SHA1 1e69c2937824ae6f818396ebdf37b3459430d2c9
SHA512 527020378644f68545d0d4930317116a8350e8ed72c3542ba55c38f57386bc7dd2dac7d347911ddbfca1f0f5ccbb83edda56338dbeb1689ded207316835a0fa7
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0mnQ/tbw/2Mkjy6y:m68Qg55nhceWu7PNU3/bQ/lFTjN4
TLSH
T178B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1f36885682ceb9937076b9f0b8c33b6346e45bea491847fae329e4de06178ce7
MD5 d1aae771295465b6f58f3663a264262b
SHA1 dd21288d619438a20fc103f7cf810ac17e82cb93
SHA512 b58103bbbeab30bd096d0cb06186bfd6aded103986d7e6db5a07d79d37c59a749a545d6d5cf7efb6f579ed2119b0c08cd2cd633b4ff7093ce2d104ff0287e031
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99j:Dy5112gYy5azzVvt69nLKnhZlLm
TLSH
T137167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0238553adec830dd5a1e7012dbb5de4d1b1100e006f3103932ed7a5813927248
MD5 bfcb4f71542597012db26512416e696b
SHA1 382ee8f1ea0d5f04c6f72ed59516ee855b43efe2
SHA512 610ad1c2c978239dda85624d34b854e6c391d709283a1cd0de81bf1b82f24ddd36dda0940765e665c336fa3963b95d7e7e9df704877fb8ccf446829d4694c363
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl5Q/lFTjN4:Ou6Jmdxd2duLm
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 30654895df0742b793e4b32a70d354e9bab52d59583cccf1979756f38249fa80
MD5 279ec98170dc60a93ebe99b937b5f333
SHA1 ddf4967a5d86b47856bd1ea44c40bd47cb53c532
SHA512 bbf838da5efaccbc1323b63ba3610b1849cc97b2fbba0b9ee65cb845f4d63fb0cce21a17280cee24d649f3d6092b3fc93dff05f3537755be0612ee6e9a697fe6
SSDEEP 49152:N1hpsNoJpF1A63U44CwH7R4xNQ/lFTjN4:NmifPWRLLm
TLSH
T100B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8650cb9a0d007c31b6bcb11a605f246406d983bc794e367e9023c73339416c84
MD5 31039b899b51e4a46cfc4684966c21f4
SHA1 c6767fb10691bdf0abe06e46a280155855df9f65
SHA512 93d322d8aba1b9834b70097471b4bc6cfccc0953e88935dd9a656dd34fec497cc93c423950b811285e3255fb3c52e8d3b953cc441f9017b97c80a1f2a898b51a
SSDEEP 49152:/SuZQIY0Be2KcRVtOnks6NMHqWQ/lFTjN4:F5dKii61hLm
TLSH
T15DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4b6acc140c40a48d46f5dd04408300aba891edd99a0ef65329407aa534368aae
MD5 4274b210fdc989007481aa27e536058a
SHA1 5b74540af6cfb948a9a8fb8a224b82287d9982d4
SHA512 011b9ee6740c53e50d2847b274d4386d93874baebce13bb0b3fc2bb21aa698d8120401485629164a0cd8690d971d29a134103650fbd0c3f566d8f3a76a25d5e2
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wpQ/lFTjN4:TX2imphPLm
TLSH
T1CD95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9e3c16f40fd32018810425fe83ea9561c5aa943e5cc3712edbbfce138cf97cd3
MD5 c7a09828ab9b6204106cd6b4727b2b87
SHA1 473ef1be481dfad67e2a409ff8310c6e4e5d1bf5
SHA512 b4e0b627d99513317d5821e80ec2e1498d1430d82ef454fc390575de22298ab1b14bba9ebee726bae8673cfdcdd51e4994b81a59a5e7499205295004206a8312
SSDEEP 12288:fiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:finQ/tbw/2Mkjy6Fr7g0og
TLSH
T1285523697964F98BFB1706F14C828182AB7B0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 bacce2f860773c495c13aee89028f98c49af9b8b1aa965f260c124e738177dbd
MD5 b27d4fe29dbc2979277df1223c76ae53
SHA1 60cb39b228e8102bbffc82411bc94f5f720a52f9
SHA512 e07519f0dec9ad973b1c76bc4713887a68ed3399412a944828a3ff4328758da8941fa413624aeb1ee4014b802fc3acd0d9e2900e198a4787e0950ebfbcb139f3
SSDEEP 12288:Y3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:YXnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1EE5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c18bfd39dcbd31aeecc921de0a7c0d9c5f41df9937555eb59541230af6d401de
MD5 091943285d9de7d3caa66d060f80d683
SHA1 d0ebe1748b812409c30bd92a3e86c89f84b72153
SHA512 da7f6ff177e065a144444b39586e762372467f490b8c8537e29bd1b78e9319617db3020647b22ecebfeb908dd4eaf094ee607bd81d107f207fab3831480f4133
SSDEEP 12288:WFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:WlnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T16F5523697965F88BFA1706F14C8381829B7B0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 48365ea0c4dbcee7c901e1349fc7699a975df456c733ce1b318c1b61d5c96f22
MD5 d2cebcd7d1d7449fc4ebc7e13fddd2e6
SHA1 28f35652ed926a0483967bcfc7610d4c89b06203
SHA512 34e7ad85c02e03047bce42d1a743bccaf9e6e67ea7b7f60889e72c8a3fb955a2dc71047d08ec1e4417a02ca4bf85e922df1335bedf523497946491ae073debba
SSDEEP 12288:8VoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:pnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1715523693A69E4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 431380825e350e10c5b4a0b38e8d793ad3a00e56f8d4d69bc26bc56baa0ac513
MD5 5fe4cfb4bf26fe44a4afbffa5a31c331
SHA1 9e0340a29e4de4981d879235fd3b80e0e12d12bd
SHA512 0bc228cc23abd3387028d280bcb3c2b9d1ec5ca909a6d33fb2b5b1b5d0cdb681681a05c8b4e221d5569a7f1c23904d95e329cb25727f32a64769d57b9d9e45ef
SSDEEP 12288:zQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:zwnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T10E5523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F77481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8b0dd1797c573ba8537664a0af9847e76314526728da8a834fe1df202a0399fb
MD5 12774923f5a3514e37d251b3a7e65b55
SHA1 25f71ff01c068e36d7846ef5a6637fedd77cc6a5
SHA512 e9b7fde14cede5bea0e09985ed5d17749f63a040ef5d51afe5d9adad5c5b25b9038a478c6148cbc2dcf74a38afc624fcee906197722103256b0b42710d108efb
SSDEEP 12288:lTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:lDnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1E65523697964F98BFB1706F14C8281869B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f64aa0a1df564dbb5948972cabce555daf9e71cae777c7341297147307a7b19e
MD5 2342f2b4d4ca5651c71533017252c1d2
SHA1 c9d6c2f67e01eba84d4c2340a8324f0cece0b01b
SHA512 1a8f1b8c06b5811f67b07b256675b6107b4b27b124ca1054660dfb8cab7664ffb4d1d85b41f0a3a06a19d5fe4572ffbf3995ea7082ee7c25ffae1c338d69277a
SSDEEP 12288:r/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:rfnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T11A5523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e4353392f96bc98f913ce7e0773e8cf7ae2cf1e44b7160c06c79e50a5d8bb090
MD5 a01838271c0dea24157c4e633f7e65b6
SHA1 395d8f6addb0ede28fa0b52eb5c6f6dd3b20fde7
SHA512 0dbffdc0064748f40868f067ba1f4d18c9a8a4ba4795a25c45743c0083adc766335a783e38d191afac33619ce8ea854fe77f5d31ee46af5bec6c938df779317a
SSDEEP 12288:niZwbUzzFEoS2cPvyXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:iZMkzFVSO3nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1E27501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0abb7ef6a4e70d1fdda73ae2f7f956afbbd4d3a42aaff2d32df7d44760bebc72
MD5 83b4419b252c12921dbaabc13f0de762
SHA1 833694aa3627f5adb90266d94ac85f9f2705ed8b
SHA512 1d62701b9c0086b3bc49076de2b8dea53fd29ec5976d1d029e51ecf46b7f55993d431f6fc826868ba4f4f2d3225231eb9269924d02a87c365bfe9fc6bf217a11
SSDEEP 12288:bmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:bGnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1F45523697965F88BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d6165c39ce5a9cae38b2fe32df011dfea67e78f2fbeb6c98ba9988769e0cb848
MD5 052e8a188df4aa9bbf7d7fe9ce474e88
SHA1 8819d01a6feff18935618b879d09a7275bfd72d7
SHA512 996c8baaf4d89bb9d0261b715d11d390f4e36abd16fb84bb65ac460d844e76a4669b36ddccfac167c77a03e026c95f69e460f0d0d9957c9c3b428170bb5b9c24
SSDEEP 12288:OaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:OanQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1255523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c75bc20a98997452d785c1cc88f966712763c3ec32c26071c9e3c8cc3c8df9a6
MD5 2c0c6e453ac68d06a12e0bf70ed40ddc
SHA1 3e081db4f4367a23df0f088d349a55e09927c61f
SHA512 5cd26d6477a827109bc9d6bef9e69a589aac1ac0852f97e2cd5578b521d060d565a01ab70457518dd12d48d388366b031c23560833dc2727a7171f61bb17b974
SSDEEP 12288:VyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:8zy7nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T16065021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 376456bb016a7f186166abb6148f6f698a9378d8459960a7a8bb86ea2be6a2c6
MD5 c6cfd378719f1ffce5161c2312d9db17
SHA1 9df1752872a2d22dd4e1b8333c494fd0341e293c
SHA512 dcd7fcef5a2cef777b5fe8512ab2d4716c91318e5eaac81f16a580f7949c7c4b5124eaa96a5b563ac4bb3aaf68d8343d8ad5fa8cdd6ff01ccb0348de5302f54e
SSDEEP 12288:tmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:tGnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1DE5523697964F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9e1b339614c51685846401fcfb233699413ad9f392b1f4a34f0ec1cd6a3c882f
MD5 4bcd5f6a328d5cee3778172d22220b1c
SHA1 b2056cf75868d5c584cb40aa4c36f60f027306d6
SHA512 27ce885f177f64e863d4baeda860ee48da21960e0bfbb1b8349bec48d6c618047385a4d67eaec81bd2b4e5fcfff7f8eb3c40fd341adceff919e38c7f20f2ccfd
SSDEEP 12288:kmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:kGnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T16D5523697964F88BFA1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5f772d991259793aa82e63215034c31eb8894c7d33d86f372af7ae46d583b539
MD5 13644d1cf5a2bcec933d5e066e87a20f
SHA1 f63c814780053cc78cb12b5d33d8afe5374d28e7
SHA512 83dba6a4d7fe113c24fd4f825232445b43c6b52d1e461db222e34dabdd609642243a462fc2735f3e45d30669cff58dd33a49dd5ee31fd7847d091a1fdf569af8
SSDEEP 12288:pyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:Izy7nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T15365021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3c2164c34b71aae4a861aea289dc56f71e21a399eb81364d1609d5ca71f9097a
MD5 1be5b31a9f8d167c6236825ef2f8f88b
SHA1 5d8a47654945ebc30bdb94d3493d8a8c8dcec943
SHA512 2b6b143f5f182455588d9fcc6777f14945842cf7798d82a366019220a33429b1a4427455f1282265cb2da2996c52b0809f681039f57fd50ab765a68056ad1822
SSDEEP 24576:bTiaLl3z0zD1nQ/tbw/2Mkjy6Fr7g0oQ:bT5LljUQ/lFTjN4
TLSH
T1957501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9140589319765f65f3337b4f4ec09a2965e0bcc43b10ae2bf640646968c310f8
MD5 5f6d83ba744b089bab1fa7727c765f61
SHA1 90da1c9e0165b8c514fccc73c1f267f099e669f9
SHA512 a52fd86dcb6ceee8839cd102a0a09dfd01901a840bd488007d83fe7ce4af86153262b579005c4f9dbfe56babb21d69a156a92b4663148d9d54c677dabad2faec
SSDEEP 24576:B3ld9CHKy7GZBnQ/tbw/2Mkjy6Fr7g0om:xld9CHKyazQ/lFTjN4
TLSH
T1F785CF90F3E414E9F1B78A358D724512DAB67C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 78ad2a79143eae965df242c1eb236a91647d1e7f58ff0bfe3ce592ddb907836c
MD5 f854f14c20b5a16dc9cce41ed92cbae0
SHA1 e9af39f2f9740f0d1186373b6a38e24d0e72d642
SHA512 e064e4fd49b05e6a7cbc398cf46f3b2e7193f75b6f82256ae4ef2cfe9ee8044d1e615947c81c0f4cd414cd6fab9c88826797353351b58cb0aac5895b11457926
SSDEEP 12288:olGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:oFnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T17E5523697965F88BFB1706F14C8281829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e220943268e7f6591513bea99474b1e56c3d0aead7fffefc9a666d7452123eab
MD5 8981cfc51646c85f3fb7ee3b900db8e9
SHA1 3866471bcc1f48ddfdc327bd0ff229855e404482
SHA512 2296abd07d8f02240a086224c7e37ef8353d4baa9ec4f7b34ce2f5d84c8b0b865a905e424701b0538e7d96f0c756b94ec243a0e0194d10d115749523327ca6e7
SSDEEP 12288:ZrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:ZbnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1125523697964F99BFA1B06F14C8381829B7B0EC6BFD1938F77481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3983d83f1f20c8bb3912499de0b791be5541e90427f38775956ad6a6a5a6cbb9
MD5 fba9f67fa15185ae05a8ad53d4287dd8
SHA1 468ecba7828d2d032e520bb9228453a56e7ae05f
SHA512 c7d8081a7d274e729d5c3ecf03984883e7535f0e03f8757dddfc9a67155168dd5a2163cff74fcfb418d3854d66a55121f97e1edaeeb93f3d31ef2b5079d70a33
SSDEEP 12288:ycGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:ycnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1D85523697925F88BFB1706F54C8281869B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3bdff9bf1c447779e1a2902b26df76277762699080c8c35792211579dd73991c
MD5 6df0ec35fa5148f3d41f6931aeee6282
SHA1 ffc10b39b35c4e6b28ebc1edfd94059b841e2a8d
SHA512 07d97c60949cc4c663f6111317ac59b9334ce41382db907815fcab720d843911a97ce52e0277502f6fc7ca4e60fcebfeafa9caed140b0ac9de6a2b640280c927
SSDEEP 12288:QmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:QGnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1F85523697925F98BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 76ab516b3abfea788491d147592d53d07bf243bc569b1bf3bef2dfcbdd5174e9
MD5 368f274bddbaaec823369fb5ccf747ce
SHA1 5466491f8b2924c8aaef8287775dba9d45e40c00
SHA512 36e89feeb160ca62ff9fb25ad6cb48383111042b7dec8c62470f4947e26ec19dfe394c98803fc60b0938e4126238e78b42e927e94db20559ed850b3883d377df
SSDEEP 12288:JlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:JFnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1735523697925F88BFA1706F14C8381829B7B0EC6BFD1A38F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8067a24427b3fc601d68b3b23c5d0c1b6845b9445cb4cc8f627c50de944e0933
MD5 e4016e181df368a3f5a01c514a1962f9
SHA1 faa1c9e9bbfa04e4b356bf4a2cb0ef15afab4355
SHA512 56c7fe6d8c5d4a56383948a7d9b8c36696926da475ac3e86c9394d4bdc0fb9a1ee0a9c3f8ad0360e2abfdb4a004465feebab199db935e830c93614586c807430
SSDEEP 12288:4OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:4OnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1CC5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 57f131c4ea41a1efb460076f4feb51eb01adafd141bf720c768b34d33f0dac53
MD5 5194ebf023ac4dbb72501f3e28e46fd0
SHA1 c77df29e01490104109b6a250e61410655cfa4d9
SHA512 538589cde4282f68aae76502a3c2dd9570adf5459cd3be550ea0330dbc9c3ba54927d14f1a7545627f6582d05b1957b6c149665a0c1da6baf3742944fa1e2e6a
SSDEEP 12288:QQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:QwnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1185523697925F98BFA1706F14C8381829B7B0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 822e07edae3db55177c42a2ed60f274023b7dfc11fbf8713b198f3d6f39339c9
MD5 a124c0530308f62955fdda2c4ce00764
SHA1 3808422f4c25ca8da384ea1cfe5489a3fb574642
SHA512 e4453fa72a7fc29aecb671e4fafc1eab58d414ee75f0d0fb50ba7d2e5812a250582693ead0c91db02dbb6d1390d678b4916976c387a512294e76b719e3538487
SSDEEP 24576:gfwvTk9RX6wkyAIKnQ/tbw/2Mkjy6Fr7g0o1:TMnYIKQ/lFTjN4
TLSH
T1F285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 45d91341722c4c631a1b322273ee4acc4d95a065807ab477d4eecfaaf276464d
MD5 c32a790eb1f7f2384878a950997b82fe
SHA1 57cae0e7ed24530bcb5d91304a575451a6928473
SHA512 81666b2d37d0da55aa4aed2a30ec87a2ad0bafb50dbf129c4075f6a24799a2cb9ad9c6519c01889953f16604933b216eb639ca39de577441b2369b1c937a91ec
SSDEEP 49152:XYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JQ/lFTjN4:SySzPmLm
TLSH
T164066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b7b5458ecbabf9bd8bd1a9ae9594d953fa5783080707672e0784076d16029eb7
MD5 6b45ee8ea9fb1ddcec6f0ed59755754a
SHA1 c9f1bf953c1770d6feb13b362fb0478e5331e359
SHA512 46d1c1be117048187c83255ecdeb098571b2498ef016a8d680e707e88e79f12ddc90390e24ee9561a11e08c5e79d98f8c0392d5c270251d15795903d74736dce
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYnnQ/tbw/2Mkjy6Fr7g0oF:a47JUQjTirIhCnDHUPfF/5Q/lFTjN4
TLSH
T14665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 32356dd89eabb2cd737e2945625f9e45437af4ae2f51046c1fc3a0d45ec30209
MD5 1aeee8508c01c7483af80c4dab27e8df
SHA1 83ce0765bb759493c022bd0fcd5c63bffa374a20
SHA512 64c16a0de8b3717e8514e3469c4ce51364be143f0432027525e0b20130a87c9045afa4e5ff8da9cf619c37f118fa8850f5e6358ca7c8aa3b67d33f783720a08b
SSDEEP 12288:Uqsf2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:gWnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T10565F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0b9110cc1902228f46e42ca901b2190ca42f37bb0ebedade8e54bde9d563d63a
MD5 623c48af59e713a69f5d628c89edbe38
SHA1 c11a6933f8436fc38561564830ff99de44d7b502
SHA512 458c505c5b613dda00208cffabfad31c610fd708780ad9e8d6f82ba50057888735d13e505d7c8bf40ad85ff510fe9cdcbd5dfcb04d96e0cc8477f81fd302fb88
SSDEEP 12288:S+Jn1kOU3fizsb1tzl9yeOfPX2G2ob4hB:S+Jn1/UPys359ye6PX23obOB
TLSH
T14A3507007626DB4FC6A950322E36D6CCAB70BD41EE05AF0772C9873FC576659B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 ed06648bb0a49db0cabf9df77bf7c6d477946be134a7c0558c8d970a54a3e80f
MD5 cb260b80ee4aad571704cfef1989c5c0
SHA1 8c00a648123b5cc3fde1783f9672f0cde5c7308f
SHA512 0aff063638d48c2c601d1c206557f17c52d4b929f696b755e70d45c5bf55b8d8580f1f5684982d122ab4eebfa5b91feb5d1cf6bdaa90132232b5bde0138e59ed
SSDEEP 12288:0cLegaRsEnVvXtEKeN7ubU3DfZfwiriUoAyWna0maRM6In:0cLegaGY59tmX3DfxwirvoAyOlmaRM66
TLSH
T1EA752A0155B7EB4FC9BE80371336A6CDABB4AC02BB493F017345893994A795EB5E23C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e001dc347eb1ed3777f1e92e8d00a646d9808725df91a6dab9b1316fd50f7fc1
MD5 3843db2a80a8a37ce12efc2c838ac18b
SHA1 c0c6af7ac4e88b510b3e3a6ecd5668ec23f687de
SHA512 d91db872b1cb34d18a54232f6a1c95c61735f5dab4d163acd8bcf6b76e2d88fbd1597ba27bedd4a94cab6d81f0be0d9a91ede9047741f43ba28172b1d1f63a15
SSDEEP 12288:dC7eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:kenQ/tbw/2Mkjy6Fr7g0oW
TLSH
T16F5523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 71d5fda380021db786b261f3257de6b6c0d970b53bfa23762c514f6717679e6d
MD5 09976fd531d93dd2547c2badefa44720
SHA1 ffb518f08d61037dc428ab590f1c5b45c7f489e9
SHA512 c7b6ad1204c23529e2c6c3f622fde512933b612e47b4bb37ed4f4bc0cb86f90c3accc99f0391d150cf725425fc69fc1c155bcd23a56d4ce05386f316d9804701
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYUnQ/tbw/2Mkjy6Fr7g0o8:bgb4mBIBhGFnQ/lFTjN4
TLSH
T1F165AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d41a0caf2140b8248b41ca2e4acf9a96988d37b603dd0e9f55c85379803ed5f7
MD5 9136d6fbe576d3864f201a5f9b7e7d39
SHA1 11bd5e9673f8c6be4a170d7c9afac19999d9103a
SHA512 96ec94e67069e3f5a3cf4a4f9515561a18ba5170e56ebc956245f46f0233138395c3c793cc4685d5ecf9a373ab2171595e07dab4b2ec9708045141c10a65aa93
SSDEEP 24576:/G88u8FpJqH1Qzria7/m3nQ/tbw/2Mkjy6Fr7g0op:O7ZFPqVva7/8Q/lFTjN4
TLSH
T19085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 00764d7ee155c55c9d831fe093bfffff6cbb47e96aff298ee28c3a4b152fbde5
MD5 0d4ad29314df1f503de32cec9f5d0e81
SHA1 b5e0a4f49feafe5006e250a81570b085e8c7c9e0
SHA512 dff07a02e7bc65f894f8f3d9d277151a23da3e3f715c01550e1cadd058c2375f5c65604f8e2f8b21c5e505db81e4384edd71b0a86f12e5908502e1877dce232d
SSDEEP 12288:XHvUrBFrEjwaQDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:XPUr+NQznQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1C865E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 55ef2d00dff1292dfe55c5d8fa7a40b03f90c82b28af35ae0950d5b5b9cd2022
MD5 7f88107be4d0cf4f5ef4d800e1faf2fc
SHA1 e03d43e6bb4008fef9a84cd9c2f9d2425176ce02
SHA512 565fff8b43c5a08b73a4fbb8e4d2db14017157abe0bb73bedbea30a6689543875b94b8ced7e4450fe91bc22b573be8bba7aa492d700618e0a8c8a3c41579f077
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDQ/lFTjN4:AG05lO43bdLm
TLSH
T117D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b06aafc23627574aa581c379044035fd2b83dad384e9953b20a08d918f8e5881
MD5 8979a7cfa02761be85c417907e14313a
SHA1 021e1d4e8ac5ab8adee26b041d0cdeafe165924f
SHA512 9e11de802ce0f05e50d0a358b89713a5b4f551df9d0deb7faff46f88eef6d0652100dbed3c799bca57075890921a0815a9bb652bfa25a55c0f3a17e72d8b9312
SSDEEP 24576:8fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnJnQ/tbw/2Mkjy6Fr7g0og:ka5POZ3BJt2pasx2+mbQ/lFTjN4
TLSH
T1D965AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 005965fc9b147b4c5986d502b52fc6069d980e7f845fda07723bb0ad2575b578
MD5 8000c6792971283803e623ee1c15d285
SHA1 a467319b2d8d7cd53b61e82d09460ee638374cc6
SHA512 e1073327e13bc479bfa336ddfbb86e4234eb44aa030d432536c8b3c593a87c6bb902320529e537e8b4c18ae11e072a0517a0fad6ab92ec091192da08773d6690
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkvnQ/tbw/2Mkjy6Fr7g0om:ANc/zEOVHFcQ/lFTjN4
TLSH
T1CC858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4805f25da13d37eeda8853966df0c46ada78a7fb824aa289f5c3917e340dc664
MD5 12b7fc88e77984b283e351be7a3275cf
SHA1 883ba314da0e3a8e51d470425e8fff007ad1a233
SHA512 9286a5ae509cfaec6daa7b993399b95d72d377c7c8d722183e2172845aa478d5d63559b56ed66670cfd61ab693a762edb9905d04714118886544a941615cf4b4
SSDEEP 24576:vTkNvNnaFeYhJNtmZBmlnQ/tbw/2Mkjy6Fr7g0op:vTMwBtOmlQ/lFTjN4
TLSH
T11455AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a87712cfd44672b6c6f8b4ac9ae02616d262ecadfb4d7585271ac713fd06a04b
MD5 5b80bb2b7e74c31d39b46dc1ebde6193
SHA1 7a06dc0111248a78b1f8ada9e7cd0cbef192957c
SHA512 8fc26445af3f27d8db7cdb762098d7a5cfe6f48ce7fd139bb05527b22eedbd5fcfa82ac968e0a1c9a08b42dfa4926a9e08500d1f8c533d9bcf1e80e6c9bac298
SSDEEP 24576:xD3FHshBIYQgACnQ/tbw/2Mkjy6Fr7g0oi:xDVHeBIAACQ/lFTjN4
TLSH
T1E275E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-305-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/124-91-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1324-319-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1324-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1324-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1324-107-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1324-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1324-113-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1592-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1592-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1592-138-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1592-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1592-140-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2356-69-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2356-258-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2356-68-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2356-75-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2376-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2376-333-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2376-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2376-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2376-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2476-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2476-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2476-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2476-155-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2796-125-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2796-129-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2796-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2868-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4236-53-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4236-66-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4236-64-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4236-60-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4236-59-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4296-6-0x0000000140000000-0x0000000140438000-memory.dmp

Download

memory/4296-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4296-39-0x0000000140000000-0x0000000140438000-memory.dmp

Download

memory/4296-38-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4296-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4296-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4856-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4856-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4856-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4856-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4856-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5928-287-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5928-87-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5928-81-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5928-79-0x0000000140000000-0x0000000140176000-memory.dmp

Download