555ac0417dae881c092029ca9b908d3e5cf3b0ae71fa0e69e603546e75e90e57

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample261104-3m33caes6s
SHA256 555ac0417dae881c092029ca9b908d3e5cf3b0ae71fa0e69e603546e75e90e57
MD5 38f5367df20bb6804b8588255aa4a2a8
SHA1 b9e2b8a58a79f1f747d7d193d21661294c529196
SHA512 5c605c4a9db118aad375eeb3b6a813419cd0f880bc1cbf89ae3a041e9edf4471cd15bd939e1166a0f3c8c625fbff3bec87e1d8304745b04a7305253c1283a934
SSDEEP 49152:NQi8dV8p7AqoW6au7KbFHb74K+TKx/6+XXCWpRDiaDLZicfHPlzfOoe7TAvuyR1u:5WQZZ64vuO1C17DVqFJU
TLSH
T124267C1BE6B900E5C0B7D1788A979617FAB27819877297CB4790475A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
928	elevation_service.exe
6096	elevation_service.exe
2552	maintenanceservice.exe
4976	OSE.EXE
2520	PerceptionSimulationService.exe
3296	perfhost.exe
3256	ReFsDedupSvc.exe
5380	SensorDataService.exe
4404	ssh-agent.exe
1204	AgentService.exe
5796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\520ee4ec7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e7369b0b56cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e998eb2b56cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000feafd9f0b56cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1841ff1b56cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf6212b0b56cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb275eaeb56cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000688008b1b56cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a5619afb56cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2800	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	928	elevation_service.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1204	AgentService.exe
Token: 33	5796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5796	SearchIndexer.exe
Token: SeDebugPrivilege	928	elevation_service.exe
Token: SeDebugPrivilege	6096	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5304	2800	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 5796 wrote to memory of 4292	5796	SearchIndexer.exe	102
PID 5796 wrote to memory of 3984	5796	SearchIndexer.exe	103
PID 5796 wrote to memory of 4260	5796	SearchIndexer.exe	104
PID 5796 wrote to memory of 2348	5796	SearchIndexer.exe	105
PID 5796 wrote to memory of 2472	5796	SearchIndexer.exe	107
PID 5796 wrote to memory of 2024	5796	SearchIndexer.exe	108
PID 5796 wrote to memory of 5368	5796	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_38f5367df20bb6804b8588255aa4a2a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2800
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2800" "1476" "1348" "1464" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:5304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3296

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f60313c8aa0edb72bbea7779a142fa28db4544e0f4d48205838f4e9bbd9d55b
MD5 f07b5799e36d73f23e93b78da936dac1
SHA1 af8e62054cb692210ce153e92bf042d6db4b47cd
SHA512 2dc681536f17b67049f1a5dccf427ff3b0e9666fb278a1a39c4896737b3b7ca56d1aab32866faea6c75a9fbe7794e457e958297179585648971a6fa41e1ec9cb
SSDEEP 49152:Hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSCks7R9L58UqFJjskU:13q6sjBVC17DVqFJU
TLSH
T12BD59D03F2D900E9E06AD178D7469533E9A2BC890B34B6DF0780B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b44b3333837240f4a12fc2fa3b3986205d36b45df5a5e10089743a8669114ea6
MD5 e4bd3ac3078509f3bd21f03a12a7835c
SHA1 3af33abed09471f4c952f15ce25c2cab44c5f8d0
SHA512 97d48fb349536bf73662d8db1b363d55c41f87b0ec44c885501abab514b5864f9e5c4bc2bfd57ef2e794a84b8c03d6c64b80bcf6a07679c1412a0a8230c8c700
SSDEEP 24576:IXYfDtczAlCks7WE9F5pwg8zmdqQjC60jiHkU:ftckCks7R9L58UqFJjskU
TLSH
T13865F12473D508FAED57823DC8A28515EA737C518BA4E78B03D4992A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e5e3ef82fa7e8171b658ad4bb825bec5492e36cb4427e215587ae193b894224c
MD5 0e4983644899024f57ab1ae8113c43eb
SHA1 a00f35f22575a02a39466dc3967e01b3db45e3c7
SHA512 a6180f9ccfe61be34137d0c3c73c960fd4568319a58b39a7b9b44f4c32cd1211d4822ec646c5e02e351a2fa842d6cb52beccf06100621135587d55c5a6c164c2
SSDEEP 24576:O0Le5ji0hmxxrM+Cks7WE9F5pwg8zmdqQjC60jiHkU:OPji0Aj3Cks7R9L58UqFJjskU
TLSH
T138859E65F6748731D073C0B9C5D2A69EED7130825B308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 536c42c6144c1a583e526e9ec3f0cbc334655902272f4fe00a48c75150c3bc4b
MD5 1c469efc6441d7f150b0dfdb4b0b9432
SHA1 0003a6fdc993a159092cedc5a65642707674e296
SHA512 e4804e489db8781d7781a7442eb14b0be63f774eb9d2ab1ec5aacde8c01669b3b81ff0a7e30b764c5485224a3006b64bc78519dbe60db813d29d370fccba7baf
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyu0Cks7WE9F5pwg8zmdqQjC60jiHkU:v/ezSC6vUzPveHjy7Cks7R9L58UqFJjI
TLSH
T1BF755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7267795d35205388e54e23f1e524640d20e263462d8b4d042436f469146fa80f
MD5 4929cf25a19a7ed5dabe6795fa915c46
SHA1 97f692e6a983e38ae3a27b3d3890929ba80c1db7
SHA512 b5de935dd1c6a2f1f0926d5f2c480de5c2a8eddcfb3057fe18482c443b2676c27c0420ff5c32ef09609e4ea7663bd914d4390a221e8dd0d4340150b300fc0ae3
SSDEEP 24576:NVbqPb88hv/l+YBCks7WE9F5pwg8zmdqQjC60jiHkU:NVO88hXl+sCks7R9L58UqFJjskU
TLSH
T11A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c78997134d0d7189be3f4bdb3b852b48b22021ac9d31d7e4749e21f9851b3714
MD5 ea78caa6417ffa0100b5eed5d616d994
SHA1 120b239fec269b58252b5580a3c3bb6f236c9e3e
SHA512 d2692cb2c9c16e672ed93e712dfc36351f1dbb40964ac8e075064370b6a95189208862e21ea7f097d30a26990dda73a54042fa75fe15bd45b3a769593d050845
SSDEEP 12288:uL67d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+r:uL6Cks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1304523B0B7562C83FF06023659DBBBDA49A17E60DC885913E5C0BE3F2C781E9E485D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 af7e363858a2f9c510ed69a403f33c64b83b2561e167db21092f598955cce5c7
MD5 c1be7b97a344e9e73e17bc8a1457327e
SHA1 6f6560214f4bd0d1e8a510543453f19d3e9ac2e2
SHA512 16fe84a8bd5b7ff64d7857ff8902996bf145de766c216368a06ba6e708726493c0ce608009c0dad930c4407c145854c97d40d8c99e08b7965732e7ab52ef50f4
SSDEEP 24576:pJIUJCks7WE9F5pwg8zmdqQjC60jiHkU:pJIUJCks7R9L58UqFJjskU
TLSH
T17A65CF7BEE28FCD2C67A8D795A91C740D7B278304F51A3CBE164820E9E235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12ada5b597af8c6426346318345341199f91d58f631bf57d60833f2059773ca2
MD5 1739dfce7c39ad2f944df866fab97408
SHA1 f6ecaec08bee7cb0890a0e5f50939d4eff9b18fa
SHA512 ac53852fbb249b889492e38bcd237869d2af9f5437c0b9bddda8165937f9452bb8d030d696dbf3fc0eddc701e9ce2a6f2b72de3270c304bf7f21768a3567d4ac
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THE:RQvGAdlCEL8c/DRNw5CEC17DVqFJU
TLSH
T15B267D656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 707360acd741c188c13ab7158685818d72791ed82eb7d0a664df1392196d7135
MD5 899c34270dd7dd5420e1ba9fafddc80c
SHA1 2999afd0162ea9e3168e9c022eafaff747d0145d
SHA512 e435686c4c541df8c26cbe1e2b4375010c65031960739355187a8f540b5988180ef537f74ce1abab06b37933a297c84ff358ae7fad14f7726087cc54a234f15d
SSDEEP 24576:A0ewsAjHCks7WE9F5pwg8zmdqQjC60jiHkU:lljHCks7R9L58UqFJjskU
TLSH
T1CE75E030FA75E432C77B0DB21B66D716186C7A204F911AC3E3E89E9E59342D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9a727aaa2f97569d468e67cbc6a5e99bc2c424c95d0d90c98d853136413d5c92
MD5 bc3634a30a43af9f668bbf670a771ec8
SHA1 40a01b83c522e4dcd1671afcb7e1a682caba592c
SHA512 ab44e3c4e4b86f710ac0f293dbfdaea07c958c016b2eb51ba417ac1f220708239f8f96f1a25ecc324e22fff26289d37dd24570f34601f1c6caaf58cd82e5ca20
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfiD4bU:YUEtQevvqc2W1cpV2tI32fi2U
TLSH
T14B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8185287e652227f35806fc8fb2f1bc969ee64854df7dfa3e7ccdb332789df4b8
MD5 cdf89670f8c1ec62ec952486eb5527eb
SHA1 46a4d66256d84e44ea486f4517c82a5f1e7a206f
SHA512 1eb2171bea6a497eaea073517bc7fda734407b5edf9ad49f372188484cc56ba34d853f5e7a0cf41b7e25e9a4e25420fa7936230cde36b8eddd97a39385c69602
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/znCks7R9L58UqFJjskU:aoquVjnmYC17DVqFJU
TLSH
T1ADD58D1976B8C1E4D1F6C37886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1aaf4a632487cb6a5e78e118339f91974b742dd6e396fdbb2057487544359c7f
MD5 47cfaa27d48c19a9f87ff0a20982fa16
SHA1 e1333a80acef3527880a9695e68a9a79933207e0
SHA512 c9aa478f81697e115999b4451b81111f924b4dbf67151fff1659f6b38a61eccdd00452775a2c1eba5ad32d21296bcabfaef5fcbfca70d2a97923f300e9189785
SSDEEP 24576:QAhGL3IFoiwtA5l7S534Cks7WE9F5pwg8zmdqQjC60jiHkU:QAMUFoiq5oCks7R9L58UqFJjskU
TLSH
T18035AD80E7F955D4F5B3AA7899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8057cd142ace3f5169e6f6cc3ceca48c52659f189b39a6567995484a9cfe92cc
MD5 f8ed3ac518cc4f618bc07d08b2c318cd
SHA1 c43cb2daa942e050cc10a8bfcf15b744a87a1969
SHA512 d39d43fd5ad1d6dc96886e48e3602a67c79be457895ceb96d1823f289b157b175bde39e388ea7591f748f96483c6fb075243d6e6466f109208ff0ac6b7912575
SSDEEP 24576:hwu4OWbCks7WE9F5pwg8zmdqQjC60jiHkU:hwvOcCks7R9L58UqFJjskU
TLSH
T16665F14573A51CFAEA6742398587D136E7F2BC112A24DB1F13A0C61B2F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4aea098e0c26de0a94690179a0f3738dfd55625790417e303567cf07a7aae8c5
MD5 15660aee212b43146088827d607dc4fb
SHA1 dda3b84ccb908e25e542044fb9e0e561885d493e
SHA512 d21ebb497964460b9191b210d8cb67ab0b06122c8b2f6f16a5140a4dcfd598d6d3ca22f7f882e3fd551a1a3e23a6c641382d6b4a774fe1a092e8332ed86b54e9
SSDEEP 12288:IeZ1IyX7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+X:ZZuGCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1085512A133D434F6E7534239CCE6A745C7B27C626B7543CF1280662B2E32AD56D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a1fc5a9b6e60bae72d9845e71251b979fae2cc02232e591774a4a022c4393785
MD5 d6657ede5980f908b19a6912080be5b2
SHA1 7442605e721b3a84465bd5b228c978513a44bd81
SHA512 5c2dcd351b293295876d33e08d7d160baaa91cd28d93cb055c932b93e3e75e4e10e47e35fd29ff7cc368dde035f1125264db035b2d01fbb85939ed8f311d6cf4
SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN3tC17DVqFJU:mQyiKa/X+PNdiD4bU
TLSH
T1C0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 36c7816e86153602cd3b4558494b337f90a0b79e5446e2a45233f7d86c3312c9
MD5 f37a747c12d52edcf3fb1557d69428ae
SHA1 2decf77382e9c245ab405475ee2bbb1aaba85689
SHA512 5653df368946896b0fc00ca10899aff31bbefd8c240df6ae5ff642681af4fa8da83d1e3d448e90d86c07697b42200e8d666c7d05608cdc649fb33ce8831a0921
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3tC17DVqFJU:2QyiKa/X+PNdiD4bU
TLSH
T1FE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ccabe59a90d104932e952cdb004094259217e67527c1c49bcc09417c27d1b405
MD5 215bd77d1962ace762104484311078d5
SHA1 bb3bc20774a49f4ef1046400d9ff06675ea909bf
SHA512 f11e3c6281ecfea94a4d082ab1874aa86bd16b0be75aad84230304786e857805bfe80ea7c88e7de0a3bb9467c35a093f9203d1f606fa45485ff8273122c17e9c
SSDEEP 49152:e68Qg55nhceWu7PNU3/3Cks7R9L58UqFJjskU:sthLRc/3C17DVqFJU
TLSH
T1A5B54933B2F60099C44DE1769F4A972196D27C71CFE0E3DB8541721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b920fd902469093613ef7a66d6e6de79bee36eb48924000d3003d88ee1ff9b68
MD5 684d77ecfa852950e5139f6b7ff4f677
SHA1 2aa877197bc72b0ca960299d733748e46ec0964a
SHA512 7bf8bb200f2d52eadc1a130b4f2ebffed5ce32432cab6c51f233b77438e6a51e873b54ce08890d28b5d1890a813784bc991d245de742bbeaa3f74cbc71085363
SSDEEP 98304:my5112gYy5azzVvt69nLKnhZ6C17DVqFJU:XLIHEWhwiD4bU
TLSH
T1C7167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6217c432c687ce54b096073c25df0dc9258a35baadc6d06f8679a9b9b0edd2f7
MD5 e72f9978b21b8ff80fb0ca0870ce5f28
SHA1 f74f38a9df3ddf98ced9cdac727b7cafa0c23bf4
SHA512 6d015552c9dbe6760e8775e00ee7c393df3b09d3adaa10a3a6fbdc40b7e28b3efd6f50aa0b172320b8d43db766689fc07e7b95059d840c1b21a0d089532fe504
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glhCks7R9L58UqFJjskU:Tu6Jmdxd2dhC17DVqFJU
TLSH
T13FD59D13F1DA01E8D05ED578974AA233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3d7c81131d408856bf657e2bff206af05f27c3418f845e893460815e7d0b0ea5
MD5 5975b9926123f99cab09ddb2a26985b3
SHA1 b4521aa7df478bfd9163f432263ee9e4bf0753eb
SHA512 fc3ec33c1e723b38dc1f11c044310fb111da7d666e78a457cfa20929ae780c301821a2d7b7a407c3281231ac89ecdbf3f68a1faa847c245d7f081acbbbb40a67
SSDEEP 49152:d1hpsNoJpF1A63U44CwH7R4xpCks7R9L58UqFJjskU:dmifPWRYC17DVqFJU
TLSH
T146B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 99bb623fb63031d30a107e1e26bc0067093f478b06e2927c392a022694665c4c
MD5 da7ff49121397901253fee164852fb42
SHA1 4aba08384f535849fffd4249c47ec292ef1e8e47
SHA512 67848945009bfdd0fdfcec84dd3cf44b2b82939bd75204b3354584f91b1e31883805ac4e8e33d89cbd14758eb998ec3d9a339aee74eb7d0af945c23e480d539d
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqGCks7R9L58UqFJjskU:f5dKii61GC17DVqFJU
TLSH
T113C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7cb6c35d047a4d5b1566204bf2681c9f9026550742154c56ab1458500987212c
MD5 7d6146d64f554558dcfab03090b60342
SHA1 edd6d598213705e064577beef14f44102ef3f7bd
SHA512 266355f0eed14468e802c5272749474e1e731050166c3af3c4c088035806ec72fcffe9f6773768b5629683e1896d686a58b819b9557ee7952d34772ef50eb446
SSDEEP 49152:LhtSn8EApI0fig3giDn0AP5wlCks7R9L58UqFJjskU:KX2imph8C17DVqFJU
TLSH
T11D95BE13F2D900E8D05ED178C7468632E962BC150B39BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 db4d76fc3172c3152139d9382036919269c6bab5ccc847725ed4bc6e7dcb2bf9
MD5 6412513c2bacf62c94c4a8129ad7f0e8
SHA1 e83ddd54941a1f191308a9eebe3be8fa4ea3c1d7
SHA512 b839447c995dbb0d112d64257ec917f65d56424f003578a1eb03901117be04f4436c17676d9f340c4a54c3a536a94f74f7005a8b249f286fb883d73923b7a50d
SSDEEP 12288:eC7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+y:eCCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T16B4523A0B6972C83FF05433689D7B7C949A07E61ED895113F6C4B93B2C782F9B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d894cea3cdc3b341b3b92e53ec4a38b8f2fb3fd273fa1197bb78ef3fe470d4f3
MD5 b1fb87acb259a704a3e7d8dccdaec2df
SHA1 006448d223898f35a7d62843d58dfb053d107d8f
SHA512 ccd69fc1536bd60a91ca499ac482026fec5109938d92b8fc711281368046d014c6f27de7d675870908297e55110615a550ad5a91d2686f5b33159f48de7b3d74
SSDEEP 12288:cz7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+W:czCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1214523B0B6971C83FF05423689C7B7DA49A07E61ED895513F6C4B93B2C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5b54652063504119e90257069817a908f60fa916c9090f3edd837414e8e06a44
MD5 694772722c5de36ff9cdd45ed62c5a96
SHA1 7789b004b5b4ef142c89c0e2d898f1c3fbe206cf
SHA512 72a3af27fc351f457027f016d0ad3589537d3f72433e560a7f8597208d3850b9b4b90e8b9abddb5bfefb8484332ee553e41120f50116a41492e2205193baa6bd
SSDEEP 12288:7x7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+W:7xCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1234523A0B6972C83FF05423689C7B7D949E07E61ED895513F6C4B92B2C782E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 92928d4f6b95580c30dbfebf9f4f9f84410230196dae78bfc020c56fc7fe43fd
MD5 7e3bbf6b09cb16655564f925c6f51225
SHA1 37564ef875645957518a751666ee4647e035ac15
SHA512 f45e345738a1b55b97903dcf4dd81845253981d2e281bdf7b11d4b28bb7b1c003620c4b64670cccdbe7db6b4ae130c257828ea0abfa1f2b2af7034f77f255766
SSDEEP 12288:OVY7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+N:nCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T11D4523A0739B18C3FF068335C9D7B7968AF17DA0EE55521BE680792B1C703E4B864E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c0359621fc6e29a39f0a895f21c8c35b0effc3f79f38b49c4b26168ede8a23a6
MD5 285416e5d697b77e36b77956a62cb3b9
SHA1 2da0893b3bb0d66c797cc8222d60fd819ad79565
SHA512 653deddce6dff991861a6d5b12eb766abe1640590eb940f8f2ce5416e016a9e25e0d1e447590297fa453dfd3f3769f773be33cd2bedf16c45bcc0dae1c108613
SSDEEP 12288:CQ7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+c:CQCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1CD4523A0B6972C83FF05423689C7B7D949E07E61ED895513F6C4B93B2C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 201af0901905235219653961f8258c8bf84ca16c2f4d56f42bc6c7519784285a
MD5 e118060b3a8821fe61d1291cb7f3d2ea
SHA1 c4867407219111240695fbd2d13d0e788407a758
SHA512 5ed55bd365a536b0207a7f70b01ba1f6dab0e4e7c99320c3f1d6061b505ca3a1026c6dc69608f90aafaf1ab5f8bac433d201c7be48827b05893217383d08f89d
SSDEEP 12288:6v7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+c:6vCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1854523B0B6971C83FF05423689C7B7DA49A07E61ED895113F6C4B93B2C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c1c9ca6343f2796d74fb59df355e660153746cec5e45da8214681d0ac65d8fc0
MD5 e63a319e0c6743f28df4253aa41ffaf6
SHA1 c7884ae0517ad98d0fba31ad4fd328a63e684168
SHA512 ebffb480db6e4a0be699d412e56b43ea71fd6d6e427872bac69516c55c5b8d909255b28da3f42d8dbc4d70b99f42a95105067e76f3fe8e65c6e11fe0412754ff
SSDEEP 12288:hL7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+B:hLCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1C24523B0B6971C83FF05423689C6B7D949A17E61ED885513F6C8B93B3C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8028491055ae95574356d23b0499c6446ec1c314abeab407793f7d358981f9e0
MD5 0130099bcb8e09642a26e56c0f920df5
SHA1 d2b8c631ae0195915c86153687a638dfa3f8b4be
SHA512 41bfbf8fee6d61b06bb2b16a04d7fd4116c4b09720d52ee3049cfb0fba58b9332131b4cc9fbfc40f6f9987bdcf11a01392afe5029957f50eb6ada6e34306b6c0
SSDEEP 24576:xZMRzFVSOTCks7WE9F5pwg8zmdqQjC60jiHkU:xZMRzf/Cks7R9L58UqFJjskU
TLSH
T14E6501A4B3901CF5ED67823EC9569A46D6B27C164B60C61F13E4362B1F333A11C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8ee2f1973e5a4a6583b777321f01961de4fc497fed5d701e0df573a242f8fe45
MD5 295864c262bf50404e3cbd232f02528c
SHA1 9e62120878ab5385d6e2a9104e988bfeff4de48f
SHA512 d904a6451ef0919aef1029c429cf13713fdd83ce6fd34712388ff31a9ac4bcf38aba3b04e42b223da00d0e40654270b78bbb318216693240e5d472b0299bc317
SSDEEP 12288:uW7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+B:uWCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1514523A0B6972C83FF05023689C7B7D94DA07E61ED895503F6C8B93B2C781E8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ebac74e3f0442fd624864a3a3d6988dc97b4b1d79813d9ad659a56f91fedc469
MD5 6678100471296a91f9ae888447ceb986
SHA1 ee6c278de5a3e22290f516c6044b7e0bb529fa66
SHA512 d2163d5084fcaff38bb5ab3315620be9cd2f34f00c66d8202b9eaf74918b9171c12031c1f3a731558d640875b821d1345c5076ee8b651ff6e501776dec43702f
SSDEEP 12288:sK7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+e:sKCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1CA4523B0B6971C83FF05423689C7B7D949A47E61ED895103F6C8B92B3C782F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 cc0d205bebf3b5ff5ee856edf2995b983c52e5f90ae4cf8018833b1dcf610a45
MD5 888f21ee1516928f4575dc4ec912e40b
SHA1 868c226a8a2dc748869f7e94cd5a1110db9b8de1
SHA512 d8242a9031114642961fd449b18983b5d050f7620d175e93aa685ee2acec175176b3a37cfbe560e9185e358e8356c3861050c6286f3f98a1c9daf474ad94f087
SSDEEP 12288:8yPz5L8X7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWil:lzyXCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T19B55125373A230F6E6268235C8925B46E7B17C324B648A5F578457372E372E09D3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3b37189aeaf4e2c1a5070296d9b5547403d84e324973637830d1137020043a4c
MD5 3bff1447a9769bc7a5859a66929d5c6a
SHA1 31f3d3b26e3605d3e054a09d101dbfb9b0734706
SHA512 e21ca314512aaa0d01ed8183e765f708c002b2cf0c4d0c379f582559487b45584c3d96726f869a30c651aca31a9976c8cb506f2dc1ded0a30af0de571718b7f1
SSDEEP 12288:BW7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+L:BWCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1614523A0B6972C83FF05423689C7B7D949E47E61ED895503F6C8B93B2C781F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d75f2cdef85ddd028c35e94d8624975a5cd1d4c6b9596d9576a8feb12e6c712e
MD5 400ffeb8af036c2119b20e8bbcffaf78
SHA1 11f9c1c39663f6348cb24a21ab17646a9458a780
SHA512 12d7ce65963bf7a2ad750ee5b65525cb81cf7612be288f5e8f55057844b6d1e24388a6a599fadeb5d4cba223f1e6467d86efc5a29cf39077b58318a898ee7f0d
SSDEEP 12288:EW7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+t:EWCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1DD4523A0B6972C83FF05023689C7B7D949E47E61ED895503F6C8B93B2C781F9B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7fae6533740f176b9b2c3d82c181ccebbfd0a5735d5e40ccfb9ca21247e13b69
MD5 e6c24113e14c5b0ac19a45bb4030f550
SHA1 078bf57ada8626da0f134cdc1269d36f173cec00
SHA512 618c124b3bc69a0302891cec8de49cd17702b0afc9781b4ff4365b181f8a52a53479ceb660e3d3eb77c5b184f2bce6934d1636bc9743b15f35c6fa9631f9cc39
SSDEEP 12288:2yPz5L8X7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWiY:LzyXCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T16655125373A230F6E6268235C8925B46E7B17C324B648A5F578457372E372E0AD3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 21f878c1fa192b9a865b7e4484bc4d40dfc7d5cb00338d5886859b958b5ef650
MD5 6dbcb6f6cbf299d31ce77c044ca42a98
SHA1 83dc6bc68f05f6818c3874db0fe13080d99e5742
SHA512 592730e665a3a3edcf2a2de2f432b8482835a0b9db4d1727bb7f0da1da802e6a7c15f3d844f5b9d013c0e3513fe4325d5aacd328c875669429be08545f2f1985
SSDEEP 24576:YTDaLl3z0zDhCks7WE9F5pwg8zmdqQjC60jiHkU:YTuLlj0Cks7R9L58UqFJjskU
TLSH
T12D6501A4B3901CF5ED67823EC9569A46D6B27C164B60C61F13E4362B1F333A05C2DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8b2582243982e6dc085920f21e368c42eb98d4846f65fdd0cbc632a3ea294a23
MD5 882248ff0e405d9327e6d003b86fa658
SHA1 876b951efed665b4ca7fdda00dd29aa9a5b9c943
SHA512 833ef73c46104c37971147a1ad9a8404530c91c3abd22e8661fb16044cd331899f37b89662a20525231efd77f7ae2e44ec1adf28f71bcd006388bae75ba46308
SSDEEP 24576:R3vd9CHKy7GZNCks7WE9F5pwg8zmdqQjC60jiHkU:Bvd9CHKya/Cks7R9L58UqFJjskU
TLSH
T1DC75CF90F3E414E5F1B78A358D769612CAB67C5A5B21DE8F0394262A1F337D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7fb0893bb69dfb4b98cb18556bd9b10a7194431e4eb49357d027578c246c88bd
MD5 c2b5d33912e7cbbb9abf8d8131a409e6
SHA1 feefad279b36dc84b8fbd64a52fc877151e5921d
SHA512 5dfd3d7183aae05373c18ddd41aa9bd20fa7fbe32fb46feeb9beee1af8b28c69d76fb6d5ab107caf8b2bb40257de502421147d3af58de172f4da8f449b1dd799
SSDEEP 12288:HR7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+m:HRCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1F04523B0B6972C83FF05423689C7B7DA49A07E61ED895513F6C4B93B2C781F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9c28b4f9f7907ae70d5a80344ce6a3a1c2d1f55909b7d359e6d54f6f25e1937d
MD5 ff91ad33a0b85582422f152f69f7696e
SHA1 ae82ccf6a97e931735c68a2f470656aede22538b
SHA512 06ffd77506304cddd665cbd1c2883e56111da4cfeab7ae7def60ea8c0f71773be7bf8509165513af8f68b1bc4c4ece01b365717492df6abd5fbeb84d7748f1ff
SSDEEP 12288:N37d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+j:N3Cks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1524523B0B6972CC3FF09423689DBB7C949A07E61ED885513F6C4B93B2C781E8B484D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 37fba19d0be92fd57ba91ad97ba23f00bfab22add054a094498a143124e4443b
MD5 373349a4dc58bd7cded4c4fb35b65346
SHA1 d5ff2e669a95dbfe8f7efd93f044a9d765e8b296
SHA512 ff33e66ad6ea10c168999ce638f7415e6546cbfa3622ad1384bc055d6149e586921f8f099a8beae79899e4719bb8d274960b3cfdb39fffe97a1b37ac3e6a338c
SSDEEP 12288:2M7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+X:2MCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1184523A0B6972C83FF05423689C7B7D94DE07E61ED895513F6C4B92B2C781F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e165ba9c0e70fe64817f8ca210096ff2c453fe7c88d969ac4efcfd01e5ee801b
MD5 a4c1d62ac5627091249ddb0012220d8d
SHA1 122a49c95baff036001a8c3b18a55acb7b7257c9
SHA512 6ec5a3b6dcbca1a18939bed9a7dacf86f69a0d6913590a4292837f6ca0b84d266b69b2a709685abe7ca2a321643dd90b1fb8c7bdb01fbaa3cf3d8e8cf6f5c67e
SSDEEP 12288:OW7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+r:OWCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1614523B0B6972C83FF05423689C7B7D949A47E61ED895503F6C8B92B2C781F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a36a4e33900a4cf8e5080baa008b1d13a4bc43a686abc5b1b8c273f264ce942f
MD5 096d02aac6399c8d5d060a1d71a0f781
SHA1 48e06f4e55346755b0a3bfb6f19e0b51bb0fd643
SHA512 e7724abd80079f1fa0fb0fc3e5d0bb502df328f6150e93bf3c7ab51abdbc316b4273d5124e7437d8d097a2866bd3d236bbff2c8725f251fa6e1b929001fe61c4
SSDEEP 12288:kR7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+/:kRCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1E84523B0B6972C83FF05423689C7B7DA49A07E61ED895513F6C4B93B2C781F8B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f181a5a40b37ad3b35872818834f88c47509b000452e1526c3b28e2ca880ef5e
MD5 95101889b0b971332d28a527aa034e9c
SHA1 f1eb0cf007d825498ea038e914fd4a73aaae8d28
SHA512 5bda2d737da161b63e6e93adf76830c0d02cf41a5a36694eb94148db7d145ff4fc6f5a79df9e8d56b62104118175ea8ec621bd7f11989d844593fcc5c4b9a502
SSDEEP 12288:eu7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+a:euCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1704523B0B6971C83FF05423689C7B7DA4DE47E61EC895113F6C4B92B2C782E9B488D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-11-04_233850_2800-4704.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-11-04_233850_2800-4704.log
Size 1KB
SHA256 79844988d23d7f6240260afdde558698b8e0242783c3aeb9297ae582e07cfe7d
MD5 fa9e726b3ab81c67167838662b1089bf
SHA1 4fd087621b023f5ca150914a0a38316c1ef81305
SHA512 695aae6cba821b21e90f57d54a3322c0eabea9f09b584d11f74767717482871ef8ce8f2b0d1c0905fe440da3b5e4fa2b055f165793a1cabacabde04f8ef6ec68
TLSH
T199217F1D7BE81A45FEFBDA8298F611439E3A39966830CA4C00F5464E0975F41FEB5327
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 150594791b4f8a2900870e99aeef4fddb7a2e429115169ce554576f58397746b
MD5 d0f82c313b67c52e206092d8d146584d
SHA1 3891a84b415fc56d7ff817fddbe1b144bcb32752
SHA512 82aa97398ffe890bbfcecc16a76016cc1c0deeb759dbb2ec77912cac1cb919b1178f66ce1318cbe4aa85495daed6fb111480b2c2e731b67c3439e5f8b06259eb
SSDEEP 24576:QfwvUk9RX6wkyAIaCks7WE9F5pwg8zmdqQjC60jiHkU:kMnYIaCks7R9L58UqFJjskU
TLSH
T17885DF29EBD808E2E177923C89F7460AF6B178695B31C2CF1299536E0E37ED46D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c9fb0b098217219d75516e6b103c25dd1f534946c538d9dac1b8611372c7af0f
MD5 e6fb884b9316e489438ea5e968f9ec6a
SHA1 e519d252ece10b7145acd0fb2295f6b0f5e1a4c8
SHA512 06dfd3cf03cdb8d638927ed0bc8455615017d29c23288af3f5d2f52c77bb3f9c3b7f421597dc136f57f2f04ef5da1152237cfda78e406e485837ce43b391682f
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FCks7R9L58Uq:+ySzPNC17DVqFJU
TLSH
T124066C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c2ad277a4c7ef55542baf2b28edcd0faf3d6ab6c0a2525cece2d3237cb174ba9
MD5 bcbcfd3cc2eac65336f1981672ce882a
SHA1 3e2296e4464cc1fffc1698f6805ae7782ceb88b9
SHA512 da60d3ae792e44431980a19da8c5c19c46669c48dd15bd137750b252917768e26c43b04174c0512a199d9b22dfb6b0e82790f83ad4a9093cb72255472bcb5d52
SSDEEP 24576:f47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYjCks7WE9F5pwg8zmdqQjC60jiHkU:f47JUQjTirIhCnDHUPfF/VCks7R9L58K
TLSH
T1E765AE1DA3EC01D5E1BA823885554A5AEA71782D5F31CACF22B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 21a5ca0a8169d45445b71974bd10603099c49c825967cff6f5780b02899e8e9d
MD5 bfc565dbd36f494778d13049ee898595
SHA1 14729617cb691b63539d4b1932956cd5b07ba633
SHA512 29994ba33012d8f4abf00a1748a7e096a154b3e76d553a66e095e43f488291c4d126be5a870920b96106eab2c23f9eb437cfd5e91207f276884ce91909684ee3
SSDEEP 12288:XbsfG7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+I:qGCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T126550159E29811D5D51E6235CB869A81B7733C218BE1D3CB62C0F93E1F792D0ADE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fa8e86a4df45e4d04907a0309ab94c1b0e6fe21040f7cc3eb487f3cf2b7c8897
MD5 08f1f5224b2feaa89c6522e90d793aa1
SHA1 2a334ae6e31eb803c602d2479105be945091cb29
SHA512 085892ae9e1f44562f8ea8969e8ed7011f328e8172220cb72a7870c607ec970a1ff025bb95fca88ac0e41cdb1a2219d1bfe4b8762fb7c4ac4940c0f4d85953b5
SSDEEP 12288:HlV92X7U3fhl/OiIBU8ncL1N/d7Jgv8aRMZg88aMfyLAf:HlVoLUPpIncL1phWv8aRMZj8aMfXf
TLSH
T1AE4538417626DB4FC66944322E32C6CCA7707D41EE05AF0373C98B3FD576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3755e8622cf698fcb58db3ce151c7f1c1d2ebb6d02ce05a8c3aea70cf62da5a7
MD5 f6df08d27c7179873d4dda4c01b9c3f3
SHA1 866863a6ab3bc22c36114a62585c019460439f89
SHA512 9195f04a614c370ecd72d6470a0acc575edad8439560dd2959f215e39f2cf92272beeeee0877bf99f199f689ece0516e5613a85dc59830b609cdeca40f512c0f
SSDEEP 6144:nSNFgwlwOb1WzETFiey2memYQytMx+mVymQytMxKjyksyt3lMHKPQ:nSNFgwM9f/FlMqPQ
TLSH
T1DA65C841A136E78FD1BA6032072A5B4CB7A4EC07B7096F2773C9453AD826B51B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1c90b0191c6b6a59d350f2bcdeaf1c2eebf4db2bbb4c1528da609e935f3c99f8
MD5 1a3c9a67a201f0873da55a41bdcc280e
SHA1 9d25b9e23522ad85be2735c885eab9036b8ed9d0
SHA512 473e94173992b379c0e962c9f5f07b339916b21de6def6c24fe8213614fdcc3b9d2e8daf0c278d589c85773dcfadff5ac16dc6c3bd861da1307766b67ae49395
SSDEEP 12288:X07e7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+c:0eCks7WE9F5pwg8zmdqQjC60jiHkU
TLSH
T1514523B0B39A2C83FF19423145DBF7A509657E60DF449183F584BA2B2C746E4ECB4E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 432b2c350183db23ce3c109c1129fdf6148a94e76d0211d61629986cfc3af55e
MD5 ae841a876c4750b3dffc675aa58f3033
SHA1 4a8922f82df43eed0864fecd3f53f09df1c5c3ea
SHA512 7503a2cb9e382623441ecbab101b0b172937caf0e726e6a91b0400cb9e9f3a6ae9a19db0004d31358d15ee9f1f243a836343abc201067e1b42e379358c5e43bc
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY0Cks7WE9F5pwg8zmdqQjC60jiHkU:dgb4mBIBhGFjCks7R9L58UqFJjskU
TLSH
T184659E1E22E802F5E1FAD2B8DDAA4417D6B278164731D2DF1150423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e60b31111b821e83ee75267cc7847ac6f0c8257109bfc30e50b993a876c6a2a3
MD5 1d8bccdf4cac00b44f5c87ad7b4f59f5
SHA1 aa027dd867750732d675da4ee923f8d6a175be20
SHA512 eb71d0ff3ef8bae35049046465a08eef4f90a37dfe362756b1b2934abbbf9a91d97b593620d0e2650772bb7f6e8e9350d09adcf04b75cd1757c4092d0386c8ea
SSDEEP 24576:3G88u8FpJqH1bzria7/mTCks7WE9F5pwg8zmdqQjC60jiHkU:27ZFPqVea7/sCks7R9L58UqFJjskU
TLSH
T14485F16177E101F1D47BD138898646A3F6B2B8210364EBDF07988B561F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8bf4d44e56a5c0647d25cd3219ded8feb2459b88948b97a63b83a86711314b4e
MD5 6a24835d1a98bd5665bf8cae26d35a9c
SHA1 ae1c4f2171b6f56ae7ab83096b133a9e9e9344d0
SHA512 6c5068fc73230705c3674c7932eef6d15dc3b1250d8e0483574d23455220791909dcfc8d7017b257b4ec0a0e3c834207571eef48509a80e08e301ca97e45541e
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvCks7R9L58UqFJjs5:9G05lO43bSC17DVqFJU
TLSH
T13BD5C06A62EC11F9D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4611fdd1e284906e36f9d36f38e46d0c95546d220dc47f16685baa16fd298e13
MD5 12bc44090ce878e6b02051d4f87bc45b
SHA1 99a7fa9198338088bb6b20eee8b053a132fe1b3c
SHA512 5a4d280ba1ce2ac9ffdf979f0fa912bac725159c00a21d9f623a220881beb7ff097b12629ecf14439bdd8aa5f145e08f06e124992424b83670e6f9f55ab54cf9
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFCks7WE9F5pwg8zmdqQjC60jiHkU:ja5POZ3BJt2pasx2+m3Cks7R9L58UqFe
TLSH
T12C65BF5EA7FC00D5E579D17DC583861AE5B1342253319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 91da2d94646d509c36a6e544c0e848fd5a70ffc761ded772fd7e7380e1e2851a
MD5 40859b47ed36b30bece9872dd271fd93
SHA1 c852f1a8333fdb8e0332f46ae2d88f2dd248c275
SHA512 5a36d9c74e68a50983d8c04157e9d103a0730d6149c8b2a6f1bdcecbdd8b62116d1cad97231d872dda07d6a7f8a2e4f633e4665a32b077675d04fcb2d4d034c6
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk7Cks7WE9F5pwg8zmdqQjC60jiHkU:9Nc/zEOVHFMCks7R9L58UqFJjskU
TLSH
T1E8858B2623E901E4F5BBE1BE89679546FAB17865573086CF0281811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 be95871565b4a6bcff43b5b8e69f6ff6bb3ceb74a0eaa322746ccd5b0a326c51
MD5 89331c1e8a5a0413891bb6602f066765
SHA1 4d41debb4b4ad33c2f28b128847863ede053d43b
SHA512 b6f7c567180e5f4319ec9092db74a444e7e230d218c8c386fc0e8a9a07533761664921c9ece9c157a59c550aa49ae215c467f39078a3f578f19f4b067e558216
SSDEEP 24576:NTkNvNnaFeYhJNtmZBmdCks7WE9F5pwg8zmdqQjC60jiHkU:NTMwBtOmdCks7R9L58UqFJjskU
TLSH
T18A55AF6EB6B805E4E1FEC675CD238512EA727861073293CB9290C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 dbc0b95095351416f3e434a66717108fb422970daa236fd57ddeb5ea0da5bef9
MD5 8ffb4f525a725e8b7a7549f982b72306
SHA1 32001c1df0fc37f1a740cbb9535f0ce93b204233
SHA512 773a0739a71f602886182c75c8744919a7895acde1c7a335bbf0a4f22265637b3d9c0f5e00004c03ce2b4207b61f3ad5df30ba0ea75926d4f757f726bd9890d0
SSDEEP 24576:0PUr+NQ/Cks7WE9F5pwg8zmdqQjC60jiHkU:0JQ/Cks7R9L58UqFJjskU
TLSH
T16A65E16E62AD1CE5F676A13D89829709E771B862171192CF02D0913F1E77EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 baddc89316d0a0903ce8ba9390cd793835d6b04574cfc5eb18ce3375feb82e7d
MD5 2494fec84afe22171f54b9723c74ad0a
SHA1 24c9fcd780deea0f3287a4a2a77160e7e259a0e3
SHA512 24a7e02273624eadccd77c06f81ff44ea6d0bc90108f76c0d5697a063c7da04afb45528218510ac5f8617cf47940cff1289b02c3dfe9cd694e04da4319b1a32d
SSDEEP 24576:7D3FHshBIYQgAiCks7WE9F5pwg8zmdqQjC60jiHkU:7DVHeBIAAiCks7R9L58UqFJjskU
TLSH
T16575E17DE69C04E5E57BC17CCA938A06E77138A9072166CB12C491BA1F6BEE47D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/928-15-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/928-22-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/928-21-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/928-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1204-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1204-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1204-139-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1204-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2520-78-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2520-84-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2520-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2520-284-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2552-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2552-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2552-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2552-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2552-61-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2800-0-0x0000000140000000-0x0000000140465000-memory.dmp

Download

memory/2800-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2800-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2800-41-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2800-45-0x0000000140000000-0x0000000140465000-memory.dmp

Download

memory/3256-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-331-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3256-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-98-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3256-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3256-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3296-308-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3296-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4404-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4404-118-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4404-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4404-124-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4976-251-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4976-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4976-71-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4976-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5380-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5380-105-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5380-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-316-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5796-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5796-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5796-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5796-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6096-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6096-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6096-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6096-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download