6fd26d4e52eb807cdc78f2b473a5ad587ac6ce57a9c9dec01c4f78de812d2828

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample261104-vdlspsbx3y
SHA256 6fd26d4e52eb807cdc78f2b473a5ad587ac6ce57a9c9dec01c4f78de812d2828
MD5 74889cdeded1ca41f1605bfff497a7ad
SHA1 080357fed9d11c2c8e5cb9c363667a497e2be780
SHA512 004fda256a681e91c10632147ddeed2a59e9f1a1e6fb0159b8ad1dbddc7e4eeabfbec6ee36f4075d5c56c5ef1e32f18c1668224c4e0163284dc088911d0a32ba
SSDEEP 49152:yPZUsWq86hVJ2HiYx3KNRIbXmYv5WhuC2nUcsV6miMyQzT3QhCDmg27RnWGj:H5b20nMkXXCD527BWG
TLSH
T105167B57E6B940E9D0BAD139CA979617FAB2781A873197CB0790471A1F237F09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5160	elevation_service.exe
3444	elevation_service.exe
5832	maintenanceservice.exe
2336	OSE.EXE
5528	PerceptionSimulationService.exe
4888	perfhost.exe
1232	ReFsDedupSvc.exe
1300	SensorDataService.exe
5132	ssh-agent.exe
3416	AgentService.exe
2648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\13c3feb44b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f52ff2eb7c6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f9779ec7c6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fd28bed7c6cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c62db4ed7c6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000406caeec7c6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab8fc7ed7c6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
3444	elevation_service.exe
3444	elevation_service.exe
3444	elevation_service.exe
3444	elevation_service.exe
3444	elevation_service.exe
3444	elevation_service.exe
3444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
836	Process not Found
836	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5816	2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5160	elevation_service.exe
Token: SeBackupPrivilege	1232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1232	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3416	AgentService.exe
Token: 33	2648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeDebugPrivilege	5160	elevation_service.exe
Token: SeDebugPrivilege	3444	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3980	2648	SearchIndexer.exe	100
PID 2648 wrote to memory of 1040	2648	SearchIndexer.exe	102
PID 2648 wrote to memory of 5476	2648	SearchIndexer.exe	103
PID 2648 wrote to memory of 1924	2648	SearchIndexer.exe	104
PID 2648 wrote to memory of 4356	2648	SearchIndexer.exe	108
PID 2648 wrote to memory of 5636	2648	SearchIndexer.exe	109
PID 2648 wrote to memory of 3216	2648	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_74889cdeded1ca41f1605bfff497a7ad_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4888

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 570af756a4a93225e7e841d46d48165b4b0720db0aecf9433c58a0838f9d7885
MD5 03a1691a91cd0ab29bd049d9b4f53c15
SHA1 cd3689c3caa88d29c41a7f5ed85dbcfbc2789a69
SHA512 4cb318d6d62dce89be378fd23f4e9c4ee8490a175c21df6e1944a9a5e54be9571cfc40293ee89fa175071eba198cd2df9ae68d1910f7081423e48c994bcac8fb
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnADmg27RnWGj:q3q6HjBzD527BWG
TLSH
T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c8f7ec8e5b29e118a482abe5d30a0c9325d21233c74dc39d9eaff62ac9f81dc4
MD5 7d2ecc231a4a100b67d03c6136b12fc4
SHA1 874f1bc89a8623d4bb7b88ba2def57e60cf51372
SHA512 cbb183ebbca978f86d319dce22ae6b144a14d423317a233812b12a5d7adfe913997006305f229fa68bdefa92607c45fe15b21dce773361f64e8d7b02ee0e2f6b
SSDEEP 24576:6XYfDtczAUsqjnhMgeiCl7G0nehbGZpbD:htc1Dmg27RnWGj
TLSH
T16F650129B3D408F9ED67817CC9A2C506EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 93a9361610b343ff4dc01974f51279d2ad0cd5f857180858f369edf97895b4f9
MD5 81c189bc4154b48f7892f6e5e5a66639
SHA1 355ac6b0d1a68bb8aeddd640e15d7c60cf453595
SHA512 bfe67766df72662bc58a0e62d0c570463c5dc36fabcaad9f86a81eec719061357347bbb43e4b2d96b1264ff4239250f8985734f1ec117a717ecee9077f382889
SSDEEP 24576:L0Le5ji0hmxirM3sqjnhMgeiCl7G0nehbGZpbD:LPji0Ac2Dmg27RnWGj
TLSH
T15E859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ceea36a0a177efee30e909f576a5bff82689b2fdac59db2174d3c13caa8200f2
MD5 1880f617d9cad80a88e688d8c3314465
SHA1 a6162ca745523b8926cb2587761ee1f0f0950888
SHA512 dd4d9096a7238c282954d646ce27b26cc0482f4b8673534d0c0d7bcc8c577763bece1780367973ebc2926526ad68b09444c34349e509765da6323543bde11a9d
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyuxsqjnhMgeiCl7G0nehbGZpbD:V/ezSC6vUzPvxHjy6Dmg27RnWGj
TLSH
T1FE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 baa32df6699ad5008f20d482d0cd31e89044fc09dca7d0e303a15448237be569
MD5 fd9fe8dd4c377174e5dbd4542c346492
SHA1 b79f57f88a8d8b7be2d75d631e2e52727e108dd3
SHA512 3f98eb607b8fa5eb9a1f2169732d8989911cc2726aa5f1d093cd17fdc633b6d91b6e73e599d88d15dd6c2675acafa209d9d694fe886ffdb02157dc636eaef292
SSDEEP 24576:dVbqPb88hv/l+6gsqjnhMgeiCl7G0nehbGZpbD:dVO88hXl+PDmg27RnWGj
TLSH
T11E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9698df40fe50f406665b9eb8dfec5410ae32c240087dc18cb4af844f35a7712c
MD5 36288acd58f592919893bbee42ddd3a9
SHA1 5f91823b8006351810376ff970f69257d6f6e299
SHA512 c80cf9ca25a1e54dea681c056b15b12a850d95e9e70b9016b2bd4abd2118bb6f799b2f4f3f1fda04bdb83edb9de6967ae4d50033bd62c92f0c9db016fe34c0bc
SSDEEP 12288:VRzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VRzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BF964C50CAEB7608B5C3E9F15EAC137E56982008436AA37DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 31c4f0f2792633ee34753812eb3b58c1e3a1239a4f367f45504e43e7d699135b
MD5 5f90321f8d575db5d0526cfdd25ddffb
SHA1 0fc4bc4c51f26ac4f552df8e81615c77de21c630
SHA512 751be5c07da6d0fc9bfbd677f99e5d298cfe59ce87ee63f118938d633841ab0cd265b5d527a949258df7a76ff51364e3194f1487f8637eb49895d6b29ea45f2f
SSDEEP 12288:FeBNUbTVO86UoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:FJIUosqjnhMgeiCl7G0nehbGZpbD
TLSH
T12265CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f66e6e5e3516b764731542d2c2b03b64d26da18625973e5e72d5afc75a696754
MD5 f98fc5f41f6cb15ef5ef9c3105ca819c
SHA1 ad5e6f0f326aff4e2e0fa867b2b69d241a3014b9
SHA512 abe7076c05206d443343548969be6bbfc6eb1f286f2a02f087aec4fb77a36dbf1012cae7a5dffc583db3fa65703d92b01e28d4d7055c880aecf9a5917539b425
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:JQvGAdlCEL8c/yRNw5CVD527BWG
TLSH
T197266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 795151db40a8a0cdfff7156be9d3fb9266f58e3110e0a2a04248b696f683ee8b
MD5 4f679ee967adb7c8847b473608cd630a
SHA1 0ed925ec8ddf08fb39944b97c911fd7c0e696931
SHA512 4b76d2c38f71aaef572c2c1f5f5b795d4ae857089ecc89cff67bbde1470c8a4d6d6a82a73662d0e9b0bbad8372cb62a8c0daa22585c1f01a783706781cffb9bd
SSDEEP 12288:hAwSfxL/2Dc34DLLmt0LDQewsAjCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:CdewsAjCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B75E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f4716aa0dffb0833d002f23d06007fbaaad6e39379f13a5c26e25b454ecd1260
MD5 da21af00daeecb07e18f74ca58a090f3
SHA1 3ae827ec1f8cca8f9142a3de1f9927035cb012ad
SHA512 41114ef323b9f9457746290e38ea16db7876e99cae5b581e756746b92a5a50474e78135f7c335bf06b2dcbe7f05f58abbf2aa114a58c7b6202c1fa2c02cdd104
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHuVQBWG:bUEtQevvqc2W1cpV2EI32hB
TLSH
T1CD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e3be33c50d4ee37408dabffdca08c6909ac9582ecd84a518835173ac43968399
MD5 d245670788badc4ebc65901442e15d4a
SHA1 929e9aa09fd44371de68869c2029faa2300603a1
SHA512 41203bdf7343834f0106ca11b89e117df851a3fcacd4eb852f6ba200e539b9a5040c3bd889d9c31211467cc17c80fc34e43ec82156dd43fcad37ea646224a8f0
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zmDmg27RnWGj:DoqtVjnmJD527BWG
TLSH
T1CDD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b9c9eb1be65e24118da6b234b967d46a73737b8f16ce405149f79b3914daff4f
MD5 7eed2d05ecc0a1ded480d2f4405da90b
SHA1 7422a2fe9f143d9c8ebe9229bdadb2701660f03c
SHA512 d46d2d7b5525dfecd131c524e4c1d79fa03fda0f5b87645c04b573ccbf5f784bf1a9c6243224aeb763339f91cbf31b2bf082752fa028b11221a7e0663f845a30
SSDEEP 24576:zAhGLJIFoiwtA5l7S531sqjnhMgeiCl7G0nehbGZpbD:zAMyFoiq5ZDmg27RnWGj
TLSH
T10D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 443a65c878ff38771348c1c6714398f5a132955e4b9913b724e5314f8a79e8dd
MD5 19026b03403386ec1f3649ba7299f89d
SHA1 6d1b7b6f864b9e168d8234daa138d8419bb9f31c
SHA512 d8a4028bab70975834d86d1821fdae6af7da871e620345b62ad2af00c2a803b6222abded697147f966704976956c081cb82cfdd2b0e9fb7fcd72e6b830f5f796
SSDEEP 12288:zmw5HEjsChNVBFgl0WDm+CRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:SwuoOWWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E765F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9dcf6cf0965118d6dcb63086c1603af1f0e375e806eb892eaba7b82aaf63265f
MD5 75b92cfd71e792ced6b9b0a91a54a063
SHA1 4928f7a328832aa4afd80f2664a1d7d4297cd66d
SHA512 1b3bb8230b8769d95fb971e9645fed35ca1f99fa696e3758563ee426b381c9b57363c28a88494e38c2aba07f18668083de1da963442a5b6bb6b6f248156c6bdf
SSDEEP 12288:jBZ1IySXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NZu/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F5512AE239820FAE163417CC5E5D609EB337C62673003CF166659AA6F739D44E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 12c881c6f6ea918f4b46c0c0279e9000f0b20874726607b60e15a67aa48bf8f1
MD5 8041e8e5083f3a141d96bbdb8c6ca7ce
SHA1 cffa59e52caa7b276b244d726211f25e1ac1dd64
SHA512 f018f2246f91a4371f5271592f8c265f78b88d9cc3219f8da6d85208ab85b8b9aae3dee1ab2b7b27f25685ea6d116d3c7e782419cb15e95ba56d86c5bf4d99b5
SSDEEP 98304:8QRQyi36YOcPQLvw2gAf+PN3ID527BWG:jQyiKayX+PN4VQBWG
TLSH
T1AC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f58e0094eb84d80eff535633e7851fedc75f41b3d333db27a12701339397199f
MD5 baf6d0302cd4c0c8e431e9f2a9eee1ad
SHA1 bafb70f31cd5ef5bf59c5104ac58abd4512c29e3
SHA512 24215ec30d6882e036591017f81869c8d74356e767aa70af1b58136228492b6ff6249891d033f822cb32e2427703a0d015df91faee8b51021d80b372ed1d03f5
SSDEEP 98304:RQRQyi36YOcPQLvw2gAf+PN3ID527BWG:IQyiKayX+PN4VQBWG
TLSH
T13F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cf58c3d76fb5ff2182d577c6017a36107339b813ed83b8db096c00190b082c9a
MD5 21ee3f546213e4f71bc4cbaebbfca957
SHA1 e8ec091aa7ae692d7782ea2a67ff438d1031385c
SHA512 946a2f07efec1c8f5b41c8fdd7b95b3a07c81cc8b5da98d2d1e37c57bbcde3c6ac476de43bf77fae9254b5cc37156867e06b2ac92a7c39c50d09dd6039746a21
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0vsqjnhMgeiCl7Ge:S68Qg55nhheWu7PNU3/2Dmg27RnWGj
TLSH
T159B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2138e2fec1d2eeff2b7295c0d47031230d0c2246cbed9d0d22bdab02cb83b3c5
MD5 17910a67e104b565202332dec99fb4af
SHA1 ac3ee3d530f9d19d14a09ea9d567672bb39415b4
SHA512 272290f3bee2d9592fe81f772b41149717f456ead32ecbb54d730d86e641ce24e8dadf9b46b8aea7e7e398dac98dbb352eda3d8d0705b2e4aea38a43ed4bcc73
SSDEEP 98304:Py5112gYy5azzVvL69nLKnhZ3D527BWG:CLIHmWhxVQBWG
TLSH
T158167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 61ec39c172ba0b4c323ed8391031fc2dc9c2250477183ecc06a2e2fc87092a19
MD5 32785596a56287aaa9b79294b291057b
SHA1 1844ba25c4ab7d2808de50f135cfd4dcb05974d8
SHA512 770d5586f77b409b601c96373590537ba63a54d08a170ab77b516e60fa37b05dda7f37433bb128ab7e95c27c22ef99bcce9a90eb6d7efb2bd5c85c89987e8a77
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvDmg27RnWGj:pu6JmVxd2dvD527BWG
TLSH
T1F2D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aa9afe76166be5119fdbcdcc82cbfa24c07880d17b0b4482cba919af6c977423
MD5 f67f07be21638ddc54a9956938b2bf75
SHA1 c5cdd56e13fd630b9754cc86b43f8ba749d93bd4
SHA512 a6b5b5c8473ae7431779085c135f66b082aa2f2e9a3ee9074fbdb9859ef618081b440e93b5e5889ca3f5be6ac3ffe641cac23aa2c59cb31aa7f9f1162094b6ca
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4x0Dmg27RnWGj:7mifPbRJD527BWG
TLSH
T155B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 37cafc4357e9283a013bd1a0e8dc3727d330930beeb7ce46aa145c4b01155645
MD5 8ca2434e53d748e7b6f3254d6d433051
SHA1 dfbc9bce9e8adcb482d55cc49147f527ec221e30
SHA512 6b4e70cf82c960db335453e236568f7f49cd43b8ddc9f04cb94a1220c4e072d603315b88ceb12183b1da2b86c2c582ce6ad968a781bcdb6ab9da6cab4f47e4e0
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqjDmg27RnWGj:X5dKTi61jD527BWG
TLSH
T11AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b7a36023bd3a8dca639a9bbf5511db56bbe03c1acfcf118b48e718a43106057d
MD5 f6dc994a5257e6a797f78fe5c9a5bc97
SHA1 fec4bf3b05a72c91c31d3ad7c68f11194a2fdb1a
SHA512 1dbfce64eeb9a359203e32007bbb284893284cef4434029d9cc9c338856386858a460cd0e91242e8af3812bfba61e0c2c0343d5d80e9b26ed4f04eabe587886f
SSDEEP 49152:nhtSn8EApI0figngiDn0AP5wwDmg27RnWGj:2X2iyphdD527BWG
TLSH
T15195BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 96d80a4d773bb572c36d30a29e84cf31e7dc64f83c539a779c92bb82d5c00bcb
MD5 1e05b944f2be2af3106116e94a803b51
SHA1 050e1c3b7ae8960c7546bfccc1f88949900f34f6
SHA512 a3f17067ab517347b53fc7370173bd79bead0ecff82d526fe06566c41656180353d2c84921c9245e37255e9832f6064edc2fcd72cb6404bea65c7c23ccc2bd14
SSDEEP 12288:8bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1314523BE964C41CAE52648B5C3E5F14EAC073E5BE92004937A9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9549665a82945c9982b1f25823b82341e925634e28439d3e203ccacd40a3447a
MD5 8ef5e05ac1fe0ff02c41b2540979a210
SHA1 b2cc06424206883952c14b4903b23e7873a5b1b9
SHA512 5597fe10e57beaf807207264526638ae3b7d70946e5bae2f0106679a27d3f1b5301a1fe0a87953bd5ec2b0e99a5cfda0eef97b43bae75f6d61a21fddf7d5932a
SSDEEP 12288:1OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AAB7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 50d73a5e9bd7bc7fcb3f25012bae78dd329dae88821997e68b7fe0f813588ccf
MD5 b5080592f3c6767be8edb4d83d69e684
SHA1 cc5187f95e2eabbbf03341d9404a768bde9c6332
SHA512 cf2f18482febfbb8c14ae63dcb330b9fd7985e6df17725f592021e22c6c1042d84175dc4dd5cb51dc47f44d2667c86cc8487d729b69704ef7ea59d54b020bfe9
SSDEEP 12288:0QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3188d25fa2af4d5af9d9d963fe313148c4fe38ef969046318d6186afceb023b2
MD5 615b7f4c667010af8d46f8a05f7f7d31
SHA1 b7111582b5894aafc82363851771e6a31abe5df8
SHA512 5c9efef20ef3e7082850b58ad8b7a1d8286feda156965985c43c1978ef933aae09769b8184a34da45caad19583f78d946d96da0b5aa03897d076eb60c84d78d8
SSDEEP 12288:jVVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11145237F675C40C6D83685B4C2F5E10DE8237D96EB30059B6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4593109f74dd9bba5628628b89f4d71f4c724402fe1bca9f93acb8e8d2e80869
MD5 8ae21982c47005bde418c2e99301c47e
SHA1 419711b294e12213fea2744df57930e927b26cfb
SHA512 eeeb28605f87906ab7ecd7cf76c7d3e97b068f68a7e8a637e8c6cb69a5a252088cb7328c5a405c2f1c0f9c57becbba039941ee883623e5314e253e276ffe114d
SSDEEP 12288:ftXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ftsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 96831f217231363ea1d241a3ef32b0899c95db33ffa34f41d9abc4c71041a836
MD5 80a2ab1f7d0962d3485449108bf29a89
SHA1 d2ff20bd0586bb6ac2aca43292b8bac1a56fe8a0
SHA512 bac5f25e0de344300c9381181152b928a8eea01f3a215fffb076ea63247a39076b3264e5bf0204dbcd165542066db3d37419cd6e95603f66c9b0bcea73295d94
SSDEEP 12288:5qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE964C41CBE52644B5C3E5F14DAC073E6BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c7082ff9645e41f0acdbb9b7ca0bc62978ebd2098210356d5402a5c158ef6945
MD5 b85eb5dc0c03b6a5256831da1d1feb7f
SHA1 692e0632ddb2e1eebf8c93ac062190e4759b61fb
SHA512 ae848cbbadd1aa495ec1d854ac252c1a5f64d944cdfb7239590f357f6bb0f5956429df705595619126cda4a9329566747506db457dbe8b1311ae36c5f1c72e9d
SSDEEP 12288:bGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BE964C41CAE62644B5C3E5F15DAC073E5BE9200483BA6B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 777794acef5262f1c0652bab7ff8e3c8ebfa460319e4a6ec580bbe646c14f20a
MD5 7262b5a2ab8b8c0312f524a1eacbc1b0
SHA1 4b3e39b8679386815b40683c3fb5dca6a212316b
SHA512 e195a40a86e523720d056955f3088a5f73a44684a14aafa9bc494e288d02d974be5db2ff69a585ff0c6a01fd5e176781a81ff428e338f8445037decf15c7ce4e
SSDEEP 24576:wZMSzFVSOusqjnhMgeiCl7G0nehbGZpbD:wZMSzfODmg27RnWGj
TLSH
T1CA6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e958b506575642137a6f09829c3800e34124ee554b281585163e27d163351124
MD5 cd9b90a41edca7c8226906fe7f7f957f
SHA1 e44774f4d25f49ce96090707552383607d6df775
SHA512 9bd63de855c80dca82caa2b89b88d1a68e35130cf46c272e7512402c8914f97c094eb043fd7cc84edb50203e61d3d16eb9ab45b6f1d0a7c4d5279ad4249c5835
SSDEEP 12288:jPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B04523BE965C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 64232b747dcdcb08588cd001e2cbe82e7c19b72b2ac2c0f5f542189e0ae7ee2b
MD5 f34c75e888e45b857d3061ffd4d4a22a
SHA1 86a864945b34a5d683dd2d202512b79c19719d10
SHA512 0b81f0b884e9b0495be671b72e90fd67acd24b30dcb61a64e5a6acf9ac6bab8aa3586f2153030354d5d8020984452a0627703943aa9a628c9af859a97c586e5b
SSDEEP 12288:SDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B04523BE964C41CAE52644B5C3E5F14DAC173E5BE9200483BA6B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e18f3df004beacdef09996ed2f7ecdec0cdbdf6f554857f7ca7c8bca0cc8c0dd
MD5 77fe6f1836e2f0dfb215fbe4f904219c
SHA1 96ace74f4faf2991e71ef6a73c136b298b2a8db2
SHA512 85d0ef06fe11c76e309e8c3f5396818342c041e7bb03737276f689baf4722e6a318957090823419467960d637d4ad77791547044785c9d2b14ec0ccb70f9c4f2
SSDEEP 12288:zyPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 94344784e8ef9106103853d535d24a363217af83bdcf3298237954c95d70097e
MD5 5ea65557fbdfd1f95a90017c052ec033
SHA1 c1551bea05066bc11c80937b5d1d8cac59a05c3a
SHA512 cc5f9574952ce75e49c1fa29400ccb802cf8bf51066bb3a075129abb6fe0a08fe8d18798ba8620e82372bec7db78b902a0a1152bb2dd26172184969c7762fb82
SSDEEP 12288:iPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BF965C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 afbfc71778ab924a710354325647eea6e01c54e801dd45526ec06c61a62acec3
MD5 6e476ca5b0a5f6f51209f8138117689f
SHA1 e048a03228f6df8f6e298c53cff708c6ec1cee85
SHA512 b34b5c863db16aa1e364512241d4abdd462ffb20fd3a1781ab108459e7a949183db08fecc9dccdb4f8f18384e587c90a1299cdeb9da3b58d96235077467037c3
SSDEEP 12288:DPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BF965C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4ecb1869c0e7df3319346e9f90136e139273c217e41e0f72ee38ce4e2cb2778a
MD5 96785fd342668c8cc3172cbf871936c1
SHA1 9c6d840780db9b20a977ae78c40e74cddad22ad1
SHA512 d2716fa2d8e83177b8f5ea294a8bc492893ca999d21dbbde3167b7fe3f008056270cde3b143e0c7281a9a06c332e97fcc1cd2eeca9ca2fc5c1ff1aca65f4bcfa
SSDEEP 12288:uyPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zzySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ae37ec4d54b6a91edc37bb9bbcdf66f397a0a8331a858ab08787f0f0e6a606f6
MD5 c5aa2cf41b99f94f8b52c59f0f3d97d7
SHA1 044e0599fa7851300b941d954d2520cf8a2fcd53
SHA512 0013c07596c843cd0964d17f25943a2e5efe737f1438a7de5739bc7a412e75a2fd209af3cd97f437de1310cebf6398afde6dd630892242b349426e1fe3391367
SSDEEP 24576:YTHaLl3z0zDAsqjnhMgeiCl7G0nehbGZpbD:YT6LljFDmg27RnWGj
TLSH
T1DC6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5300ab75471fb532b1aeee158dcf8d00c5b910877df0cba41d8c45ab633ec220
MD5 1c04d3866e33edfdc070aef9f5b47247
SHA1 a51caf260a714b1165a415e9c809872866b232e5
SHA512 f0a9af06ea5975ce18e94606d89f0a11197e511f0cce6f077365f06e990b71866994c05f4054e030a8380bb170aad81180ceef3a3963ade0a5ef784eaa3ebbab
SSDEEP 24576:G37d9CHKy7GZ8sqjnhMgeiCl7G0nehbGZpbD:o7d9CHKyaODmg27RnWGj
TLSH
T1DD75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 615ca6eedcff0d00124b28298b8c8ed693986cb05b99377e0abdd5add058ef36
MD5 82dcc397b9f537855025b69fc9849562
SHA1 2fc38a7f2f6216633d8a73963885ab1d6f7d5686
SHA512 6574a3d9447be61e82e4eda9ecd789a7a50520a4fb702a0e2a0162fc2480eac6d12ad1aed2bf968fa6c3e38fc50afec9200550a69d7b119ff16beb9693a70bfa
SSDEEP 12288:GwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BE964C41CBE52648B5C3E5F14DAC073E6BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cbe45caed76f0a8352cbeb51f9b098041632ba79133d71d9fc834f7384ae25bc
MD5 3e932f43931838bfab07d29d7e15a30d
SHA1 0b7dd14646f7974891f687cc79352dcaa3a6c200
SHA512 a0bdde8c4e4158e0dc3d3ec16639c8a463093a6e8d208f043d6b61f0efcc13aca81e9ede79cb43e47f2ee07eebee9a80401d6f6079f198ea7a3e49bd811ee148
SSDEEP 12288:byXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1644523BE965C41CAE52644F5C3E9F14DAC073E5BE9200483BA977CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2f696c34170e53f13addfdd3b2188227198dfda7d78fd2b3a19dc9b88e7ee276
MD5 47da18ef6cc9860ed1600f53f05230db
SHA1 070e9161c72edf795b86513188bb9331bdb62945
SHA512 96a5b09c1107959c56df42fcf6287ae805791afe5ef1425896ab2081dae398fa1e1a6bd352d44788bcaf063d3bd6a4692f26c6f62f92a0726293869fd64045f1
SSDEEP 12288:apXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:apsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE955C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4ad7eca871aea90a78d93e54299ddde9251c18adc30a2d00a1ea43494ce9407e
MD5 3997149c1dc7dad341edc4e4a0f4eff8
SHA1 4d12c8773536b4f50bfcade695dc68097e6d3e1d
SHA512 14e5e4ed20887b5da419a3af7c0a932ec8326c0f4f4989ea7451c9e54eb267eb810d1162ccbef57c025e612c73f9420bd3b980d747e5076c233eb1157f55cf9b
SSDEEP 12288:RPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD4523BE965C41CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3d4b1e7fa3324d0a264533b0b0356e48cdd03261a3650eb0970296d8e97e4fdb
MD5 b204c4f5beaa3d0128c7a512888f4670
SHA1 e0ce41ad4c753facbb0dba7f34950532bcff9a62
SHA512 e68f9e129d1b0bd9c250c793cc6f0d31ba38a0a42a4263c1e58446b40e225af03e85950cdfe017529bfb5596a28fe16480a5e046d1b656034afdb517c1e657e4
SSDEEP 12288:xwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BE964C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5e2acc36eaa204b05b15011935afa115cc16d52e5dd5656d8dfe125459b5d4b5
MD5 fe646273ef30d44f9df6095874f9b28f
SHA1 27c75d2cd9550f95ab6bbc73b030942c8a774a38
SHA512 6d842dfd76d58efe2282a9838964127196390fe533110a41852227a94534b50d675df7639b7c85dd5486d60f5622267f8cb8fe625c075850931eb8d1bbba5c59
SSDEEP 12288:enXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ensqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C04523BE965C41CAE62648F5C3E5F14DAC073E5BE9200483BA977CBEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8a2b2836936dbb0ddab794b5af945f7d8f17898b9771c7c7698a094b56a7f528
MD5 009715edbf0908a4a79e73d740648dd5
SHA1 9b31d650ef2a55e5d5d234ccb1ab786e5a74eba2
SHA512 16fdbb627b51ee051643b2bf58c0a00be0dbdffeb3d6f7e8849a7ea4688b531b5d3ed0150e31bc3e771f5b3659e87a54520568bc138e4cf1746f0e2993439ce5
SSDEEP 12288:vtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E84523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 47fd2937ada360644e0bd1f4ec8311391834f370627a7517e5e9b639cb79189c
MD5 fa1b3658e4b209ff2f2a3f698fdba9f8
SHA1 114f9519e5a19f3bae33bdf1b8217bc8f74119c6
SHA512 0da9bacf5d9671c3631514389a8f87db77e3d6f691bd51f7fa7f6628585f3eaeb6776ada5f0fa127f5079485a8fed0da8858bd8120f581fe590951a7d52c209a
SSDEEP 24576:Wfwvok9RX6wkyAITsqjnhMgeiCl7G0nehbGZpbD:aMnYIXDmg27RnWGj
TLSH
T17085D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9510472e5a6aecc0d698a8cbc42ac36f0714097e41422d009a5514f14decec54
MD5 0fe306d6fda8ce1f74551223647783de
SHA1 d4789c234c72d61e32f57b7035e04f9888f94124
SHA512 f9d49db9d4a58df262875655d93e0d612e8a12b2c07d13a849a2568fe44b4987d37051bcf70efb87ab174b7e1ea25ac22ffde0f35bcabe3845c58d05d6cdbdef
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QDmg27RnWGj:YySzPoD527BWG
TLSH
T137066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 99d170fa928f11d18cda9bcf9b68758564a9ec9bac6e774691b8ecab89307e13
MD5 a452f52db5debfbc3d4313c49bd386c5
SHA1 6e22b7170d4e3c9e9a119be8138d791da2b5610d
SHA512 443e8d156d811682d51cc3881804537cdaea4133d117e7663e220e89934e011143ed19b9774eeda460b3c2a155370d56c77dde46692f3484bc29d6796b90d5a9
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+sqjnhMgeiCl7G0nehbGZpbD:+47JUQj1irIhCnDHUPfF/gDmg27RnWGj
TLSH
T12B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cca03fc86660caebc71748b0a35e3488384610cb09f430476cf4496d02514f0c
MD5 c66c77ab7f79aa17a08393b5ddb4d661
SHA1 4ac679dc0dacf01e14593ef56d2d350d1999f585
SHA512 ec25185c4d0b4b5f0b4b615ba6b4ab27f7ea722674e291f87be178a8edab8f4287acd4f23d764f464ceb6749a0c4b80e2928f56ccfadcf069cec3441c995a527
SSDEEP 12288:6Nsf/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C455015AD29802D8C06E6179C3969645F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 a83936bed9c0e6ff469c0efb5b8196fef234434378c5ad7b3711b26af7e21e39
MD5 9b27e69532ceeee1c7b11963469982e1
SHA1 a90b37dcf057fd2b99c44e24431c2f7963b423bf
SHA512 ec6c2101158a17eb54310f7c8ce2154345914afd9ba9200359a1c16068114fde4d5b3e370373d2c83040ca9ffe2154c529fb158d4a0a4031c57c88753f1040f7
SSDEEP 24576:jPbxmUPas1dcJCQkbYLzx7SKRT6AKpvy:pmUysQkbYL9SK56A
TLSH
T15F5538017626CB8FC6A940361E76D6CCA774BC05EE04AF0773C9873FD476659BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 c5cbc5aa916c37451ca05600ef5c2698ab5abd1d0d6c7586e0d9ae90ea0b4280
MD5 aec23395bf314eb1fc3b6248919e7ba3
SHA1 36cdc3cfeccbbd53b82b297b9594cef2cd0d4be6
SHA512 2d8adea45f73baf649bf1b97e9202f04cd9893bc2d51f49633868ce11a558201b69186d03f7a459a0376212d2ef000d9f33be11494d7144bbd68ee52c1633404
SSDEEP 3:OlH/l9bJqlylllY6a5ktCll/5l3yjIl/lllo3mCllltGlslslslslslsl6GB3lXl:KlhYb5qClROIXymCtEEEEEEEDB3
TLSH
T1AA8192A087404A50EE71B03000A9ABAD4312E10BA180EBEF1A5412962C867491C2AFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e7cded003964a6232e7b6797e86977579c9d171fdca242a68cd06fedb1879f32
MD5 3505799279cd2a51d53904553d806051
SHA1 47070ff2049c2710d63eead1ed01b51eb847c4fb
SHA512 b3e6c1e36ca000a5f42e6b53bd5de0630d9995ed297d95e6fdf70a8fa630edc5972132a395a4980719207fb0524f3d25c49adf94a73c8f0cec736c4abad027e9
SSDEEP 24576:auausWm58KLWM/p9A1uJF47F7VTto+UhGmG:yBLWM/LOF8+U
TLSH
T15D552A01A5B7E74FC97A903B423286CEBB786C07BB453F0573458838946795EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a7e6716cf481e016c6d802a1f238e6774c37359522874516fa59b0a09d5594c3
MD5 70c93f26b6f5960b2024a81a5c40abf3
SHA1 d301cc8431e5d4e0126389137e5e78e4baa99ac1
SHA512 d3b288ba6dfcc86da9eeda3979fc7f7150e9289842e512d893ef0e394cf95da4d73615245416d6ca106b458548baf1b378fab5892d93efbdd70de4cb0fb8fdfa
SSDEEP 12288:PM7XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BB934C518AF93609B482E9E12D680B7E669F1044C3B95778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 986cafd5916c5563627f33ea1c22e25edefdd8cc54767ed4e3013b05b2244d48
MD5 eaffd82bf0d5a0767f1858e11b157e1b
SHA1 8ef6a99226345fc3cef20adcf5a1b9670a0d9b6a
SHA512 a71f5b184c4f5c99e12bef9ff77bbd4ce41999f108be4f9cc910ae8eca118ab7232eb1a2cd22292d9af70457bea0894c9beddc32c600bcd06e71e49afa2858c0
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYxsqjnhMgeiCl7G0nehbGZpbD:/gb4mBIBhGFSDmg27RnWGj
TLSH
T1F7659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fb459e69205823af7756b66d12b608702cf635c55f14c1f81ea3ef8385487bd0
MD5 7e4d7e2258e72dbd56448ab5073a8c1c
SHA1 6592d09ef45d8480bf58e5d802007aceb5d2045e
SHA512 cecd6472dcd6f03040cb4cb07620eb1f8e8cf1d62ab06c2286185e1791f54cb09df584e0f00fde59dc11344b38ae427c691c08af7dcd1d945ecc69af07ffb29d
SSDEEP 24576:6G88u8FpJqH1bzria7/musqjnhMgeiCl7G0nehbGZpbD:B7ZFPqVea7/NDmg27RnWGj
TLSH
T12C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0731b00a4e5573b851639505fe17edd7daabae27a4f5feefae7264ada2d62b57
MD5 3427135f62822deff40d19313a1a3245
SHA1 37d9e6557403f598f3d27ce277e1c897ae1cfa02
SHA512 7616dc896e854d7d5923dd729a4358b9fb572395d60baad3a6b12496251f50c55f3cffb1d54410899118253821d92329b56fa9b62bbf6166de65b68c40b1d8a9
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+Dmg27RnWGj:+G05lO43bfD527BWG
TLSH
T12DD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fea37cc754e317641bca33f59850919070a8a9c6b2036e3c0eca11234b346d1e
MD5 24109011468e9f6749c3ab432010fe03
SHA1 be37bf2ffe40b70c0924dc42f690c006c67bf148
SHA512 f06d6a720d313bcca8ac759e9706e145d9951d2c78bc805e6a38d0c671ff1d2e0203859c0407ba3875c6bdc893083122782ded6cf3696d7e804e1239824fe8c8
SSDEEP 24576:3fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0sqjnhMgeiCl7G0nehbGZpbD:Pa5POZ3+Jt2pasx2+m2Dmg27RnWGj
TLSH
T14D65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51e294b59b938f8184593bdf98111630447702fc965fd322b33a702d4526390e
MD5 e1f1e4c8eaada1475f4846e1a79f1cf5
SHA1 5dee522732c50069ecb04a9d6a484165bde9120d
SHA512 bf7abfd579cf6ea3b2d034405fd30edf4bab0385b82fb9503d5dc3a9781bb91d42814d612ef6566f2cd7c37908f1bc2aa784a6849cf11dc247858e9520776bbb
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fk2sqjnhMgeiCl7G0nehbGZpbD:mNc/zEOVHFtDmg27RnWGj
TLSH
T1E8857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9c9e79c35a8e5890e33ef4319a9f4d0e09cae949a08043768ebccc585f7a68aa
MD5 5c95b0c4304eca832905e87f6211d64b
SHA1 772b11016ef310407c8a546f6235d1ebe17c43c5
SHA512 c6fd17d687020b5c3e07cb2d7fdcfa69547f0c7de49c52da3790eac877d78d829ab9388d48d5ce1cfd12833c35b90cfa314495e8164e6e2f8983e8eb9df73531
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBmHsqjnhMgeiCl7G0nehbGZpbD:Y8MwBtOmbDmg27RnWGj
TLSH
T1D355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b7b1003615fda9bac9bbec16ecc3b4eaebbb0b1a20040855f3fd169886e6a601
MD5 fd2c37effd20c6a5954e6c9705011609
SHA1 05f733667f7dfa61b8d64dde120e7bbcb6957adb
SHA512 f3064c7b2b5021a5866d984104239a5a00442307598bdb3c825dfd59d0baf5cbfcd139e1a68d790ca7df7c6a2c9629c9896326f784e8434c18b3cc7dcc320c7d
SSDEEP 12288:CHvUrBFrEjwaQ6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:CPUr+NQ6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B265F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1f6587d101078574c7fa7e7978f430b6bcbc275641ef6a035180d3a619d42cf3
MD5 a2198d3c0818072c0a6895546af5bac9
SHA1 3ab3d1c66d0815403e7039ed77b638730e532ced
SHA512 0808b6a67c3bdce44e299500835a0aab6d2cf42a7c23db4e78711a92f794a5d4d521f64c100f3a223f1cc1ecb95b30f557b3deacf5b5ecf892731d28467bab48
SSDEEP 24576:9D3FHshBIYQgA7sqjnhMgeiCl7G0nehbGZpbD:9DVHeBIAAvDmg27RnWGj
TLSH
T1EB75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1232-339-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1232-104-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1232-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1232-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1232-98-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1300-322-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1300-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1300-116-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1300-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1300-110-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1300-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1924-406-0x00000277A5D10000-0x00000277A5F9B000-memory.dmp

Download

memory/1924-337-0x00000277A5D10000-0x00000277A5F9B000-memory.dmp

Download

memory/2336-303-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2336-71-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2336-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2336-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2648-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2648-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2648-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2648-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3416-144-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3416-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3416-142-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3416-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3416-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3444-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3444-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3444-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3444-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4888-93-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/4888-88-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/4888-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4888-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5132-130-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5132-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5132-325-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5132-124-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5160-134-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5160-20-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5160-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5160-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5528-83-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5528-318-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5528-77-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5528-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5816-7-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5816-0-0x0000000140000000-0x0000000140438000-memory.dmp

Download

memory/5816-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5816-36-0x0000000140000000-0x0000000140438000-memory.dmp

Download

memory/5816-33-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5832-56-0x0000000001730000-0x0000000001790000-memory.dmp

Download

memory/5832-47-0x0000000001730000-0x0000000001790000-memory.dmp

Download

memory/5832-60-0x0000000001730000-0x0000000001790000-memory.dmp

Download

memory/5832-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5832-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download