stealc | 795f6abd825f8d4a533066932d3935becc35f7398feca258a1c1549cbd2fdd43

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260910-t78c5avwat
SHA256 795f6abd825f8d4a533066932d3935becc35f7398feca258a1c1549cbd2fdd43
MD5 56cc58741a270e79dbdab03a32cdfc52
SHA1 6e9ede2a42f02ab1aa17f2647123e5ea7572552d
SHA512 af5f06e975fe3278f3852eda31fbfb3a8f80b4db3de30f1c80aad8a8967b58c4a76b7ae808755d30f90753d80271bc40780099382a4596a1af82af58acffa2fe
SSDEEP 49152:y2lWq/pQd+MhtHM7jO/IORBFileoU7ZtxSHLQcN5tU8ojaTJ2e77D8WP+QgVuP:y+jHLB//QWp
TLSH
T1A8267B4BE6B940F5C0B6D1798A579617FAB27819873297CB4790834A1F23BF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/828-52-0x0000000140000000-0x0000000140471000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
5116	elevation_service.exe
3520	elevation_service.exe
1360	maintenanceservice.exe
6004	OSE.EXE
5780	PerceptionSimulationService.exe
5380	perfhost.exe
2168	ReFsDedupSvc.exe
5620	SensorDataService.exe
4472	ssh-agent.exe
5172	AgentService.exe
4488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f6bf85e2238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-10_164309_828-5060.log	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccc8eb7e4341dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbdcf97e4341dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe
3520	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	828	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5116	elevation_service.exe
Token: SeBackupPrivilege	2168	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2168	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2168	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2168	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2168	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2168	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2168	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2168	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2168	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2168	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5172	AgentService.exe
Token: 33	4488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeDebugPrivilege	5116	elevation_service.exe
Token: SeDebugPrivilege	3520	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 4688	828	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 4488 wrote to memory of 2360	4488	SearchIndexer.exe	102
PID 4488 wrote to memory of 3436	4488	SearchIndexer.exe	103
PID 4488 wrote to memory of 3584	4488	SearchIndexer.exe	104
PID 4488 wrote to memory of 2812	4488	SearchIndexer.exe	105
PID 4488 wrote to memory of 1868	4488	SearchIndexer.exe	109
PID 4488 wrote to memory of 3512	4488	SearchIndexer.exe	110
PID 4488 wrote to memory of 4564	4488	SearchIndexer.exe	111

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_56cc58741a270e79dbdab03a32cdfc52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:828
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "828" "1456" "1328" "1444" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1360

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6004

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5380

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 29ea96e330ca0538b71ccafada4ddaf93165ce810ee60784379a0d1b715155cd
MD5 d7d97dde4f239b23141cf5d838fb417e
SHA1 531edf2d8e91b2e95c91cee848cefdd2969af0d5
SHA512 38ab0a57f6ae6ca51495a6cd7f160707858343a3dc6e59c2ff03c06798a6de0afe8e7fe585a02adf691051dde7d72aea01303ca677d6035098273c5e15e0f916
SSDEEP 49152:Gb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnwe77D8WP+QgVuP:43q60jBI/QWp
TLSH
T1ADD58D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f48f157b4a0a0619648b2ad34835dca480c61ace2b48e2cfefe0794cd6e6594e
MD5 dcf26c066f1b3c91cabe008bf73d04bd
SHA1 60f6a797a50961d897f90ba0ecb5f0136bbd43db
SHA512 abffc4d048b845ca5b99f0739192cd431ef05bf34c50ebccb8f4d4d9a97f40a26fb45d4398442a8631853427ece7bc3805199a2cd616fa90110d3c54ffe842d1
SSDEEP 24576:7XYfDtczAN5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:etcie77D8WP+QgVuP
TLSH
T16B05F12577D408F9ED67827CC9A28411E633786147A0F78B03E4A96A1F337C8AD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1998a6a15edd7994b1abadce32bd8d2ac7e96cce3d7b0b9174ba3dac6bbdeea5
MD5 d10fc2afdaa0f3838c22f526c8246e56
SHA1 322a0e120f31e0370f4cecfbc320f0a265b93fff
SHA512 28fcd2b5bf94b7ac15e588b55a81565e79609b946264c5e6be58a0456a482f3f558126d4c840d35fc3de020f6ffb559106e0d328f9b45d4fa7597fc2a2e66bef
SSDEEP 24576:80Le5ji0hmxNrMC5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:8Pji0A7he77D8WP+QgVuP
TLSH
T123359E66F6748731D073C0B9C5D2A69AE97130821B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7db9cc9e99d3861ce9ebb209f0fa48b00e6e53dd8974e7c282d464b40b3a7580
MD5 c4430230710358f6186d4a51b6c3edfe
SHA1 8476eb479be44e282e128384f9a96564dcfe0db1
SHA512 9e7b8e76fa0c4f214ba028aab643bb987133e091367897eb0ce887b3b36c31750cfda5471d0657ee67151736eb3a5f7ab876658c0fc62aaaf42cacf9dfaf4e59
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWr6q8wyu05w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:w/ezSC6vUzPviHjyte77D8WP+QgVuP
TLSH
T12C755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 daffceadeac227e41da87d4813bd4c680a0207de0398811cb4d9ddbfe6fd3341
MD5 f90e287f24987feb3f0c9386263b6598
SHA1 c46479fc9e2550c6199feb461367a78d6f3d88e7
SHA512 abfa98e80b3e94b26668c7acddbd92ab1c71bd6217fbb039f4524d184524bf4da8cbb6104768cacfd6217ee9391c080250a220bfe96d1aeac46bf47b37e24cbc
SSDEEP 24576:fVbqPb88hv/l+bv5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:fVO88hXl+De77D8WP+QgVuP
TLSH
T171559E66F6B48331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f38c11e90d4b3ae184003c4066233e9dacf4dff8e421bae6965b6183b38a7246
MD5 36f49359371e20270233569c88b206a9
SHA1 fa2810cbe1872b3a8706f5526bc6fcfc53bb1665
SHA512 54757d5fca1f1bad1fc4e4ea1a1723d303a22c8aee909999e1faad2eab372fe448533ecf8848071001d86343a885b80b98f68b4c83cf9a39f8df2bd0f960d542
SSDEEP 12288:Pj5dacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:PjG5w77Mm9RyaXAP+Z9T+QgFhMMVnMbq
TLSH
T10DC423B397CC1C11D3B98674D6EB1012F1456DB03DC9390B5BD63A8E5EBB688F026A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a9b2d0d01403ad961df3feac37004d46a5552af1cb10846989359c8b953fa874
MD5 8bd6cae70ebb4411fcffde5e48e20e01
SHA1 639072e60a21f57549de400225447da5c7ecc6b7
SHA512 4293f13574017ef31d88fd5677f12e99253ebe0e72d541a327a7f74adc832f942248eb4fcddd18c7682235e14cf93c39a18857b8aa110361c93cc60661cd8bf3
SSDEEP 24576:xJIU35w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:xJIU3e77D8WP+QgVuP
TLSH
T1A305CF7BEE68FCD2C27E8DB897918200E76278704F52A3CBD165820EDE235D45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d018537e026fc3b1e25c581cb1b210fd153b7134855d6aeb86e14ebe7710e19a
MD5 383a446f27b918b093179f1e675ce553
SHA1 0801ecec302e4962aa3155bc32bd84442289c341
SHA512 caaf2f30c6fd70caf181e36b3d41f42cae621dd284223b29fa824b441b2706d0a75c3a3d1eda1938bb1dcb9d48a53673fc9e2c146a147677ed1840dfe85e1fa6
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THs:bQvGAdlCEL8c/RRNw5Cv/QWp
TLSH
T1FA266C656BF880F5E0B7E138897A85B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6eb047a255081f276ce21c8c65a848a7b343e4236ff68a484cdb8abffd3a64ad
MD5 3c8dc813b4945aefe1f3ad2d23bd5291
SHA1 894b2cef8d782cf2c6e789d56276277fbd8d010c
SHA512 9baaad390c655357d1f4bae7e3a2698334fb8ff6fae0c8eadb15c57a1542aae162771733b4109a9953b120a90aefe3cf6c5a53faa9f842dc0f57b509c8f24480
SSDEEP 24576:RSewsAjx5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:8ljxe77D8WP+QgVuP
TLSH
T1D815E031FB74E432C2BB0DB65B66C716642C79600F912AC3E3E85E8E59702D26376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d51426ce3ee5441f3df9bc8b98b2be540f0a836807eab200854dc6831509c922
MD5 e0aa25d2588fe432cda63b5849d3a29e
SHA1 1007a9426d6ca06a2b189e1a739aa5d203f46b94
SHA512 3e5895c3bd9ed86ea009c9e67bccf8c43063322357237bf5ebd6771b3add52df6d08cbf45c98c67d83a5a5f5722dc65a066ea866791cb1a7ed53c03042f94d10
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHQ:2UEtQevvqc2W1cpV2RI32
TLSH
T100474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4bbcd876cdb222df7d72676c2999e5515dd234674c4589774878b37d070c571f
MD5 0c9cfb05d10678001856608911177d11
SHA1 0cb1790b5135eb4444b0e7382174cc9c91e8f3ce
SHA512 59672b716bb130b72f8d2830a5581779aa4ecad6540c4ad5dfbd4d7f37a43ec7507decd689628e541262a7a1993dfd8609f388ce35e4a83440df958242c0a0e5
SSDEEP 49152:4CbRquA/m2yL5zTfFiV+XenmE3/zRe77D8WP+QgVuP:xoquVjnmz/QWp
TLSH
T100D58D1976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b1d0c3967d0695692afe0850663ea308a2f8fd060bfffc78b81a5892df672f1f
MD5 0dea01c661910cbe9a8eb8fdedef4f41
SHA1 e9c89a1c0919625d2c356b9badb885311a446839
SHA512 301aec1947ffe44b6a5f1393a2e385ff4ab517727ecfec178b60d3ca25a82b19a0db2d9085c88563b6fcd458d9c284e2fb41b0c3d0b14d380d566d2b4dab4ba4
SSDEEP 24576:VAhGL2IFoiwtA5l7S53g5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:VAM1Foiq5Qe77D8WP+QgVuP
TLSH
T12F359D81E7F955D4F5B3AAB899B68171EA76BCA65E31D20F2250D10F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2f8c5fc842e99d1dccc75b8396d696e16e26305813742d97f27856c281a4b4aa
MD5 2e02f0f6b6568d39d5552035dd4309f4
SHA1 4e35fe4cca2e45fd334718c9418bee7b9f82c6ea
SHA512 2aebcf03ccf925db40bf51253d4b2bab38ce38a386d03b3952cc758b5f757f49b7da3714d8490698df5b974cd50362d4d4508b7bd74cef6292cca33088798710
SSDEEP 24576:BwuXOWN5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:BwsO8e77D8WP+QgVuP
TLSH
T1B505F14677D81CF9E5A68238C6978132F7B2B8113A65DB0F17A0C65B5F37350BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 61aaa78888a069775b274be8ea00ab800f7473acc733247174b7609d3649532a
MD5 0963b30e591b4c4b2164f26b070f9364
SHA1 b782ee89a9980bc010b461d8bd90ad37bf40d18d
SHA512 f99b6efb61bf37922846b77bbad4b448e85e04e3f04366dac7d6addeeee90cbbf9bf2ba757dc2dbe5517f0f09da929fa0e76d26dabec2cdd82faa7748157d956
SSDEEP 12288:l/Z1IyOdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:tZuq5w77Mm9RyaXAP+Z9T+QgFhMMVnMe
TLSH
T105E412A233C824B5D2B7827CC9E64101E36178A2377563CF17A5269E1F73AC5AD39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 499fa411ab0064dc3aadb5b13175dec14026ff8ef28e631cbd861ebe7742851d
MD5 40bfe0f3b5855373ff37f0564837be5a
SHA1 cdb865177f9de45fd8359998d789848fc085ae4d
SHA512 ac1f638a0624aaba32af7f7e76f5e18a2da0c2fbf568c481de72b6689209b490d56a7fe4d0b459bdef521e74021bdecc0bacc368ac30e732066663f4aa615b1d
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uw:VQRQyi36YOcPhLvw2gAf+PN3i/QWp
TLSH
T193667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 942579737cb8360c282f28c8a96ac1523a23f9eccc3961c848afa808dc48a3b7
MD5 1ddc48d2b8965c5ddc071db411b0e3d0
SHA1 6e689c505e25cd76963354b0a8e6937e18318bf9
SHA512 4e39a4725c199e8b2238eea70f8fd7b7d155e1c7f86f8f0c80ea72acb494e5942f8e9077e77d6d6f021dc7f63f2207d1dece91261dacd04853f896d774a9b498
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uw:LQRQyi36YOcPhLvw2gAf+PN3i/QWp
TLSH
T11C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6dc27093853de3f9ff1c27e17182a8111e3860a2405a52d0f1a0892c6e32afa8
MD5 332d88d530c56cbf5e1a9e84e2727465
SHA1 11b1c039dad9754a0b54c3afa8eafad04e56b9fd
SHA512 403ab166a8fde28ab683f1afa199f7b31a69cc04891efbeee56bb2adbe13236e4a9c79a295676597718671fadafb9433ad54a30b2081af2c4da21b277edfe348
SSDEEP 49152:Y68Qg55nhceWu7PNU3/he77D8WP+QgVuP:ithLRc/o/QWp
TLSH
T10AB55933B2F600A9C05DE1769F4A872196D17C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 99ba324d44b106e3da3cab782fefdb5c1745cc14d374d436c516248ffc5a611d
MD5 bb52f78e437428679a59709f536953e7
SHA1 02658d0a10284240e99e2a1d058b0d2e42559f70
SHA512 319147741622bc406abc4981cef84dbc161d4cc815d692f84aa796ee1f96dab18faa9d24e412fa2648adb2ed508fb72c9042a169ea1630b7ea3271309006244f
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk996:Ry5112gYy5azzVva69nLKnhZB/QWp
TLSH
T1FA167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cba8213b3df3847f57d68ad8ce300ed63fc037a20fccf271a5134325150e77a6
MD5 8e1808962c686896f17eea13563bba53
SHA1 f5a38f8547fb7aa2290ef3cd759ceab12210a2d7
SHA512 b2bbf1d6bbe82eabf848ad9f7fd9c7fde5550aa71bad0e1a7b29ed49dba311315b4adddcb2c7d1c84ea8b289122f2232287ab521fda362f7c8f8ed8e7dd353a9
SSDEEP 49152:AB+taZ3usBWOBr4tEG20bqx0z+n217aau1glde77D8WP+QgVuP:au6JmUxd2dc/QWp
TLSH
T16BD59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c46ff0ed12348ec68b815e605948e9cc92011f23604b5be854c8c1057ba33247
MD5 873c570ced9bfa695674a42e3c446827
SHA1 828755a974906943e8ff0226cfa1bad9197e0f99
SHA512 fa4218fff7c217ce8f7fd268efb1ce38b0012e02e3814a4eb48b7151e1fbda2f7293efe50b20003c4147ff67d4b1021be7c4c988ddc50d0f6292dddcb729526e
SSDEEP 49152:B1hpsNoJpF1A6BU44CwH7R4xXe77D8WP+QgVuP:BmifPkRz/QWp
TLSH
T147B5AE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bed280c697a7f92c26a27ad209de96fc7e3c79091d3f3f53ecd224d5204313eb
MD5 bb7cc9fcb4604598cb45eee5ae9ff704
SHA1 b5f8bdf184530f2e9ed8c5c8b93eb87d8d550093
SHA512 b16f581cb13f18169312aea84fd07c144e4a8561b795db9b007c81f9b3bc82ede693b37119425cd3ae18e516e3fd476e9d8392ab4f71b090796bf9e83a6826ff
SSDEEP 49152:wSuZQIY0Be2KNRVtOnks6NMHqqe77D8WP+QgVuP:q5dKvi619/QWp
TLSH
T1DEC5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b727e9dfd223791ab8b0be3254c506d4f6ea796b4a5027693fa0a28e4c1b07c3
MD5 4dfefae74ccf41189355477b1c862289
SHA1 398b7240983e5891222909c2f11fa986f70040e2
SHA512 513cda6f8966428474c6d705a31839ceb625d55c01e83a4667241d4940cb6b0bb642e14706f689a7cec78300f3d7208daa432628cdc9809f8a2ad0fbfb29817d
SSDEEP 49152:rhtSn8EApI0figXgiDn0AP5wLe77D8WP+QgVuP:qX2iyphH/QWp
TLSH
T1ED95BE13F2D900E8D06ED178C7468632E962BC160B35BADF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 8ffe7760492fd6272a6ee513acbe6216c2efeb5e1d23d2152807496dbc67baf8
MD5 d39e592d93fe8198db041d99b417e33b
SHA1 9d30d48b899ac53b5119ae67643b762af1831fd5
SHA512 8f068ca45e51c25bae2e5ca3fa7e875e1b621b9c70f84bd54bf2e2184ce70d1c73515c91eba3f1a5840b56b3fff0708e521dca7a0f1014db66c56b943b8cba3a
SSDEEP 12288:ZBdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:Zu5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1F0C423B3A7CD1C12D27586B5C6D71002F1492DB23EC9360B6BDA354E5FB7B88F026A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6317146f408755b0e95bff9eebb3f598f9125be6e37fd85d095062b625d2b671
MD5 2743179f2e9e71c212898f18ec7420f9
SHA1 3a4aec4e77564ee773f4d3211194b9686c7114a8
SHA512 5ccaff70543857d33aef9428f964101375adc9818b09e022f07204f368a17e455e053251211ae4bbbf8646c33db87d83b804ba9ffd7e514b1d65f12a180abbf6
SSDEEP 12288:/6dacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:/F5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T127C423B3A7CD1C12D27586B4C6D70041F1486DB23EC9360B6BDA354E5FBBB88F426A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c23d2295ee636ce66951e2540a3740a9b88e7a951faa56acb56099385a9cc60d
MD5 9e4324a77c9e7fccc9167edc8c3d70b2
SHA1 a70ad49faefaeca48f4414bfe1fcddb5a959d506
SHA512 d14ca4172f38e52ffb14d7cb4cb598bf8a6715d2070d97f2e99e4a61eed21a04e859171ccccee91aea0fe0c359e040fbdd020e2f9bd2c4aefbd47d32333f7dc6
SSDEEP 12288:hQdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:hf5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T151C423B3A7CD1C12D27586B5C6D70041F1482DB23EC9360B6BDA354E5FB7B88F426AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c1fc71002650fecb4961c743520f9ea34ac0a3a99a2a7a9be1e4b78043502718
MD5 350a5735361a55124786a34c636265d7
SHA1 a194a092c2599a86c950ce5ee1db23fd853a5330
SHA512 ae536f349b8f44c02b74fdac85dc0d4ed0046e7c60331bbcbf0eeb9a2f9907837b88b4c77d010aa8adfd137ef4c264f561d83208d2df25657190c1b083832613
SSDEEP 12288:IVPdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:/5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES
TLSH
T106D412A367C90892D175C278C6E74012F2A57DB17BA6760F5B81398E1FB3788F835B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8586703864ccb905ecc5603cbd4b308e7ed51f28091440461fcc90b278c56b34
MD5 871e148d63e89a964074010cb0987b9d
SHA1 1b2576ccdfa7738005df93fd71bacb9935b4b292
SHA512 a98eef4e0a33b2b66099b03e442dfc1a5c0869912f481a0a3e81834b7056d05f11c0f78b6638d10da8099e9adba6e20255fa75983a362487490048f5626db1d2
SSDEEP 12288:jndacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:j45w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1A4C423B3A7CD1C12D27486B5C6D70041F1482DB63EC9360B6BDA354E5FB7B88F426AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 54091271d2bef28f773b74d4da5f060065043ad02bf76f0b05553ae37e44eaec
MD5 0da16787bbd49665f18520dd79833e6c
SHA1 bea7725a470ab8686d9b96ae5421e92f6ea33309
SHA512 a7d60b5d94f2a2d51136df41a11f85e39eae798073788ed6fc5a6d0c65ac78fb96ca6ade002b2ceef2ecfec11007ef534d1ccff4bcd9bbc24deaf273cfcb08f5
SSDEEP 12288:8mdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:855w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1ECC423B3A7CD1C12D27586B4C6D71041F1486DB63EC9360B6BDA354E5FBBB88F026A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 04c74a588a58159e22177a15a3e2cfa867c66b8eca3604a801813735b39d5f9b
MD5 ae6fa9050d077186062260143c4834a9
SHA1 f105b1b5dc7f09b03cbb65c0306f528871939ac1
SHA512 278dae4afccb326bcc0dbb388ac9112c7e25d50f1549cb1a019d8314b5ab9b1332e198663b2245a16304662a50e17b9e3431708fec57c20b5aa31368f1195272
SSDEEP 12288:0ydacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:095w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1E9C423B3A7CD1C12D27582B4C6D71011F1482DB63EC9360B6BDA354E5FBBB88F026A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 342da42c419b99e908a860ae5c93d8be70f444ae32132df5836d56fbcd0bc352
MD5 0f2188ba6857f9d0153febe6e6b14416
SHA1 10747c3ff0e9a270ade20dc1ce6a17400a4180ab
SHA512 05148c3bcc1ceed4f179ec2b777026d7f2d65a80cc4f381a03942dae831559dd24cee31275996742ee0a6040e0eb38192fd24f43c9790b3b78cb9e885fbb85ef
SSDEEP 24576:oZMMzFVSOl5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:oZMMzfJe77D8WP+QgVuP
TLSH
T13405F1A1B3941CF4EC67823EC9568906E2B27C661BA0C60F17E4365B5F733905C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b8bdeecacf653b9aa26337ed6de2dd6fbea3df0af36f96c22b4c343c5de95e0e
MD5 e0ac451cbc282606653d7cf1052094b7
SHA1 5622e4644fa8c2100dcb2e2ef422d31c81c00a17
SHA512 2beb4930fc370e7fce6d54b33c618c28e2f5c9a137166273b1667b18e4d8103b67addb5eb290dc82f6477318e52b5bf5982be3d1e959f8f3cc43b911112b4682
SSDEEP 12288:VFdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:V65w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T183C423B3A7CD1C12D27586B9C6D70041F1486DB63AC5360B6BDA354E5FBBB88F026A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c952f28bbc5aa1f83faf1da0171c60cfabb20a94ce467d5b731c9f136f2a7006
MD5 174382b06663e1d5fb40e2a2f4953cae
SHA1 c21c0bdf6d0ef539556a02c8cc376418683a713d
SHA512 180124684aa7c891e555dc9777729958d14b945f174e33de3096907653a3e750d21b2b1b2dc21aecc1a60a0b444fd20914b5edb286efa4405d032a6c76613a14
SSDEEP 12288:Rpdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:RW5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T100C423B3A7CD1C12D27586B4C6D70001F1486EB63EC5360B6BDA354E5FBBB88F426A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5187321fe8b1bb835becdd8a4d01a5d9f0ab1e2c72df0684173ae1c16151e0b7
MD5 3d1a8263d7c4c50337d5a37b9539f9a5
SHA1 931fbf8fbad5f73321973503e2dac0d3e75fe67c
SHA512 915baae0fa436656ce55abb4b85c9a557fa0ed2c337364ee09f3b3e6f57b7d77248386ba09663acb206396817fbbfcba10084d377f3c2d3c42987f49c68d1fc9
SSDEEP 12288:1yPz5L8Odacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:czyB5w77Mm9RyaXAP+Z9T+QgFhMMVnMe
TLSH
T187F4025373D530F9D1768238C9A20902F37678722B64AA5F17A4167A2F377D0AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2c4ad7ea368015069c4108312d3ce0b63d18b8698202e34a1798996f9dd733da
MD5 7e6fa2a39144db178bee13fe5e463367
SHA1 16112731786c2ba09fd144a7cfff283936615e1d
SHA512 550125e908941efa526d7e59d30f3c18fe21e24ea059be27b709efabf73198b0e6798b143a4ffc37828b334f842b1d072f1f20fd21d067c9f5fa14681f4850a2
SSDEEP 12288:TFdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:T65w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T14DC423B3A7CD1C12D27586B4C6D70041F1486DB63EC9360B6BDA354E5FBBB88F426A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 94f01040b41ab569aba7fd4626e24ba1aef52aebc3429f497b24dbd81e501f3d
MD5 7c8f423a54669a7a2bc9cf99cf631c5c
SHA1 c750a26ed050e5be5c0b78d7237b756b562d53b3
SHA512 113fb52bee5a84f4e8e69804fa788e7577b0a2b0e49408dccbfd3852b467bdebe64ceceb3dc11b515ec10999167428c07f7818e300fa96bd5fe6b31ad1b8df3e
SSDEEP 12288:yFdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:y65w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T14BC423B3A7CD1C12D27586B4C6D70051F1486DB63EC9360B6BDA354E5FBBB88F026A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 154f8f39ec12f9cdf94be8c141a025412463576557afacd2835aa54ecaa02ded
MD5 43a08315017bcc514c62f6b04edb0bc2
SHA1 848154ae3725b173e32541e3ef1f03818fec6850
SHA512 842205aa698896011a8315aea36fe59f29c7ee31a5d3e3a516130ed1caf52cfcfa35482f03615c6b8b9b5afb37f629f1ee22bec228ece75df8868c0fc7996680
SSDEEP 12288:hyPz5L8Odacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:wzyB5w77Mm9RyaXAP+Z9T+QgFhMMVnMe
TLSH
T178F4025373D530F9D1768238C9A20902F37678722B64AA5F17A4167A2F377D0AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f88e92f4252d7983adec98fa291540bbe4b45d953fd7a3e7ce5b0727f068b83d
MD5 86967c8ee1cc32d4087cea523286ef8e
SHA1 eb886f8a546e762eb3e1b9575fadf37079672c87
SHA512 3b780b16dace9e4bc31f067d2434f74b7c4cb0ac906209e556de4e759b4c51d71e694a2f77aadbef6434aa462d362afc134109db436f826ed37682b910a4913d
SSDEEP 24576:1T9aLl3z0zDP5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:1TQLlj0e77D8WP+QgVuP
TLSH
T10A05F1A1B3901CF4ED67823EC9564906E2B27C661BA0D60F07E8365B5F733905C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ae892c9035438b551d2282bb2498bbf9fb4ea4416b4428e59d3e7096d5be58ad
MD5 0506513e91869d0b20f89968e5cd6a7b
SHA1 323faa912f4662f49101899ebd67dfd92196f4e3
SHA512 aeb0a20d6b9388ed16d42672bd7547e97d8e7c5bb4c3db91a486de94ea3952b2d5d593127b25d0e13c2e03dad6f30aa22cd5ec540fc05521403ef5f0cba6b2ed
SSDEEP 24576:d3td9CHKy7GZz5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:9td9CHKyaJe77D8WP+QgVuP
TLSH
T1FC25CF90F3D814E4F0B78A35C9764511DAB67CAA1B61DE8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6aabcd1f10d6361ab013f8c3b05d499962c763c16e3f5ef74d907ea39cd0b9a5
MD5 0b7c4b1546808747dffbc01d976c2d5a
SHA1 fa59f8ab6371ff3be1e8f19fd121ebf0b81f337b
SHA512 0bbe45bcdda8532d9aa6858fa3a7b160f8e9a72ed1148ad2e1910ef46b4e7b1f0ef7dbb22b1d34197f7c1c81d321fe74f34798edf9c6d030d9e596cae3f8263d
SSDEEP 12288:swdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:s/5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T10CC423B3A7CD1C12D27586B5C6DB0041F1492DB23EC9360B6BDA354E5FB7B88F426A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 43488a462dc61d8e443f9b461214e29f404e1ca7f6735668d108e351f224dc45
MD5 4fa328c245d1c4da68325ec9ca699ec6
SHA1 0180e5d5f475a5baffeaae5a0c684b654e20ac49
SHA512 9a3df9b1a9fc4dd2609cb7b4143814c89d3570ac8fd6711def967c3f05f6d404d96d02c3c45d326c2bbbe66828844af6ed309a1b8ace51026bf20745273eb376
SSDEEP 12288:7udacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:7h5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1E6C423B3A7CD1C22D27586B5C6DB0001F1486DB23DC5360B6BDA354E5FBBB88F426A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 76e185f6e1dba103f727ef462aae6b5b250a80b0ee2f2f6d8bafa1be79a2f03e
MD5 59f5562f6f0b1705a4c0b2f50b6bd5d9
SHA1 e44203fc2f7a81b8b1e71199bcb612447d4328ed
SHA512 dd933285330453362ca573980b4c3392d58e75a47d879c5d43e3ec1f83d713b3fbd57894edc535aae54a01cf004ce743a77fef273bd5621cdd3ab0af0293fec5
SSDEEP 12288:uzdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:us5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1D4C423B3A7CD1C12D27586B8C6D70051F1486DB63EC5360B6BDA354E5FBBB88F026A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 9bba06d4e5554555009fc395659d5e1bba6d9ff2f7ceb6e4ea91a7e7d0360cc6
MD5 bdc7366e45a2db82892d91a0f6401970
SHA1 6c2ea0252a328c07f1055aff442541466a882376
SHA512 96d3feb5c61b13e634bc5bc5ff87f83b9e12085a2f345375cc4504e0aa1f7fb380cf9bfc56928a428650ea06210af6dc39fc9fd1354957add923d6f62b0d25d0
SSDEEP 12288:EFdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:E65w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1CFC423B3A7CD1C12D27586B9C6D70041F1486DB63EC5360B6BDA354E5FBBB88F026A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 329e7a54948b10de392b5fd3f8e0680a85d1bd0c78ff04381cd5ae20068abc89
MD5 01098568d167dbdb8c89c611cc420072
SHA1 4cd4f0aab9f448631171701d0a13ddf4020d07be
SHA512 e8801043e69773819b9eae6942a5f25741b782d7c35ef53fafc79dd99a1f1a4fdee8b680df1274fe2fc7f85a9648c54fb61ab66346257897ddf9b8c480ac2c37
SSDEEP 12288:9wdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:9/5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T17AC423B3A7CD1C12D27486B5C6D70051F1482DB63EC9360B6BDA354E5FB7B88F426AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 19eea81d14b2dc6a63dd0e95250ce72ba35f1e35e83a7a089bbe492c8e17fc17
MD5 da4b877ad4e8a4e4203c7d394d81cc6b
SHA1 85c45fab3c3c40160b33d52b99864c7059682b69
SHA512 921a3cf4bbe2d815873c3be5b99a702cdbe7a1bb93bc4b17a97ca95bc42d8c078c4056581e455bd4d738668ddac3d0fdab8f06c32a6d986a84614033efa3b69a
SSDEEP 12288:jddacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:jy5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1CBC423B3A7CD1C12D275C6B5C6D70011F1486DB63ACA360B6BDA354E5FBB788F026A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-10_164309_828-5060.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-10_164309_828-5060.log
Size 1KB
SHA256 9166d4f6bee881479036885c23c3a17739179ec5b5b3c6604d3e959be4f13b8b
MD5 b285c6e2679ba55d44afff716572e5a5
SHA1 7ee27ef4e57946087f33937bca0cc3ecb756722e
SHA512 09b2022e527e7510beea8504b7cce7496b17cf73f1257e50abc9d34402f0e6815ff1f920b6c2ded248b3f5cbbd1faea076a5d9e5a7f683ecf6f78ce7e92c1b96
TLSH
T1DC2196893BE80A06FFFBDDC198FA51535E3A39526831C90C11A4534E0971F44EE74727
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 12f3ca2c8bfb5911ea74c0417a3d09426ab6a80e607c629aa71ab91169d4ee2b
MD5 025274e5d6118446b6c3cd21b1d5328f
SHA1 7fd5fa6e1518b79f3b1c10eba8bf1607e0464155
SHA512 16fdd69590ef5c6ec223ee80931528fd6d4d3a463bda4f9ee52c6db008206fd1aa6007d8a076e2a2b243c461c5a27848272d096b38f71332477b64caf9ec0c39
SSDEEP 24576:kfwvok9RX6wkyAIm5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:UMnYIme77D8WP+QgVuP
TLSH
T13F35CF29EBCC04A5E177923CC9B7460AF2B178691B31D6CF129A536D0E37ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 459bf394a387b908635158cb7aacd8bef00a87a0d96e79ed71699c5b86c4b0d9
MD5 eb7e8a928905500a34e48657a45a6a67
SHA1 c552c98a7be1f8cd666ebf425bdec5145f8acbb6
SHA512 ad75d1def3ecc359698108778596f71fa6255d9c99231a65ff8cc1a7e8365fa10cf46a4d1ab5a22b3ee382ca2e093797ed3522a592ce6cec8969b1ef74123225
SSDEEP 49152:OYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0re77D8WP+QgVm:aySzPC/QWp
TLSH
T1F1066C96A1A801D5C1B9C1B98B1BCC17FB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 463cd9ff06e13a3f6f2907b5fc263de4f284daa6109a8c8184ca1028980b200e
MD5 87d6c34af0f7365b18fa19f82ea70e4d
SHA1 e112e91b85fbab1f46d7e89a137013aeb7f76a87
SHA512 d990220bc3f18d3e490761744fcb0ce01af9bbfe0f421f1b703ea0ef7d49aadac6eaf02a02585d5f03b25dc13209f4de2053ce02562098c279a1a9245758962b
SSDEEP 24576:R47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY15w77Mm9RyaXAP+Z9T+QgFhMMVnMbq:R47JUQj4irIhCnDHUPfF/7e77D8WP+QN
TLSH
T1B165AE1EA3DC01E5E1BA827885554A1AEA71742E2F31DACF12B0437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 970f590e1d58fa92fff72b77c5bd1fab95564d63aab4542e75d8745b724ed3ca
MD5 834d17e8f18c4037164b2c9b0da9803a
SHA1 892948789b3574895760f966285f019deffbd881
SHA512 7728f5a95645493d9134a007f9099ca38368eb9c999153ee85e273875251ff4e577ea9deece302427515a8c1dc3644c75671f2081f2bd147438c6244e0228aa1
SSDEEP 12288:OGsfVdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:Sq5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T1BCE4F166D38801E4C06EA279C7964601F3233C65A7E1A3CB57C0F57E1F76684ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d30f34bd5e0170fe6f4053837d9518711ea091f354ccc7151c0eec304fcf7cfa
MD5 e8680b06c9d2d5748ddc193d804a402a
SHA1 bbfd93e051afde1da1492bfb766d9f10b599fe6d
SHA512 69abb21fe298687a0e693ddbd8bbce0b0daae4692ec5c2c510df295abcbceb6e6fe16112e29cda9a8539643c0ea5db9035c77d438aca7e9b24f123c86c23bb01
SSDEEP 6144:qsBC2na2cYChrER7fKDexHEu4wy5aB6PT3QmIJp4Fy4MYs0+9vZ1Is612JOG0q8r:vjPZby5o+T3Y4FJs1Is42JOG0q84+
TLSH
T162351711B66AD75FC6AD40325E72D1CCAB707D01EE056B0772C8873FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 be05cafbb1d627855a807c2f3314a94b65e634fe56294bc02525618e782313a9
MD5 8fe57ad3bb3e495740e255910ba4f641
SHA1 e0ee7e4aff7833fd88a4fc53cd89f96ce9c7f8ad
SHA512 bb154e739f42a751bdb12d4f164d2388f967942c02556cedf17c1761af86a9773badd52e31a0cdb202b83824e27f8d9d427626405d7b832b332e42f7f6b2372c
SSDEEP 6144:bt09VnD3R3um7InINYAOywnCPfiKDexH6iKDexHoxWja05C1LKTyNz1pCwK:S3R3umxHJRx7Ln1pK
TLSH
T11865FA41A537A39FD1F76032032A6B8DEB74ED0277056F2663C8453AD86A725B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9d389d5c09b9604354c079fed7d73de881bfe76ecc126d3ee28b9a439d896a7d
MD5 1301901cdf743ee87f4b358c0025be22
SHA1 7b5a858b51506eaae860a368d06adb1e95dba555
SHA512 20ebd5f442d6cca55fdee568f8f659020cef72e8aa775c88a40987fd77a4764cf84bc2d4345fba514ef9b1f0cb4e7f0673c506006f578e4fa9ddae71af79e413
SSDEEP 12288:j07tdacf2GTn77Vum9N/3TI5aAuAB4w+Z9awuJQgFBXZ6M3FnMCa4EUD:Ii5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4T
TLSH
T185D4237397CC1C12E1799674C5DB4021F10979B13F84758BAB86368E5E77AC8F836B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 01a3d1da302bc6f482a75fdf88907608888d79b4f2e3c5b5395839aaa8af5acf
MD5 7da25aaa045c3a27b8db169b09983f12
SHA1 5db0e08d699d562af230862a244ebb7f2064f43c
SHA512 6f2757b4bc6aca608f8ca60a46a0dce93e8351c43249d029f0a9d6b6d36b63dd3a53d20ed46ce68fa2207d3e76cf2aff9fb38199f10621c8d1b8c0fcbfb33ceb
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bY05w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:1gb4mBIBhGF1e77D8WP+QgVuP
TLSH
T11A65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2CF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4da3da1783598ccaa601b97a3f820c3e503b27c8c94e5b38335e5e56e7d33f24
MD5 3f39e9b39df632bbdb62567aa45609d0
SHA1 4b44ae523e11841b97ec0df416b35a7a517e3891
SHA512 4b8edbe6e05e9906172f18c7173a52a350027443e2d766600aa4f115020b6eff2f84bb03e674c5be72022137d5719413bb3d638c376285bb347254c95b8107ba
SSDEEP 24576:OG88u8FpJqH1Wzria7/ml5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:F7ZFPqVha7/Me77D8WP+QgVuP
TLSH
T17835F16277E401F1D07BD138CA864663F6B2B8251364FBDF07A88A551F23AD45B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 897f8a1d6e566ce73d551bce39ec5ef00addbd82a615b2b25b1042f79d75869b
MD5 0b5b5de0451c808642ea84493ef01e7f
SHA1 6c2a09c221bc9752893b709acd385d1f81bc7792
SHA512 a2c11f64cf917a1ffa2313c2662bcec835cb969056b7bb842a76319cd2048e8a12c5866433ba13786779e4b4194170b2047523f766ec898ebd38854e6042898d
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5e77D8WP+QgVuP:+G05lO43b5/QWp
TLSH
T128D5C06A62EC11F5D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 168d926672e75c69aa042c18d52efac0bf2ebda3e059458f4d7a300297667578
MD5 f7c7afeed6b2bc5ac513afc73606c676
SHA1 ae4cada54240c68f7081d1ae309d575d529a61a3
SHA512 02978312559decca6b343e970e606ae908eb61fd6592a63a1e02cda110d28a9358f7fd80d49106ff59ef25d56695c6ad7c576d9436cca08528dffed379c5cdee
SSDEEP 24576:yfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnr5w77Mm9RyaXAP+Z9T+QgFhMMVnZ:aa5POZ39Jt2pasx2+mhe77D8WP+QgVuP
TLSH
T13C65AF5EA7EC01D5D1B9D17DC583461AF5B1342253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c25af2590a0b17dd9849c045b476484b12e4d6db35f371b449f3cbaa0f748e69
MD5 8a9165980677aa90df3c51553afe0bcb
SHA1 3ba95e2fcb1a40bca7148bb0d8fe4f070a066044
SHA512 f4de050d186e7c87639f8166b33134c686cd98de8ba0972c028433354d9525035fb7ee9d55d5d1f1d7ff3a84e6a408862c1a8438efe4095598204840fe957d82
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fkt5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:FNc/zEOVHFse77D8WP+QgVuP
TLSH
T1FE857B2623E901E4E1BBE1BE89779546FA717865133096CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d7ad08b643c3e43c42651efd218c76e338ad975520487e1feaaa68b772c2fb15
MD5 a72955e9883fe553b411c2de32acfdcf
SHA1 eaf9f943392613026267e52a07a6347cf9ad6afc
SHA512 606fb5234e475551dcaa9197662665fb09113773f9fbd3b160576fc0e05fa7119339ae9f9982a6df62aeebbd9bfc025c1ac2d722ad19ddce460f1a0c5fc06f04
SSDEEP 24576:ztkNvNnaFeYhJNtmZBm55w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:ztMwBtOm5e77D8WP+QgVuP
TLSH
T1B355AF6EBAE806E4D1FAC6B4CD238512E6727461173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 ffcda1f11e0923617bd906f1192d48c832b1d2fa6efe1cd971293268496d76d1
MD5 a0f21f7a15e195c2e6ff476bb4ea1f1b
SHA1 e78cc37f6888687a76e12f5aa49f32cc2cc39592
SHA512 98f35eea0bd80648c03c1880a1987b9c89a82dc267e3dc373f333b8cc162a7005f32767d3a92b4dbb81dbdc7437c7d125db727f5e43bdf7f2a281ed6dd9f161a
SSDEEP 24576:GPUr+NQJ5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:GJQJe77D8WP+QgVuP
TLSH
T16905E12B62DC18E5E676E17DC5864609F37178621712A2CF02E1917E4F77ED8BC3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 e9c09f0fdaae22f0af55f3386db514d3351e33b8c77b5595a7996841d05710d7
MD5 ad90405f5a4efdd3aa2968fe33b0ea2d
SHA1 dfe84d2d1795c53304ee05dc347e67d536fc2d73
SHA512 bcee592f7bcadc1a80886c901bfab2d5acf9ad6e380f51ce8dc96fc2110e7b45f63f9ae5539bfbdef062e99e2edc8eec36d6ae7deec5d83f2640a557a842d9c2
SSDEEP 24576:PD3FHshBIYQgAO5w77Mm9RyaXAP+Z9T+QgFhMMVnMb4ES:PDVHeBIAAOe77D8WP+QgVuP
TLSH
T18C25E17EE79C04E4E57AC1BCC6A34506E37138A9032266CB06D491BA5F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/828-1-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/828-53-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/828-52-0x0000000140000000-0x0000000140471000-memory.dmp

Download

memory/828-2-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/828-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/828-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1360-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1360-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1360-124-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1360-54-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1360-122-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2168-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2168-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2168-333-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2168-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2168-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2168-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3520-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3520-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3520-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3520-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3584-398-0x000001F9609E0000-0x000001F961060000-memory.dmp

Download

memory/3584-331-0x000001F9609E0000-0x000001F961060000-memory.dmp

Download

memory/4472-119-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4472-126-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4472-113-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4472-316-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4488-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4488-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4488-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4488-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5116-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5116-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5116-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5172-135-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5172-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5172-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5172-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5172-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5380-84-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5380-299-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5620-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5620-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5620-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5620-318-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5620-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5620-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5780-282-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5780-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5780-72-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5780-80-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6004-238-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6004-68-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6004-62-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6004-61-0x0000000140000000-0x00000001400CF000-memory.dmp

Download