stealc | 55e3141081efcc404a9d18caef1416b37aef822cd020d80e3409fe84d7acb052

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260910-ypqgtaee53
SHA256 55e3141081efcc404a9d18caef1416b37aef822cd020d80e3409fe84d7acb052
MD5 0fff14f24a7a5256a83b138f58ce9ccb
SHA1 cb64a20c838b8db10532194c869976508d479f97
SHA512 0c634d98ab02177772a8190371fc8ecff25ba822d6e1daed0ccb917432c5f6d3e94536234867d1c9ac48e132d0ad4b2d900922bd51628998b8778ba3f7b52d94
SSDEEP 49152:G3Bi1+JQlhKtjzk0hrl8FXkufybl6v0Ve7bcN3kFrLszsETdKXDmg27RnWGj:FmmocfD527BWG
TLSH
T1FA267B1BE6B941F5C0B6D1798A979517FAB27819873297CB4391434A1F23BF09E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4076-19-0x0000000140000000-0x0000000140475000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
5044	elevation_service.exe
2256	elevation_service.exe
4224	maintenanceservice.exe
5196	OSE.EXE
4824	PerceptionSimulationService.exe
52	perfhost.exe
1140	ReFsDedupSvc.exe
2816	SensorDataService.exe
3024	ssh-agent.exe
2344	AgentService.exe
5604	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8c0e00f3238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-10_195759_4076-1288.log	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9e628f95e41dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc015ef95e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067b2d6b75e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c4e04b95e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9e586b55e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005d5e6ab75e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c6eedb45e41dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdf972b55e41dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd0ddbb55e41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
5044	elevation_service.exe
2256	elevation_service.exe
2256	elevation_service.exe
2256	elevation_service.exe
2256	elevation_service.exe
2256	elevation_service.exe
2256	elevation_service.exe
2256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4076	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5044	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2344	AgentService.exe
Token: SeBackupPrivilege	1140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1140	ReFsDedupSvc.exe
Token: 33	5604	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5604	SearchIndexer.exe
Token: SeDebugPrivilege	5044	elevation_service.exe
Token: SeDebugPrivilege	2256	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4460	4076	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 5604 wrote to memory of 2888	5604	SearchIndexer.exe	102
PID 5604 wrote to memory of 1404	5604	SearchIndexer.exe	103
PID 5604 wrote to memory of 4080	5604	SearchIndexer.exe	104
PID 5604 wrote to memory of 3580	5604	SearchIndexer.exe	105
PID 5604 wrote to memory of 4592	5604	SearchIndexer.exe	107
PID 5604 wrote to memory of 2216	5604	SearchIndexer.exe	108
PID 5604 wrote to memory of 1272	5604	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_0fff14f24a7a5256a83b138f58ce9ccb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4076
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4076" "1456" "1292" "1472" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:52

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2816

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9469668851f104f305514810e17169ec1b29e0c5481066f67659a44a644fafa4
MD5 67e7524ec652282ce11f988198bf9b83
SHA1 d19a30c79809c91c579283022957b6d089f2f0e5
SHA512 a740da7a94020cb0cf271842ea7ee9c3f322971fca1e02358350183f630d33f453cb5f856464e6bdddc1660ddd27a6a3dd73a972708e70e938996b4f9ea535f4
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTDmg27RnWGj:X3q6HjBUD527BWG
TLSH
T1B4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f3e5026b9c567ca723ba391cacd7549623ff5e99af3e3131ec77f0585dbfd6a5
MD5 488130ea3d10d153b2e321529e8a05a9
SHA1 f3ba3e5e6d506d874071fdfec3a1fe4c7e7eb807
SHA512 dd720283890fe30417082066241a05abd625a3365cb95632123ec73ecedb7005abe5cd86e6beae386cf94520fae084ad1145622b7957c3f84c8768ec0a401dbe
SSDEEP 24576:iXYfDtczAksqjnhMgeiCl7G0nehbGZpbD:ptclDmg27RnWGj
TLSH
T15B050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2c6f3fa463a9127ffa48f68eb3e491bbe333e2318a3390835ceeb8c84d4d95df
MD5 ef4af48602c71921f488f8b3c3ef0351
SHA1 668dcdccd197054b634e1143288212b5e8c520a4
SHA512 c3bfb2c37723d77549801bab7eb19d107ec336f67f4ad11b6f8616d17e293142afb74d18fb3dd5456698c841fad07c6f2d53021ff3e0e5891bf1de27f32d5541
SSDEEP 24576:O0Le5ji0hmxirMnsqjnhMgeiCl7G0nehbGZpbD:OPji0AceDmg27RnWGj
TLSH
T1AC359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a2c6b1bbbcb48bcec528754c13f077c367f7d22a4259959ca010edb37491d5d9
MD5 765f000d51b438a23374625a1b9cee7d
SHA1 4e4236e22fc5ab024ba44fd9bed2916135364e10
SHA512 b04eb621c244537bd66bfe8dcb443a7445460bf7508efe82950f8a228222129ba5c1e9e1521746a8a717aa13bebcdf5408b1f99aad6be60c000f5af3be171d0a
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWE6q8wyuhsqjnhMgeiCl7G0nehbGZpbD:p/ezSC6vUzPvxHjyqDmg27RnWGj
TLSH
T17C755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 487d482bd81064c4163f563975ca3d114ac547b5cfc24e7c7b8c9e365a1c1749
MD5 fa137ab381b8502fb257cf368eb125b9
SHA1 0400b099ed8c8cc3984cd890c3b51271fb408430
SHA512 422858400527460d07ff153bdc37b71fcf6a7a3f49d64ca5243235284b5ddbb6f789113db4fabae349123e082f6ad0e8ce95aa98501b9d98a067ba878b1622b6
SSDEEP 24576:MVbqPb88hv/l+64sqjnhMgeiCl7G0nehbGZpbD:MVO88hXl+nDmg27RnWGj
TLSH
T1AC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 62bd4c3ee4c086573743627ad66c3696566d3009242067eca39a0fe26425c8c8
MD5 7dee41424c4d59060fc4344ec72d946b
SHA1 1619d4d47bd342af3571505b7f1f0d0da1aa1d16
SHA512 505ba66e6764f19fd55c9643a8af20b200853e172192f1a0bf770e7d265815a15f2bb94da9f1f63b59e2bdf8ef5c1fef47597397e488abe143acd02e61c1fc49
SSDEEP 12288:ARLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ARLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11CC423BE824C11CAEA7708B5C3E9F55DAC133E56982008436AA37DFDE6B5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4db17c2a6b764e1080a5631f759d2a0e163a19a784661af8437dbbd6af36b60d
MD5 e30a9bfd2fc1fb04363ad9168c114b71
SHA1 f0a5be2f91b36f55fa8d636ae114b24291ad793d
SHA512 ab659f8465ae196df1d964edd256d9a2ed92837c47bdeead32d6d9adf07cc91f44b30102e249447559e82936279e468c2d8d3420a0bed786733f7df1e5c7dc6f
SSDEEP 12288:xeBNUbTVO86UQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:xJIUQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B05CF7BEE28FCD2C67A8DB95791C600E76278314F21A3CBD165824EDE235E04E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7fd32aa8a495d9d47d71e91ce892327e046122e33c4b9f5c5e18ae2bad44e3fd
MD5 4a7c962c36916e3362450a3e246cb6d4
SHA1 5fff86969626d0ddc0ac2d57ad2020de2b976c63
SHA512 f8c73d19ba44164c840f9a2a4eb54bf02eb583703442f84047c5352031b5d9248dcfdd6814b48c67b3fbb22281458ce840ef1e78d7204cab2f46f0951377cb8e
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:DQvGAdlCEL8c/yRNw5CFD527BWG
TLSH
T117266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cfccb6a591583a6670f64f7127afcf2d821e0223af49c0e232296f23acf293d3
MD5 7581b65af340620bbedfe79d9e8c75c8
SHA1 b01a696e86bd175b1ee80526f5cd099ec491675f
SHA512 783b0048e12f11b7cc3a99863335f76ab2d91df72053e991abec8b1e25a12ff59888c2c653b2db0cce37cf9733b65cc05b889d9408dacf7a0ffb499453255ecd
SSDEEP 12288:0AwSfxL/2Dc34DLLmt0LDQewsAjaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:JdewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B15E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a438d46c418325787aa571f0c3551b22a0710fcaf621a58fb2bbe9ef10c36ae2
MD5 019b8e16184fd645eb3443903d1ad710
SHA1 96b448200490d0f29040db01db63561d640fd1d6
SHA512 80937fc7b7dc630f86e41775e2ea0ba71fea6180fa390993eda255f2b5b874e8ed4ece61abe5ddfef88e6181026ccdda852fd113220df6e4bc5a1592694ab45f
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmVQBWG:CUEtQevvqc2W1cpV2EI325B
TLSH
T1CA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 87b583150b3a3ce418243aa09ae9be27378d4bbb8c733cb1c5d9b8beea65e662
MD5 5df232370ce20f53cdbdd190c8a64f79
SHA1 fc3c648811953868c8b929f4d52d67574e616ddb
SHA512 9b331f8ba0af517e04c04f766ca45ec84d07a66c741869d10919f82f2916e207a906771acd5f04e8d7e6df0b8615e8a8d8b9176dc022756567cfb894ae460126
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zODmg27RnWGj:coqtVjnmBD527BWG
TLSH
T114D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d4ba50a5b9aa50ba91e704d4ed29aa872192e14399ade90b7b31d9cfdf1098ba
MD5 e7c5bb0ed150859f0beadb82896bcc28
SHA1 4b2b2cb827b1fcaa941784b5f99283c97e748cdc
SHA512 add2c42872bdee5ed3e9f670e6c078a117d4a3899ca72d06cc4dd9260d3f39aa3916e11ffce4894a0de47394332555ba5aacb1a4ab33431230e346319afce211
SSDEEP 24576:DAhGLJIFoiwtA5l7S539sqjnhMgeiCl7G0nehbGZpbD:DAMyFoiq5RDmg27RnWGj
TLSH
T1EE359D81E7F951D4F5B3AAB899B69171E977BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1e795bcb37422fc32d75b969dde9b76e5501da7738b60c5dc71f606882faf0ff
MD5 2496b87c7c8ea7bd74409099c4e8e99d
SHA1 2d531f6386ac0eb0f3b08e04361b570a0b2d47c7
SHA512 d12e9acfa9f16f1258ece09dc8de9fcd43833d67a2ebca5741ce4746596fa2f42ef5f90339a8d9ebd64f5502e128bccaba62227c6667fbb157eb89445b676c9d
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:WwuoOWGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C05F15A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d01b6a3388457bc701fc832475442e7c2141b6d192b46399aa3ab78a2983ff4f
MD5 605ab441b3178c7e82d8a1ad3583b7a4
SHA1 8398cdd019ce8571a6744a49639078fce4be347c
SHA512 8191b9da529d5c4954ac4b1d456166e8c17005ad6a2f079e74e7f299c933bd85ef610f293f87f29a6ecaa1f9eba4cd175d651e9fb0ed59eca25f8e1804ed5598
SSDEEP 12288:2BZ1IyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AZu/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T145E412AE239820FAE563417CC6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0cc250b0d68d3c66f9ab0ea3fcfc42f8bc39627972b96c05f843936c2003c9cf
MD5 aab9675d95a2542053458afc13e29b4c
SHA1 c5c30d854c72b6457e7763d2b36e9e0996c01900
SHA512 c003ffa3d2d51f2ea601348359c84c96b9b300969315929c083cb84a85bc86643b8013a9dedca4c8d43671b8a4b2effd1efc2beec59252097a9accb82940c1b1
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN3ID527BWG:BQyiKayX+PN4VQBWG
TLSH
T1C6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 74e0fa3d925baee7183466697487c1cf0eb3cab033fb6d640acc9a33d6092385
MD5 0f85a197340dd1fd76291e7c6bca5c9a
SHA1 1963f1c35b9fd42d306aec9d48b51d4c0ba01562
SHA512 899b34fb61f871d8a6ce02dee9cfe44e049b7b64f07f36c0dba73b19abaf2e1d71246a6acf1d4f13f6701663f56fdda5e46d125357c2de3a960dae878c02c2db
SSDEEP 98304:sQRQyi36YOcPQLvw2gAf+PN3ID527BWG:zQyiKayX+PN4VQBWG
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 704e0b7e0844663fc9fc1138b1fce6dfafbd6d43451cad51a7aa47725643cac6
MD5 89400a4f25c90a92a712238db2e61845
SHA1 70e27033bb766506ddef2b9825e917f8c8751a3a
SHA512 69eda7310293a54b57040e5e389c837ae45c1eb811d914ba50179ad1f5b237395f9b5b6c20b4a80a8a662741d492504914f30f7a1da7649747766d1dc2a35c67
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0vsqjnhMgeiCl7Ge:m68Qg55nhheWu7PNU3/eDmg27RnWGj
TLSH
T1A2B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 58b96f7a87fa83db6355dcfe02b4cd05a0071a48f5db789d2769735cb9cfd6ca
MD5 1272c4ec88da024a79d848f8d93d8545
SHA1 b2c166db21ac42a402ed4a48eb94111f4ac73309
SHA512 7c796d39f204b3881c1a0f7f525b7711e5c98a95870aebac6546455de30088992a5e3fb2635be3cc27b3b9e56c0ea7b21ba92ac78df5040420fd9b71c5b996e3
SSDEEP 98304:my5112gYy5azzVvL69nLKnhZ/D527BWG:XLIHmWh5VQBWG
TLSH
T160167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2e6ec59408b69e79f2d96a6decab4729a8d14b860ec25a872c04c7cd8d0b19d0
MD5 52f80048971b45f35b9a427d2b5f9721
SHA1 3b252604b195a6257283257edbc396bf43986303
SHA512 e801bf5429c2f5c82b8158eb0b998c230c56131976f2f645a1b67ca9c7526d4f2adc7e7e1d6029d0ac8e893c7b5158187df7c7d06a33ad9f6f668c14da44d4d7
SSDEEP 49152:dB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgDmg27RnWGj:Du6JmVxd2dgD527BWG
TLSH
T109D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2873732c78a94f7fa0b08c12d5d98cf0ce5740009cba2fc8990b9150934adfb4
MD5 184ec6d3401fcecc1b5ad45869ec19cf
SHA1 f5fe320670b8a8b9108e41c2d4540e74eed3a8b4
SHA512 1c55c2ada2f34befe9eb6f170ad4f9015792c7bd1f39461a7fd1af7a99fe53141b6436591393f7c1b08e7d482feb1e904d04a1d12f6f6115869b6716900fc44f
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xsDmg27RnWGj:jmifPbRBD527BWG
TLSH
T148B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cdd9c327b6a95814e756f10cd38afb6fef1ce8386b73f1cac65d132277ffea39
MD5 9cfd341d56ae514d9c644f40f51df6c2
SHA1 371c9062409e066df7cdb5735573569197d1ee3b
SHA512 cb11d0feddbf9b0f55f015be83ec1229b25cc674c5d5f69262c8b109543389fc58650f7e1a5868c745c0c27b42d0029908c63371f2df068bf5b6e2711e01cfff
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqjDmg27RnWGj:l5dKTi61jD527BWG
TLSH
T1B8C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 03f01535fd40783589191f5eaef6c8ac0532bb74de027b05b46eb8d9095b8246
MD5 a23e9f0b16bb812af0210d1e2b58aeed
SHA1 d41061d857519eef096076782b40d54c45b34830
SHA512 f86fb8de2d8bef7444e477a484009a7d43cf0ef419079425e4818ed7c7a76801d456f4ead96a6b3cabe6aa66f76b0c5cc1559833b1d656a19bb1bc73e67ece44
SSDEEP 49152:ghtSn8EApI0figngiDn0AP5wADmg27RnWGj:xX2iyphdD527BWG
TLSH
T1B395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6235758b43851c13580ddd9f8783717279a52ba80459b8783db9fbf4ef518c48
MD5 f1b98573e060f9ec5c7c3f8cf870ee4c
SHA1 f555f4d0c0155ceecccb9b5384c0bd90a32dbadb
SHA512 9460275f53e14a2601bc3f8358e25c3e8e5761864458b9dfa8a49c26f49f8c4b9fe5ccbce1b297e4e6ccb5580197b028555c5fca9916e3cbef87b140781132e1
SSDEEP 12288:ZjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ADC423BE915C01CBE92244B5C3E5F15DEC173E57E92004837A9B78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9c87b4dc8b32c850fee31abe45defa90af5697e7bb451c32d3672c2367843059
MD5 f96ccd6ada2ba5eb6155e8dac322b24e
SHA1 4ba921f602e4adeaa22212991ed056a2102bcbef
SHA512 c296504a0d9adda3239c8b76902e22d16da8fd7552c8f472a7979f2f8f7e894d131fc1c12c009b5a3805a5d1e2a8f41fcbc51b0c5eb3aa6e3855614357e3c131
SSDEEP 12288:AOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F5C423BE914C01CBE92244B5C3E5F15DEC173E57E92004837AAB78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 47a44ac3c629000b167ac85ae91f6ee0074054c78ed7e43bf0812b7636882c7f
MD5 f4b88a952510c12624fd7ef9d4082d53
SHA1 e8f8208d5895efedadebb7f495f491b3f936935b
SHA512 6b4585853057016fd76e6b2ebd266339872bff911deac076f73956048ce94a5232300357270ff8a29e21e352909f5f87bb61b862216a40fc325fc623151757cc
SSDEEP 12288:+oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+osqjnhMgeiCl7G0nehbGZpbD
TLSH
T108C423BE915C01CBE92244B5C3E5E15DEC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a87887a0d10eefb7e71121ec03e83a9798cd9ce26ffdd3b9649cf1a7c3bf3d74
MD5 58d395e3e1cfdf17747a2172b4a802f1
SHA1 d04e19b380f8e4ed412ac396ea6d6fb1d39d8f64
SHA512 37c01d30bce725572dcd6316216393586c75b610e1cd2b18d10f9926acd9ed5e22785bca280bc6946c25893f1819e804e8f550109280d203a08ea40013e4de09
SSDEEP 12288:WVdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B5D4236E535C01C6D83285B5C2E5E11DE8237D56EB3005DB6B532CAE6FF26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0c78ab2d5560e790cd884a28253a5bfdb35832b0a6afaddf62a378167fd853cf
MD5 0c3070591d133db6edf254f3f31b3246
SHA1 ffb41fd665daf1d47770198bf34c9111590978e3
SHA512 3ab34c690a6a0263eb187e283b8a1104e43909af5963a2bf59f4d3e76863554b4b121a687083c66712194622d743d67d339c8ab611a97eac7baae8720740fae0
SSDEEP 12288:DlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18DC423BE914C01CBE92644B5C3E5E15DEC173E5BE92004837A9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ecef060b7817e6d2e93ed4d9dded2d2d2db2262d3097ec1c875c0031abfb01f3
MD5 b53e6a1a1b16240dab64613d9bcfa846
SHA1 3c76dd2aef5405b8596a9f8fc8a0bb926cd6eaef
SHA512 e3d2977e7d50aa34a32bca07c57d9b248196e31f1b75abb445f083f5a5eb25198497fefd585038365ece3b08cfbc5b6e32517ab0cc050c62db0b18da7114d1d1
SSDEEP 12288:nyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nysqjnhMgeiCl7G0nehbGZpbD
TLSH
T176C423BE914C01CBE92644B5C3E5F15DEC173E5BE92004837A9B78BAF7F24644B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 63beb960df4656e77303b718cae7f692566ecf8393e3c1c929d38c4211a38e56
MD5 6db65f1b26f915630f705d9add567927
SHA1 e2c84198ff7f552dc81d1d891b7384c9bb84b63d
SHA512 769e7973e8da808677583182d45227e910adb59fe3fa3c41e1fb1602b186551484ebacfcc611d296e44521dba9926dd15a75f39deb6671267245a3698bf2bc1d
SSDEEP 12288:B2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T169C423BE914C01CBE92644B5C3E5F15DAC173E5BE92004837A5BB8FAF7F24644B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 00f6d0c9f0056a4a3d188861eda620352f56639897458a36da8e39b810556740
MD5 7d8ab7d19c72568e62f312cd7237663a
SHA1 177d0077dd00dbd4386d9af30c236c5943aa125f
SHA512 d76077643b003d15541287ed7698b37e4d06510c480e97150a193eefaf3201cbb3dfa346c4d9a441a4d2352573bb51fc897aa8ed23511db644fded8f32fc0c42
SSDEEP 24576:KZMSzFVSOusqjnhMgeiCl7G0nehbGZpbD:KZMSzfGDmg27RnWGj
TLSH
T1710501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c7586589766c8e79537e8178ebe64d708be22424e5d5f3358477317070d860ca
MD5 aa82467b436dbcb35ccc727c6b9515ec
SHA1 ce546e0d8b96a30c61c83efb013c683ba36a81d1
SHA512 e41bcc9cefdc39b3f7db14d771968ffa9e5cbd85677e41ada4bc27eeeafb48eb2a6a42c963b3d677e12b2b3e3ab5a80d2a17d33c6693979378fe6a988e0a455a
SSDEEP 12288:oPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T160C423BE915C01CAE92604B5C3E5E15DEC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 08b2507db3333214ac0e9912eadf947caa9e3f408ce938833c80de493db919e6
MD5 9fbfaa386cae0f6c333f264026858147
SHA1 80f356bc8dae87178235436edce8168b93a0bade
SHA512 0bbcf204ade6ae5b697bc6689217657d669a09f853300e2838cf4738036fe1753927ad3c8df1ca63251aa0bfdb903cdabbf22ed4c34dcd88fd12ec51808a4cae
SSDEEP 12288:CbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T180C423BE915C01CAE92244B5C3E5E15DEC173E5BF9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e8eb37d16d14510f190463540cbc735b460d1fef58d4f5298aa54f2a3fff6ddb
MD5 4abe691023d821afc519ac13b91d83c2
SHA1 2bffbbf8a7018c087e61741642720b4d8774b514
SHA512 f89f154ac6cae229853569ce003f7eded14f836ff27aca207e7060aa0a9d6f5eab0221b6815d3d0bc37ce854841be4be7614e8ba05d43aeef20216139a48e2e5
SSDEEP 12288:WyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T105F4125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3c886223f65df8c525adb89163d3411c640753b251fd090c968f744b53c0cd8e
MD5 d015a6f9d91458261b40121cfbb045a7
SHA1 aec7ecbe7b7cdd58174174601a069b6ff93dcf67
SHA512 3d30f25715e660377c49927ef33e291db3e69eb58dae246d967856e12c4450c65790ac9626d13edcc40053ef4176ccefb3c6727dacf7c955d09598d6718da1d6
SSDEEP 12288:KPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T148C423BE915C01CAE92604B5C3E5E15DEC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a56334059a6999227b40d5e98fe422e307b7386e826d9cea95fe3e3aaf077f14
MD5 b808290b6c46609b60ba158eec6c25d3
SHA1 2304d0e5269112d6f053698927ababc814ee842f
SHA512 dcba481e9c9f1ecf039defad6473751cf7c8429ec6ac71d3ab62a279b556ec54269c8eda35ecb83236e9398f7698b1421af3abe21faf5df6fe24d30c68c307a8
SSDEEP 12288:JPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16CC423BE915C01CAE92604B5C3E5E15DEC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b7a7f95b5fde418f2c1cb5dcf12527e54e25d82efcd67daf70f0b93265654da3
MD5 09230c1715f8cb483cfed75890fec27f
SHA1 ea057d658da3e65ff05472b10a0d5229157d0604
SHA512 113c8794839474a39502201b89de661990ec6163e932d0a2d39b781150e6e3194df74d897434d3d1b64854582211f10fe454bf473c9a0b09a9c69a556113e54a
SSDEEP 12288:+yPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11DF4025B73A530F9D5378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7e004d1dd340b48f9db51ff5d618973228ab7ff15400a6e1372b070f667b0e6d
MD5 34e54c9c32321c0883fde561af1c6b82
SHA1 41a3bb128713a7e1743b04664bab4e84fe31d4bb
SHA512 d578f15b3e218b2a2eded16d0618b734374d1245c3bf11d15f5c70423100c3a35cc8a8b582b494d83b15ea105fa1c6834f1b267d85998b0aa4157476292e41a7
SSDEEP 24576:KTHaLl3z0zDYsqjnhMgeiCl7G0nehbGZpbD:KT6Llj1Dmg27RnWGj
TLSH
T1580501A9B35018F8EC67813EC965C90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c1ecc2affb9951d79375b9b1cd543040fbb77e5496cee3622655436a8659bcd7
MD5 0bb162150fab403f3f4f491a18cb5bf0
SHA1 cfe18685100e693c40b65b60cfc96af5583da0df
SHA512 964f66d0206bc5cfc41e34d547f5e58c23cb9f4ce46e99bc0376369d25f9a37e7dcb41603e1fcad4b7de29ce7a9b9133f901385dcd1044c3264bcf0d09ca8222
SSDEEP 24576:637d9CHKy7GZ8sqjnhMgeiCl7G0nehbGZpbD:c7d9CHKyaGDmg27RnWGj
TLSH
T17425CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d3158e33685f6fd8c1383a4ef303cabc5d797f1168450cfd2fc139fb7e9262c4
MD5 0051269d2278b849f5d3c74b30a734dd
SHA1 1b547ba659b76564d09f4f38d4eb06fa025d0299
SHA512 8cab296a30aa7b681486e251fc2194b93ca46ca6ac0f0c9cdbec6cf8ac904182abc9088961d7f0b083ed6d469d541a40c10ebf0560d0d1c63fdfb05d6440e7fe
SSDEEP 12288:5IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FAC423BE914C01CBE92644B5C3E5E15DEC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 1ad1ef90109df0a8c9967fa7757f47360aff2a21c88abbd6e25906e14e2c644b
MD5 4ff6dbfc7ea48ec144f6a101820336ca
SHA1 250ee2cf3cb5ef7251258cc3ad44bdef040e4db4
SHA512 765c737697991e55880159fde0c8260f8e40450b0442d5b15fcb906d9d2d04e42f7011c8cb7c3128094812cc36e719dd24e5f9c0f9aba41a050e1ea3ee4baeb9
SSDEEP 12288:kKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T159C423BE925C01DBE92644B5C3E9E11DAC173E57E92004837B9778BAF7F28644B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 1774c5151c830724f55da0efeb905b14a82ac451803d23b2504e0958e3381f41
MD5 473a0e252e30ec6592e75631819a9e4c
SHA1 16d737a695df68d397b6a63944fe785aeb6408bc
SHA512 68e8da25c83adca668a88bae502f055049182bd47c2765ffc78fd5756f874fdf6a237442f5a7678de3ab5e7cae6c3e66cf37bb773dfa323ee24ee83a4c949daa
SSDEEP 12288:GpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ADC423BE915C01CAE92244B5C3E5E15DEC173E57F9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b86fd8a8dd5bc360017a30ef8c735dd28637df46989a9db8760ef60c322c2542
MD5 96913ab475f47b389f3dd109b2e0cc31
SHA1 4ac81ce9d0ccc2587dd6c79b0409029ec338d2ac
SHA512 b7b168b8c1470289d6bbca31028b778fe4e485c7dde99ad960e04e82aa2b4755fca0d295e882e1753e631cac0cff949f127a127f14a29c809b7233824c37e950
SSDEEP 12288:4PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EBC423BE914C01CAE92244B5C3E5E15DEC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 5818a55d88891ee0f2556d995ae0800cc5cc1cd0d884337c13cae91b5f00a68f
MD5 cedb37ed485771e24accc0ddce4a95c9
SHA1 722e329edd7e35772f53bc4c7b716a7cffdea999
SHA512 da2362ad5d29e0813d245e79dcd2f8e233cab93e9f4b3f64c8ab9972665ad264107e743692bd2733f057a39e4ac32d58e248b66d53a2d25c95ebcc475b9be800
SSDEEP 12288:/IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AFC423BE914C01CBE92644B5C3E5E15DEC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 936bc35a4b1f784b91d62af2792ae99cac2d149cf26dfb8fbc125dd24428402b
MD5 c99892f22d9326347fc6fab524e42add
SHA1 9dba153dcb3453f1b8694022e4a2531f693bf343
SHA512 c1cb47541329fbb235193ec26e98a948635bb12f1930457449059feae8b0b00636d8f9b5861be45788ca9357a13e7e4019dae2cd1e60b0d80fdd929caa4070ab
SSDEEP 12288:bXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AAC423BE915C01CAE92244F5C3E5E15DEC173E5BE9200483BA6778BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 0ab70dbbfe70a61012602a0782ab14708c0ef56ae015d4fec100e988352faf28
MD5 a85b535935bee8d849e73a6cefa32e02
SHA1 38c17ccff03c32c57a0e465af31a4a43fbca1868
SHA512 cdb7b5740397ec9d0b2e5f8ea1f350818371d2784a3da7989c603b0115375490f24c7b3bb44bfedfec8fa21a312e656789b636fc9e4a219b003193746dc466ee
SSDEEP 12288:YlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T182C423BE914C01CBE92644B5C3E5E15DEC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b665e68929044bb6f6e2cd1abb7e67d47aeeae2ab409a08945552268fc8be8f5
MD5 cd943aaf34312f0b003006097755f61b
SHA1 6c4b7356bb21f1ded080309c54b816ef40dfd125
SHA512 9bb5b9100e302c7ba51e998da17ef2930850cd1f5e7c180d4785cc09adf6f00e0435fb56d537188bf62468aa494c1430d99d3fa360973a3f06b091a9fbdcb1e5
SSDEEP 24576:Nfwvok9RX6wkyAIrsqjnhMgeiCl7G0nehbGZpbD:LMnYIfDmg27RnWGj
TLSH
T19235D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d0c44a53160cc013d56aa4ab9299084b88217e2fb8f4ee65a885866bc5957e42
MD5 51834f783e6872074ec235df878f31c4
SHA1 10316c01973470b18cac569ee4f2c028f88f4e10
SHA512 af51857147402fc81b3e71a98219981b0e537d3d8f113c6c4e2546782f03512a67aa4aded72bbcdfbbe4c1e93076e2aa8f862401ea600adc42bfae275ea5aa52
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gDmg27RnWGj:0ySzPoD527BWG
TLSH
T1CA066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 91c278e01664d870b9752bd9f9472d78bd4dbac00c0abeeda2174f95d14c7282
MD5 7e3545ae054d05ee6b21cf303952242c
SHA1 21a69f7028ea23c30ac13fc6b7bb0c6d6ca55676
SHA512 f6476e173ad947538bd24c4cedd81a2a6561f5ffa4f658e0cad08edf793f1018a1d40635ec6da8bf178f34a9fbfb53d3a2bf98617ba3bfff2d610fa7ce50b8c3
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+sqjnhMgeiCl7G0nehbGZpbD:N47JUQj1irIhCnDHUPfF/wDmg27RnWGj
TLSH
T1F765AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 15ff569e1d98b8c555946ff4540d049a830baaa788185cd549547e6b940b659c
MD5 9d247780a86e621cea12e8800eac95e3
SHA1 d93921425ab88277bb220a886e926e943946b458
SHA512 ba3dcecd6b4d75f4668e567b63cde468869498d42ebc99feed48a6a6faac94d802d90f39f7acbb35ce2a4a305a47b86c9adf0de34028a367af069cb204094163
SSDEEP 12288:PNsf/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbED:s/sqjnhMgeiCl7G0nehbGZpbDJ
TLSH
T1F6E4015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EFA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 bad7e6c2cbfb539c83f4a2a7a0da902bf9eb9cf9dae9681ffe213fd714d0d128
MD5 b43980c3e749393be42b33952aff144a
SHA1 c6695180213d5fec5aad9f681208687b4cc1f546
SHA512 fc1801806d5158d85a85d2126571477b41653469ba0be4b85ac0a798824ac010bd20d6e959fa7665880f7855c197ae24e3047bf271a4f7fba030028742626ccf
SSDEEP 12288:ajCQZy5DxW/hfa26NlIJagFm41856OHfOghL:aXZYIVuDem4G56O/51
TLSH
T110453940762BC75FC6A940326E33D6CCA7707D05EE456B0372C84B3FD576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d8462198d24a543b0361557f21c2446b1e21c45bf223d2fe1a0e861005448ab3
MD5 650835bf651f2ab2fee4aebc2099b56a
SHA1 f617a288c83ce0aae8ee55c55079df9cd0a10709
SHA512 e7cdc87887c648d45a86a6d2b8538b1bea49eca163246519ae2836a2029725488156d3a6502261831e372810ad9e83e59673209216b61c56b02c7d189e12e960
SSDEEP 6144:DgjyTs+JHF1E01Exw8/VKSCcDxRT9XezV77riPi2KDexH02KDexHz9EknqqN6+2n:YX+JH2w8/VKSCclwfPG9NkXRjU
TLSH
T15065F9819537A3CFD1FA607203365B4DA764EC0777096F26B388053AD86AB25B4F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d3c4b309495aa3fc6fc887426fd374ee0656eddd166712902f9b274102239365
MD5 601792f15a90ac43e8ca60b787413608
SHA1 64984ae8d1cb0de0e6913f10f99420898dc38423
SHA512 6c2d6b79fb9af96f357e7c6ef61186133297231736280f603d2b786de1ebc3bf8eab292fde401c9f30f263099ceb6c204b417eb779a240edb4dd3b36107b7bb9
SSDEEP 12288:YM7HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13DD423BE934C018AF83605B482EAE12D681B3E669F1044C3BA5779FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ae1d1fdcd093d10b6e3dbc8735655d5a6a31a25dcf6b48c3268d06bc237a8a81
MD5 852302720161f2c3f47c91e75d88bc05
SHA1 80057275081d3ec062bea23c25c87a1c98cfdbcf
SHA512 9798348ec8e3386603f317682297aea481b594f262386ecc3505f26b101f163f80ef0d6348b6c01ef2d9c461ad62d4303bd1f8b1fe0d0b9994db952d3f95feec
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYhsqjnhMgeiCl7G0nehbGZpbD:Rgb4mBIBhGFSDmg27RnWGj
TLSH
T126659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f460a6f888db57688ad9b277064df57dfaa5c813619ca9b64209e85c2fe3dd6d
MD5 c691dc49a1d2f72d1d41703e2cd75394
SHA1 5a287abc451883a0b9117c747b2905980b477e98
SHA512 2bf8396bd58fd07f1dc70597e653c0ac88b424964e64466b16b9499b7772d0ce20e7b04b8004fb50b761b5a4310e91a5c530210dae503eb008e0cf7687b68b53
SSDEEP 24576:WG88u8FpJqH1bzria7/musqjnhMgeiCl7G0nehbGZpbD:97ZFPqVea7/NDmg27RnWGj
TLSH
T1AA35016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 96f0f19725f47657c631a9ed6b76516766b560f962cee0e946623950688a910f
MD5 cc083c8e5b0e7b7f6690be9fd51bbbfe
SHA1 383991d87160127354001c49cd150ab13a0af2b4
SHA512 93d6c3505b3151b35c19f81cc04b66659de8005e346edeb7d460a1fe597dae8314e062fe0e1185a2bdc8645e1655166be7a2e26b5d287083cae17e3689c635e2
SSDEEP 12288:zHvUrBFrEjwaQCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:zPUr+NQCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E05F12F62AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a840b44d90b3b9d9ecd5dbe6bb0b57fbb3d77dbaac2a059f7c9f744b8a99eafe
MD5 928801587a632740c57356d98ef2d8ab
SHA1 498d678cbc58f77b60c5e14c6b1102fa9a1bc212
SHA512 9745c0fbeb420fffc4bf7c713159067c5b8278f3163911004158c52570a0cad352ee833f9573c462a5f69887ec9d9a195de47e466a27d6ebfabc1bf2ad774e88
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2Dmg27RnWGj:nG05lO43b3D527BWG
TLSH
T188D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bebcc4e40cbce512382ae18fd267713038a6f3b321e7a3874cc3194f9e022bf4
MD5 8e6ff4e0ac7a3a80221b68d28a695280
SHA1 0a00acf9988418e673cac3c7d8b853baf730d0d5
SHA512 b2d1b5bfb3f965e66afc78d8c384e6c7de9b1c09d792672111e4185a69a99ffa6203fb3f98dbf8c79c6f9a0981ff8f19a96ba9e263d1a28203aa5bea161dbcbb
SSDEEP 24576:Ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidnEsqjnhMgeiCl7G0nehbGZpbD:Ma5POZ3+Jt2pasx2+meDmg27RnWGj
TLSH
T16065BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4699431b3781db4f1967fd4ee5356a6a636b4ac6c856ca965727911179740769
MD5 f0324c641976f0654b479701e812327c
SHA1 e1dda5e0dc0c8947a3d9b145b236b5fc3b515f98
SHA512 0f619e369fa6c8efda1b9b68d007ef2482d6365e78716cc047f5855debb7e9150032284dc97fd383d798419f89bdddd515133b4eb8b4a6eaad4d546d7cc67b52
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkmsqjnhMgeiCl7G0nehbGZpbD:HNc/zEOVHFtDmg27RnWGj
TLSH
T1F0857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2311a4e7261106aca743290b35463bb8d78505ebcbf832b4dd77c124dc1c4092
MD5 ba42680aa54dac0b54efc931fe5511da
SHA1 1728653ee637505937cd58c8986f63174bcc363a
SHA512 8bf7b79950fe4a6a01fdec5db4ccd1493ca909e656706f8cfa9bcc74f1d8e52a813b1f826a80fc6b2e45db0a05968e8c2cfefd9b0065993614ec08be6eecc6fd
SSDEEP 24576:d8kNvNnaFeYhJNtmZBmosqjnhMgeiCl7G0nehbGZpbD:d8MwBtOmUDmg27RnWGj
TLSH
T1D255AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 b92ed404dc1a7d8b920bdcf21ce29be0b4ec5b52bd12ca72be8df3c3f55abc2d
MD5 ac89636e8425aa61c728c52f49085564
SHA1 1c3a5c558c5553418c9abaac1c00d50926828509
SHA512 a8ada82a5bb7cc3854f6259b7448959d703dbd62ef4c04801563313f8b8944155da2f311221af9b779305f167283de348748cad46b0c5e2fa53b7c57f2757949
SSDEEP 24576:3D3FHshBIYQgADsqjnhMgeiCl7G0nehbGZpbD:3DVHeBIAAHDmg27RnWGj
TLSH
T12E25E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-86-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/52-87-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/52-92-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/52-318-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1140-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1140-338-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1140-103-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1140-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1140-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1140-96-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2256-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2256-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2256-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2256-182-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2344-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2344-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2344-142-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2344-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2344-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2816-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2816-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2816-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2816-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2816-322-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2816-115-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3024-120-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3024-122-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3024-128-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3024-321-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4076-19-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/4076-20-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4076-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4076-8-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4076-0-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/4076-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4224-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4224-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4224-59-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/4224-55-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/4224-49-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/4824-75-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4824-317-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4824-76-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4824-82-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5044-30-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5044-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5044-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5044-132-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5196-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5196-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5196-70-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5196-302-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5604-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5604-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5604-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5604-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download