stealc | 12e2541a7800976116a9eaf74bd2cdfc122236c48a9645329b60f6f10465148a

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.1MB
Sample260915-1awrdsha93
SHA256 12e2541a7800976116a9eaf74bd2cdfc122236c48a9645329b60f6f10465148a
MD5 d7efe92714bea25994af96dc32391a05
SHA1 a11795eefb9e12199f71a9bc3501251d88efada4
SHA512 f699736496480cc389788fb3e54c1558ba41b4967399e592ec93257448dae136601119a37e747d7804aa4e9e378c519fcb12ff4e65097028bd4c79055dda4d06
SSDEEP 49152:EVgp0aP+gsDsSttrCMOvmdGVagluIdnyDInjUTQcCh3hnd7PAyTbgHUWrOxeHq/v:Jp0YzIDI4a2HUMOl
TLSH
T1FB167B1BA6B940F9C0BBD1798A569617FAB2780A873197CB4791471B1F237F09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4132-22-0x0000000140000000-0x000000014042A000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
3488	elevation_service.exe
5928	elevation_service.exe
2508	maintenanceservice.exe
1376	OSE.EXE
5752	PerceptionSimulationService.exe
1784	perfhost.exe
980	ReFsDedupSvc.exe
5676	SensorDataService.exe
2040	ssh-agent.exe
2960	AgentService.exe
3828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3402abcb3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063a4ff095945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fbd52085945dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a88d43095945dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f412ae0a5945dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8317f4b5945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce797b4b5945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b11bf085945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004809f1095945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4132	2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3488	elevation_service.exe
Token: SeBackupPrivilege	980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	980	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2960	AgentService.exe
Token: 33	3828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3828	SearchIndexer.exe
Token: SeDebugPrivilege	3488	elevation_service.exe
Token: SeDebugPrivilege	5928	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1840	3828	SearchIndexer.exe	98
PID 3828 wrote to memory of 1428	3828	SearchIndexer.exe	99
PID 3828 wrote to memory of 4588	3828	SearchIndexer.exe	100
PID 3828 wrote to memory of 4140	3828	SearchIndexer.exe	101
PID 3828 wrote to memory of 5972	3828	SearchIndexer.exe	105
PID 3828 wrote to memory of 5404	3828	SearchIndexer.exe	106
PID 3828 wrote to memory of 5820	3828	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-15_d7efe92714bea25994af96dc32391a05_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2508

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1784

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6402f032981b34653a7df175b970b8433118dd3e0c89d598a19a7388cac3c4b8
MD5 d2ba4d4510c4060dc2050b19ce87c451
SHA1 38d0e08ae274af9e32c3a722b6ce22eef0c36d48
SHA512 da398dec771fb526859b87d8fedaa210f88f628a0595b59d31204daea34fb49d766af92852049697bc87b18f92e5889d73a2c5e9261f170bc1e051af2cc20269
SSDEEP 49152:sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxndUWrOxeHq/HP:W3q6mjB8UMOl
TLSH
T170D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 12e9edf856b72f8e5bd59a5c17392950a6e97107ee859507dd9d9e46a97a60ad
MD5 e3cf7b273ff2918e0272e2ea06b6f40a
SHA1 33df504baac7b0b581bd04c0f2fa81b578929028
SHA512 11e6da07a46daa6ce9fa253bec52f555980b239882a0cd0009d331a342f9193e1de069e45817d0cafe8273fd4e6be318b8203adc9a4360207cfcca10d56c13a5
SSDEEP 12288:a1XLsswWkxy2lRq2czAYxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAK:wXYfDtczAYUWrOxMkm3Hq/HPW8+KjQK
TLSH
T1AE75F12973E008F9DC67817ECDA1C511EA73BC9547A0E79B03A496291F233D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fb0054e5cdf1cc9c7b2a11d5deeb6ede14a3b683112424fb385834eefbad7608
MD5 51acee11337335bf71c4e737bdd2f596
SHA1 20154c45e5a7a2433051d5d81d6af78e61552557
SHA512 08e2f66fd26b66a28aeeae543acdd6fff5f6a94b7fb63a5e3a7c0991c73d3b24bf940582039bcb389b0041eafb10cac654005c95be6b5cd62df85ba6764865f2
SSDEEP 24576:n0Le5ji0hmxhrM1UWrOxMkm3Hq/HPW8+KjQR:nPji0Az+UWrOxeHq/HP
TLSH
T1AA959E16F6748335D073C0BAC5D2A68AED7230855B308ACB4286D77C6F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 57ed5ed0b09cd125a63a8905c8e2a39fff7e4168778e9a99be142eabd3cf0f2c
MD5 70c5dc994b91f6ee73e9c868b5db907d
SHA1 5ee7bac2eb93a7609d528c16770dde2a541e2386
SHA512 a70bd17809a7927ecdaea7f75e5289d8ffd2a66d8e575be86dd6e93b87f9f7856193acc7cfa1629c7095f9cf397784378a051c9faeaf98873fe9bcfb8665a54d
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWj6q8wyufUWrOxMkm3Hq/HPW8+KjQ/:E/ezSC6vUzPv+Hjy6UWrOxeHq/HP
TLSH
T1EB755C25F5788323D0B2D0BAC5D6AA9AFD7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a479393cb9d499ec8509f7a7c60dcf2fc4c3560b17d37af95b0b75a3a796f1f3
MD5 c54ba5928e4099deab2b786fcaac7b4d
SHA1 096d774cc8a0c7705d760892746971855a2d5495
SHA512 aa6dff39db7f7606c978c6df7329af7f4a100c9a41b0dcb8a15b3e67343b8796636ef267c2949edaeaf1e1b507161b4d8b864d739897de66268f1bfd2984ee1b
SSDEEP 24576:CVbqPb88hv/l+BsUWrOxMkm3Hq/HPW8+KjQG:CVO88hXl+eUWrOxeHq/HP
TLSH
T17D559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 ea94993c7685bd2ee850669db26d0780fdf04aa69cb9efbcc59890ca665c8b30
MD5 721d8de60e6449a9ff8048f3b6087f3d
SHA1 e1480602000cd1128d9812a1f5c74a84b8b42dd3
SHA512 4cafc284fc54bc733a07d478b543757e122ec92ae4cda97af93ce10d6cda9db2a083d4f62ff3ed047b7a2911b6ebe470f42ed5167e8b11d2c9273c23285a6847
SSDEEP 12288:WG5xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GA:WG5UWrOxMkm3Hq/HPW8+KjQ
TLSH
T14155232A4260245BC507947BAFF08D527C6BFCA87DD1C9175B21B34E8B262D0D7E6B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0cb88d327a9a1c1444a2deb8908019ff0a97ac2301f7360d16e577761cd36109
MD5 6b09f126cce22b7e432b090ea531ea05
SHA1 6b3312264ec261b74641fb229e5091b35d07784a
SHA512 8cd1896c82823777da40f27471b4b92ead4fd86f2faacb8ff8b2bc743547da6898b346b7093768ce2b52b5c13a7133e3df18d84d2d7eaaf584c34ba693ceaee0
SSDEEP 12288:DeBNUbTVO86UExeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAF:DJIUEUWrOxMkm3Hq/HPW8+KjQF
TLSH
T1D475CF3BAE28FCD2C27A8DB95B918600E77278704F6293CBD165830EDE135E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 579fe0d3b8a339b7d70705e59a73173850b272c7f9b23af216fcbb192a45fd3a
MD5 61d640c91b6ae2fa5dbeebd28df58543
SHA1 313449173c761e0ce4743d8d6c79e0759f85d492
SHA512 cf899d92d0a02897313acd0d7baa0fe7548a809537557f118312d2495f6f664b20211cef97b10e0df77e50524136f6836f25a8eea3f065607462d6e00f602153
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THb:uQvGAdlCEL8c/WRNw5CPUMOl
TLSH
T131267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d0e53868a6cd94968d5a66b526f98b4473cf3fdf32f241b50fa02de1c2f14064
MD5 c32878f27b1fff121e4b36354f8b4395
SHA1 87385e07e78809ffa77a92cf3a78a6df85d5637f
SHA512 8c96c722bfc59cf8b846a0addf29840ec42c519d46256902e5df6fcadf6bd9c05ccae88d1003c643e038ed2bee6d1e92dcb0fde5fec538f9e5d268fb48ffe680
SSDEEP 12288:mAwSfxL/2Dc3mDLLmt0LDQewsAjuxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0Q:7fewsAjuUWrOxMkm3Hq/HPW8+KjQ
TLSH
T19C75E031FA74E036C67B0DB61B31C716287DB9604F9119C3E3A89A8E5A302D26776F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9fecfd1822e0ad17d3c5c034d3d4255df1b156c33c382289f2f66e5b1b2778df
MD5 94a7a9e2d2f15f3963e2c1acb9b6c040
SHA1 32d297322ee107e0887fbe4df120d501823d8f11
SHA512 c253ea071970951b8030d2427a3ba8a627d351c021a38e915291ed7005af697e9f1ac3661146ed29e00fc39043f68644a6efeb2a86a94a0f8064f03ed3e8cd91
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH/l:HUEtQevvqc2W1cpV20I32
TLSH
T192474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 85dfe19d229a209e61b1cbb88d34a06ec5a8b1c259ec0e385f8007082850188c
MD5 671913bec15d31b273598cd72f0d68da
SHA1 b6bfd50aac542661480b0e45f241c612dbe68bc1
SHA512 279d952bf270af972d1db1257b7fc8b8c429db545705d40d1bbb73177f50a374f0dd6036612565fa20f1535ec53cf5786614b4115aa635e6cc57095137becff7
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/zOUWrOxeHq/HP:hoq2VjnmbUMOl
TLSH
T14BD58D1976B8C1E4D1F6C77886A2C647F37178154B319BEF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 761f75becd9bec5ce80073e4d413c59dadf6eac57ef4631dcbfed4a3f83f4ead
MD5 d51e28e176a54e2d75e5f70dcbf1e766
SHA1 673014c508ec3b85f7758369f0c2630d5b9d7ef4
SHA512 7167d5d0e65c487ba95a870bf50085d51f9176004ae613a12c7080638ca87ba02a8dcb89dee2dcbbd2d2935b4af4c9d3a7f37eb446a18e0c9eab2e5cb82c0520
SSDEEP 24576:wAhGL6IFoiwtA5l7S537UWrOxMkm3Hq/HPW8+KjQt:wAM5Foiq5LUWrOxeHq/HP
TLSH
T14F35AD81E7F955D4F5B3AA789DB68571E976BCA95E31C20F2260D20F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fff9e8f2e31506c686009b44a8337048bde3fcbaed04cb8df51b0394861fd9e6
MD5 d0c6166f3c29f90bcba00f8f5a5d739e
SHA1 3da6d8b8df0847ab1c95bb99a3f84cfbd86c299a
SHA512 5fe372324c2cda0e040dec662b923e657c9a22452999d54db364a70273fecb21de8b61d42b75da4c0a392710f2e1a838cf1b516752631a50e9a9ba1045b876ed
SSDEEP 12288:pmw5HEjsChNEBFgl0WDm+C/xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GA1:kwuROWaUWrOxMkm3Hq/HPW8+KjQ1
TLSH
T19475F14A72A41CF9E967813A8693C536F7B3BC112A61C71F1760C75B5F23361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cba29a6465b2b255ad472cee1f7164f43d7dce72c2d31b51e0c5b2c28858d3fc
MD5 9d496977ee6d3bd5eb37ebb3810886aa
SHA1 0ce7ddb9e8ad451c89dd4422c6d22acbc3d37dc1
SHA512 840a2c4f00e99f5093b2ef8a303edf460e0747955fab565fe1c99389cbf7fa2de3b19a6ad44d6017524eddfc1374679c68300faf117651d758f7d2a2c60967f0
SSDEEP 12288:EyZ1IyexeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAi:5ZuNUWrOxMkm3Hq/HPW8+KjQi
TLSH
T1A165125A23E420FAD153913EDEF08A45EB7278A5277283CF1720535A5F236D15E3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1840ee0c7b35a8f617481af601265b4e8fe0209ce79439f97058568696cc9efe
MD5 b5aaad4ab6f54ec3db881aa9b243cb84
SHA1 622a2e3b566294ff57e47627b3bde2cef013db45
SHA512 95a5b3fdb7dd741d446390ab27ec526003496807da2aa4ef0c1ceaa9c6ec26923ffc0810f08015247f7f83dc825df18ee90ac47ff73d5df1ce5b699f66c1fb54
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U/:mQRQyi36YOcPDLvw2gAf+PN3wUMOl
TLSH
T1EE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 72df232ef46525826e119dc4eea15c591f92b283ae11c89de3fd22b4b6bc2d97
MD5 656a36614356ca95cf6a923cda9ac05a
SHA1 eda1d603459070d6c166d27f6c687aaa0c021767
SHA512 0af8cad1e0d57f04e9b518c7d6a11b36dee92b1c8d2e2bf4a9546431128a8a10fdbd55623be743868e16ed49c52b5d3eca9ce07f47c7bb06db3eb74f7f2f703b
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U/:XQRQyi36YOcPDLvw2gAf+PN3wUMOl
TLSH
T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8b5ca26db78dc00dd156bf15cdaba02ab14eb672ef2f6307f69af6bec256d5cb
MD5 bca4deb0dc03ddc200cbfb341f38ce31
SHA1 5625a61986c39b70bf45e36775cb458b6a400d1e
SHA512 f3e77e24c6548489cb7aece120b83949bfeaaa22e8ec993df24dd83c94f4d1b10ab97b96bb891b5f1ae51ee7ebee093839080f8a657771fa9fc9bd0acb90b1d7
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0dUWrOxMkm3Hq/Hv:g68Qg55nhkeWu7PNU3/+UWrOxeHq/HP
TLSH
T130B54A33B2F600A9C44DE1769F46872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 89c3c64e2fad79b1c8f620e378d03ea0ad407e3131be8fb450dc8fe3814d540e
MD5 4e50164ca410fffa41df7b2bcbcf05f3
SHA1 179336a7839fae1845e723571d6d2bfaff039bc9
SHA512 d8820513540b9f98fc2025d7c30f933f190db8aa8201b19fa128da89db9e92e7d9555276fd902b35a949f31e0af2c9650feee1224ae5f8a8d652977263ab252f
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99l:ay5112gYy5azzVvU69nLKnhZ5UMOl
TLSH
T121167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ca98279847c18b752d4d91ad477ee6c66cacc1b9e799d558e982feb82bcc3988
MD5 db70d63ffba8dd477662c6797b9e715b
SHA1 b5e13245eae27c32980bab22472b718455e6603c
SHA512 415ad84759bc7aee647ba2eecbebda6c330a5ef935482030d8c36e2f0cf55698fcd015af87b801b42a05a52c7631b2697e8f9b5240ef9ea87ab4949ab1bfb33e
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glHUWrOxeHq/HP:Ju6JmIxd2dHUMOl
TLSH
T177D59D13F1DA01E8D06AD479974A9233F962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4aad822dea7e64b177d3adf7db7f4ec9aeff0b8baada8020cc1d87d15d8f838f
MD5 05998034558e46bd41c7def59f905f7c
SHA1 f0293f895d9c5df494b72e5ba83c858e559f6d76
SHA512 f851f64a1a469d0b477231e89e334277e18327c94d669487a8ec4eff98877c74926890fa181510ae6520a312e1324b2b326f496933dffba2a7d7cd18829d870a
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4xkUWrOxeHq/HP:amifPqRbUMOl
TLSH
T1DBB5BE13F2D900E8D05ED17987569232EA62BC460B30B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b656a0ed8d736b35c902c144d63100bd9417a897465103f77906eb351bc3a0a0
MD5 0f0cedef9037a545b2b802c7fb917021
SHA1 99d1cf011bb50834cbd4ea9bb3a56eb0dd9a1752
SHA512 3032f5e6b768a2dd1a166d72b024b12f87c277515ace21522de06b30a34280c3f21f9caa0cae066b56dee9d8162b088f69fb7fd67932ae37e0573e812bfb1d84
SSDEEP 49152:pSuZQIY0Be2KkRVtOnks6NMHqNUWrOxeHq/HP:n5dKqi61NUMOl
TLSH
T164C5BE13F2E940E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 74c28f71761ef4d351b01991f9f6dd8506b1f541da99335eb0c0bacffbf4a3d7
MD5 c89667f3807bafcc427e4de3a575a02a
SHA1 e9e164b29aaa268f93322f4180a96bb174158d63
SHA512 1c97bcbfc3fd3950bbdcdf29837714692048f8c895c3ccfad8beb5e89a3963c99cbf28ba88fbb91ed7e427393ef5587a67eb51ef9b972b9e39c1f23b24d699b9
SSDEEP 49152:ThtSn8EApI0figjgiDn0AP5wYUWrOxeHq/HP:SX2iWph3UMOl
TLSH
T12995BE13F2D900E8D05ED179C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 bf9f13ade6a702d169ecdd761feeccf10a03af6ebbc6b13e8c561bd1f8242da3
MD5 be6ca479101698bd9ece1c43b36c821d
SHA1 b4411db73cb910b557839ac4356baa0a90549229
SHA512 0fa9e1fb0f709fd8252c95288d9b67a1ce55ba566692980e660b541309ea9399fc8f948b12fafd5e6e1d4bcab6a23d188b6cba7caac014d9176e113837e5ead4
SSDEEP 12288:NRxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAQ:NRUWrOxMkm3Hq/HPW8+KjQQ
TLSH
T1C555232A55A1145BC406947BDFF08942BC6FBCA97ED2C1577B21B30D8B022E09BE6F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 48d743b2d27c38fae6df5a46bc2cff6a4e33a6b2202473dab5c03fc7a887075d
MD5 6899c5039dc6f2549105af2b8664c8b8
SHA1 9afff082df40db807871b354be71d42459d13dc5
SHA512 d88e9aecd89637f821802a67ed8647d5796528a411c4bea95a1aa8640d90b39268e54533d9fe2592db447f585a8490f00fb1cdb20a08bdd8eec78f1f6ca317d7
SSDEEP 12288:FixeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAQ:FiUWrOxMkm3Hq/HPW8+KjQQ
TLSH
T10B55232A55A1145BC406947B9FF08981BC6FBCA97ED2C1577B21B30D8B022E09BDAF47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 49d298b7e6e1c93f3f927a54ad502080111f1fdec97bd8cd2f987d78bf2db6d1
MD5 6407078e9ffc23c02bc70768ed6a1e56
SHA1 248949a070e3aadea458891874c47a2bbccffc80
SHA512 bb9bc6c379995613fd3a8ccc9666784be74e282ecb8819283afac55081d28e49f82baf6452988c6676a4c3da7eb79d7104676a2b29f7b01eb3154639362bd8ee
SSDEEP 12288:R8xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAk:R8UWrOxMkm3Hq/HPW8+KjQk
TLSH
T16955232A55A1145BC406947BDFF08981BC6BBCE97ED2C1577B11B30D8B022E09BE6F87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b10c2b79a6dfe54ae1540490c9f223b76c916f52e0e3bbc61dcb27861a6644e3
MD5 2e6cf38fff48cee801f1a2b77ef907e3
SHA1 e0f0824928a4962603313cc67e49a0fd8ee7db42
SHA512 ddb1446f78ca657c4b39088097fb4c4962eeb0f841ffd64024051dfbe36153b42c4b0ef904e2b187db3994cd36ca8dee349f9e8efe118daac58857fa92bb361d
SSDEEP 12288:nVbxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAL:hUWrOxMkm3Hq/HPW8+KjQL
TLSH
T1DE55232A16A510D7C402D17BDEB18951F8BABCA87B72C69F6B10530E4F123D0ABB5F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 bc40fe8d1f30bca6682ed13052311447c9b9a4e9078dc42ee6c433574282ee52
MD5 a6441e418d92144b09011ccd3f6f0dff
SHA1 cf93f09fea1bddd7b1b7191c5131c2f770e7790d
SHA512 cfc3c146fa7e55c310d0312c2d8c55ad3c80a795b64ee5fefed0f2640d84db6f5c9c28c99b4486627d582dbeeb0d4b8fdf8ec19fb8076032da7010338b415b0e
SSDEEP 12288:GDxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAi:GDUWrOxMkm3Hq/HPW8+KjQi
TLSH
T18755232A51A1145BC406947BDFF08981BC6FBCA97ED2C1577B11B30D8B022E09BDAF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 e969a515e31048e2d256858963a538c45840c477baf26c1731e8fd7b3e64f36b
MD5 08d79081fe0b08cc6a9dd91f31e82842
SHA1 c999f816878356e3d010e6d59055cbb91ee4eb3f
SHA512 896814f2a3e04765019c2646d56b001f1e199c48c1843108d91ffaa951bb220006e3047a7a4d4a04ea45ab72644c85f4c9ea29d5d2bc86944a0904a16a3acb38
SSDEEP 12288:dmxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAi:dmUWrOxMkm3Hq/HPW8+KjQi
TLSH
T18D55232A51A1145BC406947B9FF08985BC6BBCA97ED2C1573B11B30D8B022E09BDAF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 a6826b93a95823812c11c25bdd436d9931afc2f078eb1ac036265b6ade9a73dc
MD5 113c258a4338d7a882e185d9c1167814
SHA1 77cc0ccb5e65b3ab898aa1fdfcff03efa8811435
SHA512 024b11598bd5e06264194697141a476ca3b47f35395fa94be582b08f2e11c40a1bfed59d45cb7007861b7cbad25d2e27acc545a9fdc4243abac3a831cb4b01d5
SSDEEP 12288:/qxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GA9:/qUWrOxMkm3Hq/HPW8+KjQ9
TLSH
T15555232A51A1145BC406947B9FF08D41BC6FBCE97ED2C1577B21A30D8B022E0ABDAF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 278a2243e6a73d25d887eebdb7eae647be5cd51fc217dfd13087b2b79de6f4ce
MD5 779fe3781f15a680fcd910e98cb8faef
SHA1 cd525494f8e30d8c5652c26035ccb354b2c8bebe
SHA512 414bbc6673a5531ded0c8e3329e46f029f2066bbd0e7971fdf6f2b6e622ad6254098a0a2e901a4f7ca6a5afb4c9f7728383dc7bb34d0cbdd1e7408fed8982bfe
SSDEEP 12288:+iZwbDzzFEoS2cPvyCxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAF:hZM3zFVSOCUWrOxMkm3Hq/HPW8+KjQF
TLSH
T1D475F1A5B39018F9DC67813FCD618906E5B2BC591BA0C61F13A4362A5F333A11D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a5649a00a4e14fcf8cee9ee64a49229b5433f44af4a28d9d0d0e4ab16a191fb2
MD5 596bda23c0bf4891fa719307b03077cd
SHA1 00c9d7e48fb08b018012d234a95aa5fec132ca8c
SHA512 02cd3ed376a067269653cf7dce3f9bf66a008e21f4faad21c2b5787947a51f9c14d7532cd69f695aa51b4587a852314c06cd772fa4233ca76e0c92da349afede
SSDEEP 12288:K9xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAb:K9UWrOxMkm3Hq/HPW8+KjQb
TLSH
T12B55232A51A1145BC406947B9FF08D81BC6FBCE97ED2C1577B21B30D8B022E09BDAB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 dc46b8490bc9dcf0f0d38bb3d1f10aa464a40aadff0782027b3e748366e1b0ac
MD5 c4897b736ac5d9a85a1d12d656b521eb
SHA1 b803c80796035f4a5bf283f129235ea826172225
SHA512 8fb11d210645a658c2cd3f49355317ae36f40e0569438a8a00571c58807a15d69d39122814538389d55709d0685d3b9a02f68611595498de3d40e98ac063e04b
SSDEEP 12288:WpxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAA:WpUWrOxMkm3Hq/HPW8+KjQA
TLSH
T15755232A51A1145BC406947B9FF08D81BC6FBCA97ED2C1577B21B30D8B022E09BDAF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 db1d32980ad49b233ebad7edcb78167b092dbe6c9c210e1dda1094f5bb9aade0
MD5 cc6b24a9b616139c13b3843a446695c6
SHA1 217346f16c31a9a17ae0c4bb70467665dc62da63
SHA512 a40dfd377ed079adcc5e7c3440a4306fd4aca50f680c5d1166c2cd168b2f51712acb15a714d7a292b213ae194a65814e472b66ae1e16c379e2641fcb96a21357
SSDEEP 12288:fyPz5L8exeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAZ:SzyeUWrOxMkm3Hq/HPW8+KjQZ
TLSH
T1C065021773A130F9D027913ACDA14A02F776BC751B61CAAF1760537A1F232E09E7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 d426dd19a8dce8ef86ff999edef0c166694620685fe0c345c95fcc795a6e6d53
MD5 0e7c4e073485b17e3695df5490685082
SHA1 f2d34435ac274265c3c64a2f5fe3ea39fbc6622f
SHA512 e9ae06eaae5fadead5343a6d92ed3ed298f0271b77d52317b331918fc8abc28666c340874bcd058b86de578f2f6c06be0d3deaf226d5e81e0591e98bb8b4200e
SSDEEP 12288:O9xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAR:O9UWrOxMkm3Hq/HPW8+KjQR
TLSH
T19755232A51A1145BC406947BDFF08D81BC6FBCA97ED2C1577B11B30D8B022E19BDAB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 143e34d036920e299ace3be69649a4ac6a20066204b57d1f1689d32eb4e0983d
MD5 e2bc91774b2d54cf09cd0f4d2b01f269
SHA1 bf784091a8db93ff09ea982cf3d9eae47ef9341c
SHA512 943cec91ecb8f752a533c024e990b13b654ab1f256d883d6593dca6a8c4670037cd40c672aadd2c1165963a98e3e333a7a1a2f9a2a49fe70dce428d3bd30221c
SSDEEP 12288:T9xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAE:T9UWrOxMkm3Hq/HPW8+KjQE
TLSH
T12B55232A51A1145BC406947B9FF08D85BC6FBCE97ED2C1577B11B30D8B022E09BEAB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 eb3afaff91c88be9fafe306d1681552691f28f4db35a548565b56ef65093c05a
MD5 85372f1391c1db4c8a771f3df4db8f4c
SHA1 7c22ca2713752b34da73bb0c7cfde2e72109d25d
SHA512 18c8a196b14121f9c4eed3064cca02f27257000b7c2445e15b42cd11c13a73550ad616a4e9047159234423d2eb46306df550040659fe6344e3260a06bce1e7f1
SSDEEP 12288:qyPz5L8exeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GA/:3zyeUWrOxMkm3Hq/HPW8+KjQ/
TLSH
T1D965021773A130F9D027913ACDA14A02F776BC751B61CAAF1760537A1F232E09E7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cf4335c68d0f3e100afaee240ad07d9f7f5b65a64aca36e6adebc7100750b421
MD5 d72a3c4d0786767f0f2e3b261126a6f0
SHA1 d775ca04b27ead4fcae19b31a1b626500de7dda4
SHA512 1141d976711ad6fa41226f2b061139c7062c0040de0a3080dcc1ac0baf4b01048c981ecefb292d6d9ceb58393072d715f525d5c549f0ff90b6728d5c9c4e1de8
SSDEEP 24576:XT8aLl3z0zDMUWrOxMkm3Hq/HPW8+KjQn:XT7LljfUWrOxeHq/HP
TLSH
T1CE7501A5B39018F9DC67813FCD618906E5B27C6A1BB0C61F13A4361A5F333A05D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 11b00e25eadb8a48c7f92ed472cb4f09a37bb3799f4ba070e787814ccfafd8ae
MD5 1afde7e01863ca5d55253db64e47449f
SHA1 cff7d749e2cef2fb76332952b1d4e586afc0c20c
SHA512 483ab01b37375987fc74df87f283d15a32a82eee911d434bb957f4ec5f2ce7aa75b88ab2b122047aa4bb9586ab9486ad773a78463e217dd2e395308e351c125e
SSDEEP 24576:23rd9CHKy7GZQUWrOxMkm3Hq/HPW8+KjQn:Yrd9CHKyaWUWrOxeHq/HP
TLSH
T1B185CF90F3E414E9F0B79A368D728511D9B67C991B71CA8F03A4661A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 d33fa9583e4d224d44f8c54db075535002e332579e0be393824bbfcfb624fa80
MD5 f08f1768621bfe813535ac43ca52287e
SHA1 f422c5833b979c4781333afd59cd6bb22ef2ec22
SHA512 d17f475053bdabdaaac4b992750a223a0dffb6998a0ce40cfe77e3628ff5fc766474f9142ad0e64dabf9b5af313af29a44c7767cb6d9776e6372c8c63a50b3aa
SSDEEP 12288:4cxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAO:4cUWrOxMkm3Hq/HPW8+KjQO
TLSH
T16155232A55A1145BC406947BDFF08941BC6BBCE97ED2C1577B11B30D8B022E097EAF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 5189a9840c766d6b99ea75ea6f9697426d1defa3bd37ecc7a1dd8a2a7b0f6e94
MD5 dea4d25473525a1bdff0d2761dc5a79f
SHA1 389e1844342931a9a54f32098e2d201662186748
SHA512 f95e29cc94eff199ef044503f3b31e65afdbf889241c5c3da4522eddfd05ae7368bde72de10d804d43ae972e328ef694f1a184249d75bef90aa133015ab9d97f
SSDEEP 12288:0+xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAa:0+UWrOxMkm3Hq/HPW8+KjQa
TLSH
T1FD55232A51A1145BC40694BBAFF08D41BC6FBCA87ED2C1577B11B30D8B022E09BD6B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 439e800ca31cfc9fd85b5fc9bf89a0157f1e9a59e711bf1241c7539beb5eb371
MD5 01e5f9c46be65d78c8f7868088daca5f
SHA1 20f6e39b134325593571e8466467cc0c3c94340d
SHA512 e8d712c521c2a1ef8da9f754265db8d457bc4c2e535d9d4d46870d4b392fc83383bf7edbb84afc147ac550597649bed546d07c4587aceb28a9400b8421571444
SSDEEP 12288:wnxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAp:wnUWrOxMkm3Hq/HPW8+KjQp
TLSH
T1CB55232A51A1145BC406947B9FF08D81BC6FBCE97ED2C1577B11B30D8B022E09BEAB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 65cab86bbb12350d4656f5f81b61a941a5c40f497ccf37dfdeb959022290d1b4
MD5 11fd8503f84376790c6078d5b07d0524
SHA1 7991ec5e119df9eb673d02999c9c9b4ff6840539
SHA512 0e7049ce9c41a92e85b8a518220be1fecb2b4f5581aa8760f44b5e7724ce73505489fad5cb4040502fc6c7d16f9b84d3e0a7e3485c89bdd86f0143846ab731a8
SSDEEP 12288:B9xeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAg:B9UWrOxMkm3Hq/HPW8+KjQg
TLSH
T1D855232A51A1145BC406947B9FF08D85BC6FBCA97ED2C1577B11B30D8B022E09BEAF47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 1522c32e1d54308d5cbcc52e0745a3570f98248afa485ffaddca0e0d6e689cf5
MD5 1d2c665e4af16f8b7b97be2d02ae197f
SHA1 f787de9b09e3a5ce2e1722f077569d37f4a788f3
SHA512 120e066d52bec8f0dd851c9a57f5db2e43298b6d36128e6c53c47751f092732cef449b5a2e520e87158dd6f49de18632fb0c45b986063594515e0d4bdf0e4b29
SSDEEP 12288:1cxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAc:1cUWrOxMkm3Hq/HPW8+KjQc
TLSH
T11F55232A55A1145BC406947B9FF08981BC6BBCE97ED2C1577B11B30D8B022E09BE6F87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 b3535c9431ff5cd6627ae197b5aefe5b9534966963e991eb01135b83a144014f
MD5 017b51f8c585702c8b70954a0f6c3f43
SHA1 3699016446a7cd9f00fa6371f00f7992053115ab
SHA512 daaf3cf2cac13df577b72d84696b28038cccdf225de53afa5cf718df024a7727d5e576b3fc161c94cc66c9a06e61c084361cce56b05614fdcf512ca576d35b72
SSDEEP 12288:qFxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAs:qFUWrOxMkm3Hq/HPW8+KjQs
TLSH
T13155232A55A1145BC40694BBAFF08D41BC6FBCA87ED2C1577B21B30D8B022E197DAF47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 6b89de39988b17ceee56795aba4012351429be3ffc122f096313e72d255f20b2
MD5 5c67d0a9029445abc0f344715e9eac8c
SHA1 4154d16c36026371723a2fbd5036b304a4d51231
SHA512 017d6402c68270edd23d0ab421725bf12d6245ebd454cf9b687ef1086c5570dfc4e8804447f4cb2cccb1d018abc238bdb35390cb5d6f85b5329de0b1939dbf53
SSDEEP 12288:ADxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAw:ADUWrOxMkm3Hq/HPW8+KjQw
TLSH
T17055232A55A1145BC406947BDFF08981BC6FBCA97ED2C1577B11B30D8B022E097EAF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f3d05dfaefd3a1733527ce90094396fdefcf2103dfb09dd294ccfd299ce0a2f4
MD5 bb71991c55ea325472250abe7433742f
SHA1 6bdecf680faec053ea9529730d22370f0072fe84
SHA512 7ea3ad537ef8c261473fae89f94eec8e357e2d0dcded3eac6592a378a51b884f155b8834e291433d03920f2e5d52c06e9b5c84c4c5c6e20a325a37d5fe1b84a3
SSDEEP 24576:Wfwvzk9RX6wkyAIZUWrOxMkm3Hq/HPW8+KjQ0:FMnYIZUWrOxeHq/HP
TLSH
T1EE85DF29EBD804E6E077913D9DB3460AF6B178691B31C2CF125A536D0E33ED49E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 47d829382b247df6813765c60b46236659c2ba2b78efbc01d01cd9b0db2a40d4
MD5 96b825b08383698e9551f3b7ff4f0c8e
SHA1 7e116815f45e865500cdf98c4b9b80b1424f3b7b
SHA512 65f28d29de34597c3fa610492514715f2e8ddb73d883bb3a3cf59cb6d5c75b30860f9392e0f2408a6cae28506af845bba020d8d01f9c778c29224d389522da37
SSDEEP 49152:3YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04UWrOxeHq/HP:aySzPQUMOl
TLSH
T116067C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 eb71982f0a5d1bbe30ddf75ed8e4dcff37bc6e887b40eb7f41b299631bcb5386
MD5 5739b06af806ac51f56b3b8164d68068
SHA1 ac54eee8015666a5f7c126f6453ee581717e7d33
SHA512 7f9f7e7e31a5b939049f4f04da6f7c8df4c47ad1a4f3173f31b4695a27b841d2d22f44c0c42b744821dc8006290c615ff99dca46b449354f458a137e761c675e
SSDEEP 24576:h47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYyUWrOxMkm3Hq/HPW8+KjQ3:h47JUQjqirIhCnDHUPfF/oUWrOxeHq/v
TLSH
T12665AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4ca58de0b7851911ece98aa2ace948972c27c4997ba35bea236247366e1109ce
MD5 b46b44a76f4d941b83be3edfbf7c00fe
SHA1 842519307bd8e8dea450ec54fb27224ce4b07733
SHA512 9badf3a38938667e0a765676c6ab27d702ebc1084e83b2a97ab5f3d595abaffb53eea08ac1b3deb05c5a846bb463cc77874e7ca9ef9fceb262d1d377f0f1ada0
SSDEEP 12288:fpsfNxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAp:QNUWrOxMkm3Hq/HPW8+KjQp
TLSH
T19C65F11AD29411E9C05EA17ACB918A41B6377C6597E1C3CB57D0F63E0F362D09EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d96626a7905a53bb1da52a3f7661b874b2e9d9048c43b7da82ff95744e7ddab1
MD5 307978caac6620d4921c3e6eb8d8d251
SHA1 246f3dd4441b328c8ed581b025327fb6bf0e1dda
SHA512 06ca6a417bfe7a811d6f6bf32afb412dc340847a5c86d2dc08a500e64af635ca924fafbfc8c05416d3e3b5869db2bd24c2b31b64b9538786ea4ef4bd6f9a5983
SSDEEP 12288:gXcx6DBq1LOpW+1HSBf2LX9nHi95vNKEZsRNqmh:gXfDUq/o2r9Hs5vMEZsrq
TLSH
T1594518107626DB4FC66940325E73D6CCAB707D01EE04AB0373C98B3FD576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 28649c230bd7506e3c0031aa867c7248cb2518938e8e280fe98d35ac27797ba2
MD5 07c714edfafba529f7072652727bf443
SHA1 765e1c06aed5bfde1e3c696c5b895e634dedee60
SHA512 26c2747fbe7c46654f093cecd6dac1090f862354defc6ecf1880b45bf5e66bda459ee75e4b7e3647be82cfc87140a05f7839828bb07ea7cd2fa4a35aeb638b96
SSDEEP 6144:PyIX2Dx8BnnvrJQF5EJXt2X2wKDeoH7wKDeoHqOs6TM0oP1jQo:PT48BnnvlQF5EJ9J9sOi1jQo
TLSH
T14D551A409536A7CFD1B76032072A5B8DB7A4EC16B7056F26B3C9047AD86BB45F0B83D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 ebb977e2f156851f4fded75c61a4d6caaf7801f5247e2dca0e817e6ed3d57b6a
MD5 b759e2164efdb7f2551fb23aa84e5790
SHA1 ba839fddbe9120579fd99008f73eec1dcc169f11
SHA512 bcbb2e84d4b7a5dc3bfe5d8391d5e50bf694dcaeb24a89d0783f6ab592550692706c9879acdf52f735ab97f9856157edd519b85c90864770fd953f0a392b78af
SSDEEP 12288:VF7VxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GA:DVUWrOxMkm3Hq/HPW8+KjQ
TLSH
T1E755232653A5581BD416A5775BB1C921782FBCA83F91C0D7BB10A34E8B222D09FF6B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5ae3d0438f58e8c3f412238b857476c7da8883aedebb098b1880fd3f1d32b498
MD5 7f721b0445f0ae70abdc588e2e6dc81f
SHA1 0d4cc942b6bb7e839443f45cbf7a7946ab13f19c
SHA512 b56c098e8197626d492a9909ec446a8b755a38932e9e53b2ced1eadbd2e745f7c0721de3b2758f39b65272403213b2eb49b615b580e1155cf60f2b1a23b369ce
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYfUWrOxMkm3Hq/HPW8+KjQm:ngb4mBIBhGFyUWrOxeHq/HP
TLSH
T1FA65AE1E22E802F5E0FAD2B8DDA64417D6B378161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 0ce1b62e0493fb8dea28151c40a9f8c400c8003cca6755d791e706132a503458
MD5 8ee477a517921d0779bc31d32205c983
SHA1 2f9c18a63ea17fbb0cc7469af81b1b690ec40752
SHA512 42f106d4a2de690ab78cdc698e7e31e8ece25bd3fc6687f4de093c4c117e6718c68bef6e0274da7a1c79539dacb52096616f74398303f94bb97e977e1db8f6c3
SSDEEP 24576:vG88u8FpJqH1vzria7/mCUWrOxMkm3Hq/HPW8+KjQW:e7ZFPqVya7/HUWrOxeHq/HP
TLSH
T19995F12577E101F1D47BD1398A824663F6B2B8251360EBDF07A88B551F23AE14B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6fbd74e715a1f7fab7a87e29825250e835fe9d1f39e9d5762501cb4375ac0381
MD5 ccd43164f9de9ac94ddae0bf6b6c2ffb
SHA1 64b3ee6164c8b58cc47a4796dc30ddb659976ae0
SHA512 172b179c0e8ba89ab503104341ac77586501169d08e557a465b0aadde5f3a1d7be81c306a4a6c693003582f8c1225e80012fe0fc32e48bf3c4a284f6c7f33fa0
SSDEEP 12288:EHvUrBFrEjwaQWxeW7/OxMkdJBE53aUZX3a/T8Uok+HbA+Ki0+GAm:EPUr+NQWUWrOxMkm3Hq/HPW8+KjQm
TLSH
T1D875F22F22E918E5E576E17D89928709F672B8621752D2CF03A0817E4F13EE4BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9f20629e630fb64e6f5c15d80e94cd15c1b61c3999f3783b5e7173edf3c286ae
MD5 95ca0e7154b2abf2998935d4c13c284c
SHA1 d98632521f3966b8bc5994db8892d53cfcf58566
SHA512 b4b660e07b0f3f77aa8d4de7b18b5184e7abce1e28c69a5fa317a5ad9e648b71d0c94ad2134effd4606956fab984fb8a7611a64ecc0d64b4ec1d973f7777c8c7
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmUWrOxeHq/HP:FG05lO43bBUMOl
TLSH
T1E1D5C06E62EC11F9D0BBD17CDAC64A0BEBB23415033556CB02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8224a6b7e0bff90eab526868ac00d48d7ad73a0d6f66ff5bcff58acc94e99c1b
MD5 7d6fcdd2ff0f312b985d9f255322fb7c
SHA1 2e0dda3af8e054fa76a2d4dc78edaf8c77109473
SHA512 e69e9d55aef9c41fef3e838c062bb5d4a9876f503b94a547af6440c5ab06d8fb55648fb9d9b945d1fb3ebd058af33cb3b87eed141d62ebca50efb701e9598dfe
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidn4UWrOxMkm3Hq/HPW8+KjQS:qa5POZ3lJt2pasx2+m+UWrOxeHq/HP
TLSH
T16365BF5EA6FC00D5D579D17DC5838A1AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fe7715c80f2ac6c3ad9758c383d38b1a148da62efed303d760d6875768fc1fed
MD5 5f4681e7eef149f1428de48430b0db33
SHA1 23bcaf183ce32419ac693c2cae094e132886729b
SHA512 bdcc177fa21301183a2b8ca6e27f46e1e7ccdc5f51d62911f87c80f8a3f882e220408c12de65ff984da300caeb6b7e0bb61d73595bb37155acbdabb74a4144d2
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7Fk6UWrOxMkm3Hq/HPW8+KjQs:+Nc/zEOVHFnUWrOxeHq/HP
TLSH
T1CB857B2623E901E4E5BBE1BE89779946FA717865173086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 19f25fa240ce02519676db02e5899552b6b1bb91e970b9ff945e1d386735fca5
MD5 751a83336626798d120a0954f569d7ce
SHA1 fc55768ec1792b6328c905ecc967100e50b66c4d
SHA512 6bfbc2f4bae9b8b057ea00226f2252aedc1e32fd03b1a16ba074ff297402340bc56b10d7af5d7b20b66a5baf1689c2d3e240526e653612a41acea22f582db002
SSDEEP 24576:FzkNvNnaFeYhJNtmZBmjUWrOxMkm3Hq/HPW8+KjQ4:FzMwBtOmjUWrOxeHq/HP
TLSH
T11755AF2EB6B805E4D1FAC6B5CD238512FA727461173293CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1cf74f8df59ca0e60d8d02fd0f191b0fb0ed90118ec5edfd33a9b50246275027
MD5 e2dbdc4adfac222ed989a55aebc5510f
SHA1 92f83b1a281af749cd25fbb1ee8f575a6c6c178a
SHA512 dc410dae96d32150c595938745aefb44bf765c1a0c9790822bbfffc455cd03d0f6ecee9daaf67436d459a9e55010361ad0880b509958c44f58818862dd4c080f
SSDEEP 24576:4D3FHshBIYQgAxUWrOxMkm3Hq/HPW8+KjQS:4DVHeBIAAxUWrOxeHq/HP
TLSH
T18985E13EE69C04E4D47BD1BDDA638A06F67238A9032255CB0690C1BA5F5BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/980-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/980-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/980-339-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/980-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/980-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/980-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1376-64-0x0000000140000000-0x0000000140236000-memory.dmp

Download

memory/1376-65-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1376-72-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1376-289-0x0000000140000000-0x0000000140236000-memory.dmp

Download

memory/1784-320-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/1784-88-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/1784-89-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/1784-94-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/2040-123-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/2040-323-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/2040-131-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2508-50-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2508-51-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/2508-57-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/2508-62-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/2508-71-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2960-146-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2960-144-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2960-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2960-138-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2960-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3488-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3488-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3488-31-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3488-25-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3488-32-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3828-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3828-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3828-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3828-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4132-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4132-21-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4132-22-0x0000000140000000-0x000000014042A000-memory.dmp

Download

memory/4132-9-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4132-0-0x0000000140000000-0x000000014042A000-memory.dmp

Download

memory/5676-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5676-324-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5676-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5676-111-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5676-117-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5676-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5752-305-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/5752-78-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5752-77-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/5752-84-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5928-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5928-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5928-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5928-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5928-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download