stealc | 67a71b540af16424f563dd5ca123e0805275347c08ae9c375f208eb691aa44f4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260925-rtlk4azz2p
SHA256 67a71b540af16424f563dd5ca123e0805275347c08ae9c375f208eb691aa44f4
MD5 157a3358658475359ce5685ec7d490d7
SHA1 d195f1ddd0713f8dd0e649fbfe22db9f0204d0ef
SHA512 9e04735bb6581d7c8595f9d3c056233a2b38edce1fe78893f8e391639a82695ed2e5ffe3dfa8845b831b67d153d59d224af57838175fd96d7a97fc01ab4962b3
SSDEEP 49152:xaAiL+4QDlxzUTSPfjznUD3Pqv48pBoSp6cT6vTHMU6eOTjNjeme30jaNf1TWbdz:W5kBLRemU023W
TLSH
T191267B1BE6B941F4C0BAD1798A979557FAB27819873297CB4390474A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4468-45-0x0000000140000000-0x0000000140475000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
1504	elevation_service.exe
6044	elevation_service.exe
1924	maintenanceservice.exe
4628	OSE.EXE
3412	PerceptionSimulationService.exe
2792	perfhost.exe
5712	ReFsDedupSvc.exe
4420	SensorDataService.exe
5192	ssh-agent.exe
4644	AgentService.exe
5988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f31ab66e67fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-25_142918_4468-3556.log	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f5ec149fa4cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf2bcf49fa4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072202c4bfa4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ee4e48afa4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b20baf49fa4cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c7de149fa4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
1504	elevation_service.exe
6044	elevation_service.exe
6044	elevation_service.exe
6044	elevation_service.exe
6044	elevation_service.exe
6044	elevation_service.exe
6044	elevation_service.exe
6044	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4468	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1504	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4644	AgentService.exe
Token: 33	5988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5988	SearchIndexer.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1504	elevation_service.exe
Token: SeDebugPrivilege	6044	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2816	4468	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 5988 wrote to memory of 680	5988	SearchIndexer.exe	102
PID 5988 wrote to memory of 3476	5988	SearchIndexer.exe	103
PID 5988 wrote to memory of 4412	5988	SearchIndexer.exe	104
PID 5988 wrote to memory of 4128	5988	SearchIndexer.exe	105
PID 5988 wrote to memory of 4416	5988	SearchIndexer.exe	107
PID 5988 wrote to memory of 5840	5988	SearchIndexer.exe	108
PID 5988 wrote to memory of 1808	5988	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4468
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4468" "1452" "1320" "1440" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2792

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4420

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5192

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 edb21e23ca532f477a7fc9c8dfaeaaedf67078bf9e415b90618461192b404595
MD5 afc9074d3d807de1cee9a0c8a08ec2b3
SHA1 b799ab5ff783679132c3a1d0f046e9aec4c2ea93
SHA512 1aea73867081cc364c6fc741ac940d19cd9c3bb3a0607b7b559b330d536a992e6aba842df1bc98315f199756216fc61079958b3bfaaba2e75ed18e21e364a073
SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnUe30jaNf1TWbdz:93q6HjBZU023W
TLSH
T159D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fd3fb63da367a2962165f6c12291471bf4ebbefc1c5547cc7f2cd7469c21291b
MD5 9ab30f31abd7dd8f876be3453286cf01
SHA1 ef62976fc0ccfd5be3ba032b815a258411d52510
SHA512 b49676ac8be965e0e805201a86e1ddd7d3ee5948cfafa225d2cb509c80479ab8465244f98b43b72468be035b95a1eec4c0a7fdbac558567c1fa01562fedd1ba4
SSDEEP 24576:7XYfDtczAqgXe4i7ojhsP5Lgrk1TWb4AN5:etcOe30jaNf1TWbdz
TLSH
T1DA65F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1a66a9a1b618f9479e1b969ba7a569f41eccf1a68a854e349e63a26dec4589d3
MD5 2e401f55626a63002ee3b31a66b0b79a
SHA1 4ac91771bb676198ba97da58b88fc6cbff95bba2
SHA512 ab4aade06d7ad2a81734858f6944a3625eb2e9725138932f2300d9c2601f2c41f66f0066071f5e800f197901d9a183859ba688cc1f47bc5563c4b8edf2bf81d3
SSDEEP 24576:k0Le5ji0hmxirMrgXe4i7ojhsP5Lgrk1TWb4AN5:kPji0AcFe30jaNf1TWbdz
TLSH
T1FA85AE26F6748775D073C0B9C5D2A78AED71308217308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 431e804cb1d78ce17140153707b860b2ac33858b028ffa1b434d75181f54b213
MD5 e52fce85b14e7b088040d166b1a24f73
SHA1 9607fd3ccec825db89d35fc4958c83e0dd09e3cc
SHA512 0af610af98d41bde72e50d794a07e2d6bb28bb82c92102b85c445aa3c9499e7bb1610169fbb50b08215eae67488acae445426ee60b129d784f6cd23138f7dadd
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuRgXe4i7ojhsP5Lgrk1TWb4AN5:s/ezSC6vUzPvxHjyhe30jaNf1TWbdz
TLSH
T146756D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bd05600d1c1f44d6f485ec345ac498b5f86fcaa209f35e92c55353dd7884729e
MD5 1a79e3a2f127f1c5c880adef0f171379
SHA1 cb018f74fcb08f43c12e32f057a9c73372344450
SHA512 a3df7d919d6cccaa9518b9df48397f880bb45ef44425529723a98120c5e9aafce9a6e24a727f25d5899475e5df7d0e94f267f00a3cc2b56f6fd08bd02f56f84d
SSDEEP 24576:/VbqPb88hv/l+6MgXe4i7ojhsP5Lgrk1TWb4AN5:/VO88hXl+Oe30jaNf1TWbdz
TLSH
T108559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6bd1abe3b8737350a9e426ef4ae21d83214b7790616edecea312d237d1f3aa09
MD5 4e8b339f3d6a579021864968c4f7ae79
SHA1 fa835d3312e5438315b2d2a8ae0cd2e73d8d94cc
SHA512 1d04bfc102e3ae705db08fc5f8f30e98c884ea67ae20801803c63f37aa66778a151b10d3d3fe77ce7309c90cfbddf4aaee3a0eba785b4c448e6b8fd83e124dd9
SSDEEP 12288:7RG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7RfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12D4523919F5409C6E38BC3F0A0F7CBD1F9E11EC065448D6B47E0FA9358BC899EAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 941cba19ea8b6c6a6149645246283abd28afc2664e8cfcd10abce82e3136208a
MD5 7a817b3cca3c737bfed3116b8f658a47
SHA1 60e548d1f56e294605d073c2d3d19d6c987f2678
SHA512 f5fc9c5bd0c7828c6b67e6efca78f405d421580f7741b9b67fe966d985bc81d4037d9bd328e185ec3c48ce1ed9d5f2a99b3b0e43d68c116a69054d9ac6002ec7
SSDEEP 12288:JeBNUbTVO86UH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JJIUUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C665CF3BEE28ECD2C27E8DB85691C740E7B278704B5293CBD164820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dcedd94722742ff0857bc498c23243a3385b5b22d6d67c6679f504737f7f020e
MD5 2d41726669cdcaecae5b7609a7f48944
SHA1 7d771df640c5b743541b9a21e9ae6e6057e644ae
SHA512 074efb0e459a6b222f97e23411a52f6fe0746e90f11be59f4e92e743b8032a5eada61a601fe1c92486986b449b8e28cfda84b98684246d22f5c16b4f9fbaf8f2
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:TQvGAdlCEL8c/yRNw5C8U023W
TLSH
T128267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b7325390e03742e1250373e406285d329216cb7ffca1b4fdd2e183f95c930ccd
MD5 77a317c28cfa56676f8e7fd6dc95e9e6
SHA1 c152311bcd405b0b26116542d981b0d934eeb235
SHA512 fde617cc8649af60f43856fb49536ec68d15bfc5030ef3e8d7530611cd035410de1166359ca2fe57a98c6b0cb894a8feb8760204e9185ddf4ac3ec5631077db1
SSDEEP 24576:RdewsAjCgXe4i7ojhsP5Lgrk1TWb4AN5:vljVe30jaNf1TWbdz
TLSH
T1BD75E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 48c0b210cf8326318589adb97d181105969e5c33eb6daed5f4572e83f4e5692e
MD5 e18c69fbd9c54b475f8002c4f82b5811
SHA1 2a3a6230e10b480d2053551407973877126ed73d
SHA512 3320106d060b9410b622dd34ebe30ba43f42d5f4d13a856119d188171090805ed5f849824822eb7fb9b304a1307d046d6bbc1bfed472b926cd4877c28002c087
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9p4W:YUEtQevvqc2W1cpV2EI32/4W
TLSH
T144474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 14613b496611076dc3a9c2c60ce6a1e7cc17b527bdbcbcd55df9bc75dff2326a
MD5 c6715b90c3b95a7795f3c926b985a223
SHA1 087e029f70c6041090cf153bb29f161b2043c2b3
SHA512 aacf3026d97ae9e69992420d8f6b6ddc08de15ec747aaf4a04eda7d94b4f2a5b1e3a1c24a176bd226abbbf21be83a66d1faca4813000f4ece03d808d9b80a37a
SSDEEP 49152:UCbRquA/m2yL5zLfFiV+XenmE3/z1e30jaNf1TWbdz:9oq2VjnmoU023W
TLSH
T1EAD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8cc9b3ba0a936f9c1a53d61002d70c2027803e3d4a072ed63db3545deb23b189
MD5 04581069332f70555f716d4771800a70
SHA1 59d45cb0d56595494f2048d7d49b9614c6960d7b
SHA512 a16aa1240aa381ba3604d3203ded342d5f9994530ca09cdec7530893f6f78cf8450a408d4b08e1753b3910ee277da915573f5be28647295a94947fd6f4e2bb80
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53NgXe4i7ojhsP5Lgrk1TWb4AN5:ZAMyFoiq54e30jaNf1TWbdz
TLSH
T12E359D81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 83eff73d750e22a171ccf50d1a80f269a8856fad51531d551a553fd58cf7245f
MD5 70e707759c2e8a8ed8897436acaebb63
SHA1 a8d587fddc9294d974bb0ae822fadbb47bf7674e
SHA512 5d57f139aae7015a145f4827e7a2706978d63599fb926009bae87cb40160991ff36d9706222d42f6e69ce0c8b6e830b0b164f7e232fa37b470021e6b8f548c45
SSDEEP 12288:Jmw5HEjsChNVBFgl0WDm+CQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:EwuoOWOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16365F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2cab274fe415967200d922d3e59d84202be6af4dd279ebfd51aaf120bab8a505
MD5 1f0c36db0d7a5b72487c35bb10a225f1
SHA1 d18a7e878e3357714af404d9fc4e2b0d5ae19639
SHA512 a1b66396f4cf27c1aa8fdfe74734c78825feaa39a1a293da4f6de7909242241e843f927314897f2ca74e2e05cc9f1f0410c672c8f5cece8faf2633ef5a4ebf1f
SSDEEP 12288:6BZ1IyF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0ZuTgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B655129637E420F9E29782B8D4F28741E7B13892233147CF06A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8c25f9623297a3294450843e40a1b9db1b181e210bdde430b76802a2e736db1d
MD5 b2c1c407d02e37c487c44a072326e0ad
SHA1 697cbb4b817663dc4065beceedbc0f68b96f3de7
SHA512 9161bb734a83397fc7c2bb9657b237947c225b5d16f0374d5f7f8f9c73992ed99d8f9a6df07b34fa795b57cd4b9889d72888a8c1a6e7d0beca5ca33e5b06090c
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:YQRQyi36YOcPQLvw2gAf+PN3HU023W
TLSH
T16C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e3f980a67d7565d4719ecae7d1f375fa346ddc5bc3d4c7c06818fcf532b627e8
MD5 582aa355f1c40b000cf3aa5e9f392186
SHA1 59dba87c6e92acc4f464cae070adac8fca73515e
SHA512 4e59235d0c9782333fd48afe5dfbda1de9f28dd281784223cd35137a1c62f2eaf6ee391121d82f5d1fcd9d8c6916b58bfdbc0df995df10c65a91e954591023fb
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:5QRQyi36YOcPQLvw2gAf+PN3HU023W
TLSH
T11A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c25ef17967166cd9976ff67af3c6460f75751eafc0bb9d2cbb526a5d57c77b5b
MD5 90baf14c9feccdc190ecac915ebe01e4
SHA1 3d8a6b9985695bc87849a6dd2d3b452b57f44bac
SHA512 60fbd7317930a31c765973ff6d97c1ccbafe632289612b57cf54e56c3da9b566b8db7ca4c9ad177e30d44e0cc8f07a6c8f8fa0ba33c2f23c8c5cf450ca0f619c
SSDEEP 49152:N68Qg55nhheWu7PNU3/Fe30jaNf1TWbdz:LthWRc/FU023W
TLSH
T19DB54933B2F20099C04DE1769F4A872196E27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8a9db9ec879c3d4436a526a760046798e60ccc8ff5e9b08c520c8a4c55796b1f
MD5 59123d558f2986ea24a8a76147b82cc2
SHA1 9a8e432db22e684d57377eb94e2cd5a4239c9f69
SHA512 1137ed7a288df42c4e3cc6019764f840d01876e000b0833caa120b930ef8bedbae1b1f12fef8845095db532d4d54de0527ed564914d9b97732d527968a7b2de2
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:Uy5112gYy5azzVvL69nLKnhZ2U023W
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e8ccef8e82d3181cf868e51d4ff7e168cb6cce14fcbc194cd7c354c64544ade3
MD5 aa3a141daf11ca54fd40ef1bbe31e99a
SHA1 cd8a0a440276f82db55686d4b6d4a079e6f2b18a
SHA512 0b0f95b5190665792ecaea41df801cf2b47ae3bc9c61de678cb364837cc2e7b61f7af14a27259dc20844d6a984876d680b07634e32bdfd648edd87f9676b5b2f
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9e30jaNf1TWbdz:mu6JmVxd2d9U023W
TLSH
T1DED59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9439cb29847d878cb371ad9972e0840d59bf763907895190d39fb320e1201b4e
MD5 b213a0642959037c08041383d3657f81
SHA1 0290b5b6739bb347c63aef4ec96cddbaa7f07a12
SHA512 76bbe888438ecf098587e8316e8402daf0ed36f0a8d6701fd4ddf0af97f009f8f415a35271f4c214b1ca986dbf2cac0f7833be6abfe886dd12d267ecb2934da5
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4x7e30jaNf1TWbdz:9mifPbRoU023W
TLSH
T1CBB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b06cc065f643704571b8e8f9e14a42a3ba91c6557ea34dac708b3f28e636eb9b
MD5 1c2f51ba9ed5017a03901e1f208f87d9
SHA1 28ee90145077d0431599b8de2da5f73c6b549c3c
SHA512 c5e5b5e69ab29af363c3e0507bb31337e2e43e7b423b8f5031905562e282d5223b45430f47f2259c21c0a27e92c3d2ce293fad34500cec1c5946e26d4397e367
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqqe30jaNf1TWbdz:/5dKTi61qU023W
TLSH
T101C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bcdebfca63311603d25abe7b038900cf8905774b59563072dafe8febe0e1257d
MD5 e656a8b9e0d17f61e3212abdf4cf8de3
SHA1 44ea09e4a3932eaddf5fff335dac275263d5165b
SHA512 b5a76c4b546ae810bcaafce7b2e81e856ed7b49431a634e0e17f6a801c2436de290b072a6286bac0dfb4b597cb571cc3b296eab71a8d49ec95a737b468cfc54a
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wve30jaNf1TWbdz:MX2iyphEU023W
TLSH
T1D595BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0a0c9c5aadcf48812c70768c777a11a660587f704e671c2f43b88f5b3c9bb4fd
MD5 feac509a4742987a9dd2ef08fb1e7c9b
SHA1 bdee8b6d3a4aa400444e30a334ed56e3e844bcc2
SHA512 503853c309ffa62543726c88b3cad1e3781df87e1b741dd3560320918474cbc341197aa22fbe88f439667eaa94584584f7a4c67c7e22bed6b8c9cdf36e6b3682
SSDEEP 12288:2O0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2ngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13A452391AE5509C6E34BC3F0D0F787C1F9E01FC2724049AB57E0B5535ABCD9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1fd666a7c16337d9e7e91c9920a243af04c72a82ecdceb4ff3746f80b8cf95ad
MD5 345d1d730029c20494410866709ab0b4
SHA1 bef41a3891fc74dd9b6f41ac02449512922e8589
SHA512 0aa1f98315526cf6e7335ed5011a57d7ef38efaaa28cfa995af6e053b41d6713de0812df697f9ed3464b47e6121f6353926e779215dd8dbf6d478d224b0ddec0
SSDEEP 12288:f50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14A4523A1AE5509C6E34BC3F0D0F7C7D1F9E01FC2724049AB57E0B55359BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 82bf200efaea2d624ecc6ece35fd9b1488089c2e53441bce25512f089bcf0ce0
MD5 0389096c20ecc5a32779b291f4908f7c
SHA1 4ad5db3ccfd4477084cbe908015880324eb9a2c6
SHA512 2b69690aa074a3c3488b5d84ff3f5ca630f2366ea99c256082dd4843d90b4936eb7d27bc36b342bcc0d9d4570023e3075e3383e07f59d3c092a562e4c0392207
SSDEEP 12288:iP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:icgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C9452391AE5509C6E34BC3F0D0E787D1F8E01FC272404EAB57E0B55359BCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 23f0def86b80e906e227729b7bce2d457e23c9925e4d959b38f335033ebf5909
MD5 c8d61d86ae30218b9fd9349aa1e2bfaa
SHA1 5751bbf4633e85f5f3463bb9663589355585c63c
SHA512 fcdc9d0a2406dee95e7c4637476d84712e2109755f0acd3aa4147c59b682286e39c797531e9fa483c44072c0014b68d6043416235e4b5f130edf3c8c793e5e7d
SSDEEP 12288:YVM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1344523526F5505C6E287C3F4C0F38791F6F13EC173118AAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 09cdf6f03efee8c31fcc51b01abe02ebd509798f525c0a73616aafb4d66fe803
MD5 4ad0bd367aec921e9743f0e2e69e6208
SHA1 1840f13bd060e5b855827bb33df0b648a4796306
SHA512 5945165015edb90363b4dca6b844c2fbdff0b215cda6d811c1a58e55e2e182dc4975a0d8275185e464370367450564e8a2df411905bf3a20a1d66c031f603ef1
SSDEEP 12288:Mk0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MlgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D6452391AE5509C6E34BC3F0D0E787D1F9E01FC272404AAB57E0B5531DBCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b2ff2ce587428305d782dad879670c5e641c1a2e701ed2f16fe3eea24577c139
MD5 cc87f73d83a90ee360c4349996975b42
SHA1 9ff5ee216c0eb5a2b518e873bec5f3d55d6628c3
SHA512 acc505f43441b013a5c1e0ce7c588a8fb17bc89db158cdbb9d5f5eb15021013fff05e3437406c60a163c845823e31c53ef73fca3ba656d8c786a7d1f10eace70
SSDEEP 12288:I90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T150452391AE5509C6E34BC3F0D0F787D1F9E01FC272404AAB57E0F55359BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 96655b44256345322a1d0bf178fd01cce05b258d2cb6b3006f3f4dd3235c00f6
MD5 a996edf2d0d7c9dd545214fbbf604255
SHA1 db8027fec9ab71592e61714f3abb9e8e852d0d20
SHA512 2514ed2284e57c09b07e1586af60a6d870aae3bb3821b46e0c75ef5f7a266980c29dddab6f9b9c9155d29f84ae92343943edc52ceb4d507a693821dee9083ee9
SSDEEP 12288:xR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T190452391AD5509C6E34BC3F0D0E7C7D1E9E01FC272444A6B57E0F5531ABCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4207ae824fa66ed8888be269bbcb631dbe32f256adc5955991edb51ffed18e8b
MD5 9fb8fb259730aedc95dee6034477ced3
SHA1 8eb6a8529ed096739aba96cd17a01fc90382098c
SHA512 a9cd961ccaaf82001f272a4371d3cfd7ac38ba8bd26d06d19468141eb868d58785099e1a359dbc1951a3a119a449a414122460c8f4a94cccc6355d5efeeba2b2
SSDEEP 24576:nZMSzFVSOGgXe4i7ojhsP5Lgrk1TWb4AN5:nZMSzfde30jaNf1TWbdz
TLSH
T1E1650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436675F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f1488c7464c2107c9ec8b3e791ba75ca96910795c4c370507035d03d0aa4e28c
MD5 d46e4786d31ed94f75622fcfd6014b55
SHA1 7a05f0978c79d66e3ed13a16915d5d427cf4c244
SHA512 e6401751617b9b79a6fd743d3e8ec7c69970a45e8829710284b23e571b645933698f170e28d8e7ea140f478ed33c402c54e1ff8b1d53698121fc3315cd8b4da1
SSDEEP 12288:4K0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4DgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T140452395AE5509C6E34BC3F0D0E787D1E9E01FC672404EAB57E0B5531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b79806d3bc0dda74983a5647f39aca74ff680729950b286a70eb9679da51d524
MD5 13f4f7560a8f6d64eaa1191d5f2df4bf
SHA1 d0ebb0a5e5246d06cfcefafc037b93ccb031611f
SHA512 8dbd955e140a97718145739a901d076a3c05f61c554a0ec8fcc3fae63d6bc9479cafc0d584e9c62f06b6ad4a95499b1804a2930756071dca10bb7b0526c92c4d
SSDEEP 12288:IW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T111452395AD5509C6E34BC3F0D0E7C7D1E9E01FC272404AAB57E0F95319BCD9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 fd70daf27779f589abf8fc45032f2868be301a38f251f0018c7121025c80c662
MD5 155c0d5d7324dde852a6358b01f166ba
SHA1 c21caeabc0c0f8188145f2157a85080af1250b01
SHA512 200026e7c46077c6682f976a4fc8f085721ef73b27fd733aa91e74d0b578c96ee4ce2d226941fd1e70a5bc99e9b6ebdf1ef2d868e6894fa553dc6a2c5005bc26
SSDEEP 12288:YyPz5L8F0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5zyygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DC55015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b42cc432ad16a368d842757f29946bd92e0f290515707e807d49e50c9bbac9d0
MD5 4c7e007885e5f74d24007e535b44103a
SHA1 cb3febd025da6f3ee107a407387165e7b8aae9a2
SHA512 93646823606b12b91fa62c3a6622f6c2b65370f5cfcbd6f4ac7854ef7c928c8a35bbe08da7c9ed7bb5bd8f017f867233cffbea17c7d090ea63e25298d9b2b058
SSDEEP 12288:jK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E6452395AE5509C6E34BC3F0D0F787D1E8E01FC272404EAB57E0B5535DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 408cd7ea7e9596283f1b04eb77205762549d188e44fec2f2298c9a4e433d6f32
MD5 c917bb1b3fb91eed8a75c53e389af712
SHA1 1ff46ddc3cd18380526fe672669c4e03bd10ee9a
SHA512 3cad891085099e29df031c907846a13a9985e2c8c96a81c7161636af4dc9f5222b31914432e98b4c93364f8f052cd83fa75fcffdc0e4e655201261898c5c99aa
SSDEEP 12288:NK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12E452395AE5509C6E34BC3F0D0E787D1F8E01FC272404EAB57E0B5531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 43d1df799e81e09b09675ea673b2028be008e9361e78dea9b4c9d453fe7cae89
MD5 d6277a5498d52247ebd37b2b8d8aa6aa
SHA1 aa0fc4ab37726374d06865d57f389e400f953c3f
SHA512 e6f368f4162c25e0fb2225a3ab38287178b829597c8596830db022a49ff2ea509536f78e72fe3ff6991a6dc9e9e65a4f398039028d1bde3a9cbc3403dbd32f31
SSDEEP 12288:vyPz5L8F0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CzyygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15F55015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 bdca24c887a5fef0fa874a11a39c4f72ebd9b61e453ab01286d742b3f0676a25
MD5 5d8734d2644c36fc028e27c336154da3
SHA1 74b01c359176d44051835e74e5e02b1a012fbc3b
SHA512 3f0dc379c5b69ba51799fdccee409a49d53eb7398bb8d8daf45f5ad5d69021b8c27e1c3d04fd46d4f97b9379479c589898d6cf1e2e896c0ec76072a06f46d236
SSDEEP 24576:TTHaLl3z0zDsgXe4i7ojhsP5Lgrk1TWb4AN5:TT6Lljse30jaNf1TWbdz
TLSH
T1CA6502A5B3500CF8ED67827EC8A68A02D6F27C560760CA1F03E436675F373A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8b290e1d3b558d58c98cc961871b1a3c01559609fe9e10e63f1fd06824444801
MD5 30021a4345c20c3598f47640549a8e51
SHA1 6e1c3a52109daeb7e9385ff3b656e46de91b766a
SHA512 a4d9fb73f1f0ac3a85e2836fae451d5b40d87f744a4a1fa99646b8dc23dbb08661acdedf28fc87be8b2506e08c217494d05c5432f83bf3453a8c3560caf28510
SSDEEP 24576:N37d9CHKy7GZggXe4i7ojhsP5Lgrk1TWb4AN5:t7d9CHKyade30jaNf1TWbdz
TLSH
T19675CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0807c863c58fbcbede7d1b75d6ed92a17c632de73abf9a1cb1a92a5492764f1a
MD5 94ace5fe4aba0a94ccaa47747b804b40
SHA1 353d8fe90a038af3d0ab53e9e6673162802bd218
SHA512 f729747395037ddb59dd75a181a59cb348a44429f0996fed356bd3636eb7dfece16d2bc2b00ad7f4121a1b9d3a0c1f2cbec17e0df122676a3a79023a27f25c54
SSDEEP 12288:gv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:g8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T169452391AE5509C6E34BC3F0D0E787D1F9E01EC272404DAB57E0B55319BCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 65cb26021b9eb2517a2f2cbeba59db116ed9e59cc83619bc0be32db32fba40ea
MD5 bcea0091e5e2f50ea4657198cd6f514c
SHA1 b46674a8da8ba2794b81cb29effc2cbe8c5c2b66
SHA512 0ff51429b5903ac7227b9c5b17b96ee57decab515e32d0c3ac04da0ebf7f3c040c52b0ac523582feb0d41dc94930cd230ab96c1c76d6259fd8ea841c578f78e7
SSDEEP 12288:Pl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1784523A5AE5509C6E34BC3F0E0F7C7D1F9E01FC272404EAB57E0B55319BCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 06b048e5bc2c1fa6a8ff2b966cb34491eb8b74c0c8339cbda0615c93eb5335c8
MD5 dd4e3e11d9134a708edd0c060be239fa
SHA1 0127e60912165ed7e57bc841ad5917ec413cc05e
SHA512 51e65a9e7f13a5623121d46f914b87aa886ad984dbc6529ee5c6c6d6bb3d03399eb9f06bcefe13ee91323ae22aa4e7485ea537124bb94d235e4130949b7ad89e
SSDEEP 12288:OI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10D452391AD5509C6E34BC3F4D0E787D1F8E01FC672404EAB57E0B5531DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 874b2bc556d53894612937dc96ed399af1946f20a913fd365d8ede02971d3351
MD5 efed1a5f0cecfc42e878e0834174609d
SHA1 eeff8d08386fd73f0caf616ca7d1d5ae8f3d0640
SHA512 3c65369c066c4be3892b20624f4a8eefbf53e78e3de59f4b25b51d2d5c20e49332205b99292988bc44b4be1c1d4ac68cfd0e81ec75450ef45ccc498aa6adeeb8
SSDEEP 12288:3K0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3DgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T149452395AE5509C6E34BC3F4D0E787D1E9E01FC272404EAB57E0B5531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0aad6f7631b9f0a7028ece52aed9141d01d7a706da76cbf1d45a88657741d219
MD5 adc797d0dc8f2ae8f66257437da8fba6
SHA1 c71b2594552554103eb4728070be5d75b42ca75f
SHA512 347f72d668d239f7fe11669079fda78e148cf5def135cd4e84d5e012596ea99b87756ad5fef044c9f260a277bfd9927a7d5495d74aeb6d839862e27bcf7d7f25
SSDEEP 12288:Uv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:U8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C1452391AE5509C6E34BC3F0D0F787D1F9E01EC272404EAB57E0B5535DBCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a97466d383f7f50a0c922ce4bfdf891f27d5ce2ffafd15fa21b2559e309b6b6e
MD5 a158549cdf3c33527a3608ab4cd83e41
SHA1 0652939c9378d6e47d5e7fb261552c73e2cae55e
SHA512 dc8e4941984fc7ee70bce039ab6a7aff2a195f27e26bca39064e1c61969ee724496b64a09e76d6f078f4883854d55488450e79a42add083d8cc2eb55aa6c5e67
SSDEEP 12288:Ii0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:I7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T188452395AD5509C6E34BC3F0D0E787D1E9E01FC272414EAB57E0B6531EBCC9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-25_142918_4468-3556.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-25_142918_4468-3556.log
Size 1KB
SHA256 2150356de62ce94635a929f005b7e7b1c369d60e3e2281ec2e71985769342a67
MD5 89b78e58340858f7851ee97d735a0273
SHA1 96485261667ce39e457c8003a4a40788a888f262
SHA512 8ac16d2197b7b75b36eb4b035e00bf431544539d01a4b741489a5a0ee776db871ff5e3908b725085111cdab2b1f58119d6af5a51f0d53f7be66550137f0a435e
TLSH
T1F321720A2FD40A25FBFBDD8294FA14539E3539926835C90C10E5424E1975F45FD70357
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 a82bb12a16d0c18d8e4571047d4c10fe6b086a12a3f4a918bc5eda5933def608
MD5 4e18771aa35ab77b81fcd64fa70c8349
SHA1 b35de9b15e8b4e10e553a04c5102a56aba478a39
SHA512 3fb796a3f95f403127fcc249606a213a2da10a26f8bb518803dbd79a6ee809df7019f7edff4f32600b135f33430017b8f833f9d36c07eae8e6944d1e44fd8174
SSDEEP 24576:Ufwvok9RX6wkyAI/gXe4i7ojhsP5Lgrk1TWb4AN5:0MnYIWe30jaNf1TWbdz
TLSH
T18E85DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1837895557e8094f503a54a9f591e90b801d8a07551bc48df2e8c72547cb5744
MD5 c3a26232498aa902d19993c47025398f
SHA1 acfa5268abf431192b6371875576e5ef8d0707ea
SHA512 cc1a0c17d87bb47adcd62cfbee13515cfa6b68e861c536dd8b6dfb85ace2c6a9ce3315e0f589dad4e9154f8067c866d587550a1428a6cf4525eb2e5b249c321e
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Pe30jaNf1TWbp:XySzPnU023W
TLSH
T19E067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cee606ff6b204aa3fc6f26f8a0f57928f11350cf6c6b31682b351eeb97845f0e
MD5 070a876b82d0043b7c9fcd6becb008d0
SHA1 0249b6b501589e7a28a497c4cb0bc2505dfc3a54
SHA512 acb3ef400e2be2dc6cf7a76c73c35def0cd92b6cd4bd0c9f83c982a9f1ddaeb942fb3630cb363e1f17c2ba37b7aef393d5d32e63cd448ee9fa0c5f48fba46db5
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2gXe4i7ojhsP5Lgrk1TWb4AN5:V47JUQj1irIhCnDHUPfF/fe30jaNf1Te
TLSH
T1F065AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 faeb8b5fd9e1fa596b0dc2cb96d2639036472fb18df61ed07953d5cf66707c2d
MD5 ad357af176345ecf4554b2453845ecef
SHA1 f6c7d099510a909f57f89787b2dc258f895cb7ac
SHA512 b99cd73261b7ece8054f1e0e77ba7f6936d58e1d60051dff093b669bf2ee31e05d4cbaac943eadd582614260653bb1de52db026877c8182c6a951ffa25badd1d
SSDEEP 12288:xNsf60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2TgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C955F15AD29802D8C16E92B4C3968A41F3733C5193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0146ead94df57752654a0bbbb8b5d773a8c7798b7b114195f46c9ae4b3b2852c
MD5 da9f8a91f1bc28130e162331ed5d4495
SHA1 0672ac63c6969bf47fa7920ec14f1d3107834ebe
SHA512 d26a302dd00a3008f585a28bc63cbaaf1f1afdb96bfe44780f8c183bfdca73525dedb4c05e3bbe687143806d8b0459bd844e2438742139eba5880917692d571f
SSDEEP 12288:X9p8U3fVDb2wa2fWAeznHubURiU2ySoDU44W:X9OUP0zHnZ2ySSU44W
TLSH
T16F3528117666CB4FC6A940321E33D2CCAB707D05EE05AF0772C9873FD576658BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ef25c2b3c5bbe86c6b4470f6f8aef025571158039c0b334fdfd7f77a0b09c6cf
MD5 bbd748bfeaf6f3fbf6ee26257cceaa2a
SHA1 4cbdb95a12f152ecfa685e0191f9997a08d0d997
SHA512 bc5e67c184b2d499f390b71a278cd74c5ab989f97a0a37a84653cdf91b21d180456eea84a5350dba8215f4a20ee96a712c022505dcf9081ee0344dc7b04f04ee
SSDEEP 6144:9ldbyvj3/0fkgfJPw3txVvEtMx2vEtMx/UpZxUggIiG59FNHmiDRv:1ba0fkgfJPw3vg1kPNDDRv
TLSH
T11965F880A537A78FD1B72032072A5F8CABA4EC07B7056F2673D9453AD867711A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7897ae0ea5ff9724b823198c0c8d474308d5bdfbc77d54d5ba89f205aa5ad679
MD5 766be96089c79467b1f5e56e422e7c82
SHA1 ed390d1fc39db2f66f36d7e429342eda55cd823e
SHA512 192ec0022efdcea29d1c4a17759c8cd8d2e046e6acc778b535ceb35d31d2afddab83cb3668fdb5e5593dfb43eaac9a1db5d1e11c1dc0f8effd3ffee7db451c5f
SSDEEP 12288:0F7S0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ILgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1164523629F540DC6F29BC3F090FBC760F5653EC0270089EB96D0B69319B8DC59EB8919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9fd4654264d30efe2ef2949148494edaf442e7d713713f7c71ac88902e034f2a
MD5 f3f499e3a2eabeda1151ccbe6d684774
SHA1 d8bb22eafd797d6b556c304f84c6d5958d95a610
SHA512 7036f8d49bea9704b669c6ba36866738b8407ed5a0da7a725decb775fc5151375a3f36203c8c64ceef74230cc333d4ef55e9997c3983908ad7a07daaf7ad1b04
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYRgXe4i7ojhsP5Lgrk1TWb4AN5:egb4mBIBhGFZe30jaNf1TWbdz
TLSH
T10B65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7a75be53f62ee48a3a3632ddd7ea66fe1250740b254911d044087afed87a6c00
MD5 7461ce9fc5fd94cc39945a90f98e60b5
SHA1 c001fa3c5d6d4a9636497cdd65134801fb836c66
SHA512 12848ce06f3c4c81b547795f88253b80c73da7167447b47b8c025e9af522ca54a9e2c5ce186618c3c68ee23ef4301f4aa9941626b47fb211c8912c53832ab03c
SSDEEP 24576:NG88u8FpJqH1bzria7/mGgXe4i7ojhsP5Lgrk1TWb4AN5:A7ZFPqVea7/0e30jaNf1TWbdz
TLSH
T16085F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6bece675882552556123fe624601bd6b345e8f7a99ae98cb45be48b7b638578b
MD5 ba23daaa649721b093a384b45caa687e
SHA1 3d937fe7852f8be9728984f3f1a414ce6b6bd043
SHA512 d03dcba57a458b35063ffe9915145abf92659ee45415a89ea102628375d1bbdcfaa27d61f5304ea317506954edeea4124e9a9dec94512753eaf13e2017fc87f6
SSDEEP 24576:lPUr+NQagXe4i7ojhsP5Lgrk1TWb4AN5:lJQde30jaNf1TWbdz
TLSH
T1A165E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0779fb8fcabac7bc3c68dcd4b7b3fc7124a1eaab7846aee3435bf1053f41aa73
MD5 12600a6d2f8e41d36a7f07426139fd55
SHA1 ea803b72ce786a81273f33c6292fbc5fcf8cd344
SHA512 61484ffc4b553b016aa6b9f36bf8fce319932300c63109da76eb0559021f987bf85b564e27b4009b183a379ed2eeaf976364cdf025b506f77b2876c334860013
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNe30jaNf1TWbdz:UG05lO43beU023W
TLSH
T164D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e23449fb20494fd54cf5924c22a36332294938b3d18dfa0db61a5dee8b1b2060
MD5 da11be5e6e7a8c935df81d08333b76e2
SHA1 4aeb3ec91b16c088484312cdb6ce2074cc2e0e71
SHA512 8febd86977f215f2c465ef6f906beea1f83632112222051239eb1c53b09130cf8820f67303c485ff3ba388dc9cfb4e53d075d4373c7e6f5efcc0a4afccf499fc
SSDEEP 24576:Dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn4gXe4i7ojhsP5Lgrk1TWb4AN5:7a5POZ3+Jt2pasx2+mFe30jaNf1TWbdz
TLSH
T19965AF5EA6F801D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51ee3b7920536ea852deacdf78b3bb9a857a7ff3ef452473d1d791df0669bd2c
MD5 0f4e87f521eb6b4439f217ebf58c6b77
SHA1 ff0637bf2bb412b9e3901061e6f0063a5951e241
SHA512 fe43a542c2563b2c7981463572ad808fd64587a19a8d9e8ecb71602dcdd0bf6386ff492fd15a41b95e180918641b9011e2420fbf2cd66f9e2524f39664099f13
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkugXe4i7ojhsP5Lgrk1TWb4AN5:iNc/zEOVHFUe30jaNf1TWbdz
TLSH
T159858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 80616e4080f1f82ff3256ca8637f34d157f1932280be0a86cddf883c84a0e25f
MD5 6524aa2a1c5f8574ef2b6a20e6597fca
SHA1 fe262219d431a07c10d524c3f028eca4b7977682
SHA512 e3e4c765879898e011640b89573deedab58638ee87ab11d946ab9ace8546d1629ad89e95873a8aa93784e61b0020314dab9a0ebf44bfc19f96595dc299fd9c8a
SSDEEP 24576:J8kNvNnaFeYhJNtmZBmugXe4i7ojhsP5Lgrk1TWb4AN5:J8MwBtOmhe30jaNf1TWbdz
TLSH
T16E55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f1bcd17e0d4ae74cfe86be9c0790147ca4fcf8171ae30fa1701faca6b331af41
MD5 5c2748998fae2151ea1c9ffb8cc7bb4b
SHA1 d20fac87cd3592a1c331de3f22b26bcd8ee6221e
SHA512 b676717498a321c690ea09bb0b89f42cbf570d7518b8306e926b83751781fe5d671d49c40bba338a7de76bdb264b852d7999b270344e5777f529ac02416ba621
SSDEEP 24576:1D3FHshBIYQgAHgXe4i7ojhsP5Lgrk1TWb4AN5:1DVHeBIAAue30jaNf1TWbdz
TLSH
T11A75E17DEA5C04E4E57BC1BCD6A38A06E67138A9032156DB02D0D1B61F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1504-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1504-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1504-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1504-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1924-54-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1924-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1924-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1924-47-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1924-58-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/2792-318-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2792-93-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2792-88-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2792-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3412-84-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3412-76-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3412-82-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3412-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4128-336-0x000001DF4A840000-0x000001DF4AA88000-memory.dmp

Download

memory/4420-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4420-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4420-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4420-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4420-117-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4420-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4468-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4468-45-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/4468-41-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4468-8-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/4628-258-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4628-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4628-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4628-71-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4644-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4644-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4644-145-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4644-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4644-143-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5192-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5192-125-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5192-131-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5192-321-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5712-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5712-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5712-339-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5712-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5712-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5712-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5988-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5988-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5988-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6044-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6044-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6044-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6044-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6044-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download