stealc | e2649726b153ee82c4e4ac0709b9e3fec5503c2a13cf410d416580057f34778a

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample260930-v3fyrass2l
SHA256 e2649726b153ee82c4e4ac0709b9e3fec5503c2a13cf410d416580057f34778a
MD5 ad5746e59b50842a262ca74e1b8d1acd
SHA1 0e023620b1dab43c69f32c322e2ad419bcf4186c
SHA512 5cb02e630742ee7ab59fd30e581793268c8e66065a2c024fa0493fca75b2afe9f57163fd478416b513138d9f5305eb57ebaa21b650d868fc2fa1ad729746cc50
SSDEEP 49152:GSX9RXNBYfzjV68NPLFs/6iNyGdqacTLhmR6I/GOTM10Tod6bMpdhW9:wSdq5OE64pdhw
TLSH
T105167B1BE6B940E5C0BBD1798A579617FAB2781A873197CB4790471A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/1324-47-0x0000000140000000-0x0000000140433000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
2788	elevation_service.exe
936	elevation_service.exe
3564	maintenanceservice.exe
3436	OSE.EXE
3764	PerceptionSimulationService.exe
5528	perfhost.exe
5108	ReFsDedupSvc.exe
4344	SensorDataService.exe
4264	ssh-agent.exe
5324	AgentService.exe
5308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f687109e7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-09-30.1730.1324.1.aodl	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073dadb730151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000247c19b90151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e1f4c740151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006138eab80151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1324	2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2788	elevation_service.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5324	AgentService.exe
Token: 33	5308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5308	SearchIndexer.exe
Token: SeDebugPrivilege	2788	elevation_service.exe
Token: SeDebugPrivilege	936	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5308 wrote to memory of 2356	5308	SearchIndexer.exe	99
PID 5308 wrote to memory of 1408	5308	SearchIndexer.exe	100
PID 5308 wrote to memory of 3352	5308	SearchIndexer.exe	101
PID 5308 wrote to memory of 5860	5308	SearchIndexer.exe	102
PID 5308 wrote to memory of 1384	5308	SearchIndexer.exe	104
PID 5308 wrote to memory of 3804	5308	SearchIndexer.exe	105
PID 5308 wrote to memory of 1052	5308	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3564

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2692 2728 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2692 2728 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f16d32908b2de23a26cd03338b4d15ad95b59b76eef0ef271acc51cd2c2cba62
MD5 ab50d8cabfbd373ecef89bc61c8382fa
SHA1 ccf5bf2f8d3287a676421e6b1a33b5343b6f2ce3
SHA512 ece517ab2110a38d866f826cdf12e1fee911d3204539957e1123de3f663163c01c014b617343ced37b27359541cd01eba916184c04ec3cae82fc9076a89dcdab
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5Tod6bMpdhW9:k3q6HjBN64pdhw
TLSH
T162D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2ef456a5781ed68fedb6a7ca85cf0c0f475349036222612feeab1c3c90f11590
MD5 4cded9c7e53f89dd8d44750d1b06e3bb
SHA1 166e660395222859d9363655811a4d88bcc6f0eb
SHA512 3d89e2912c3a140b2c3fe62b2f9f4e985e1c22abd2277be772635486dbb8986dcf8e9f321aed998a66d4a465474bbd2031b353b2e7777bfdad70c655aed3eaf4
SSDEEP 24576:NXYfDtczAW0qF5u2p2c8hIG6b+zpdhWUA:YtcZTod6bMpdhW9
TLSH
T1C065F12873E408F9DD67827CC9A2C501EB33BC9547A0EB8B03E49A655F236D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6a9bc20a9790d6f9bc38d4ecf3eebbaad14d76ad7e8f45f80f6a1e5275898493
MD5 a5c5d2d7339142d51ebece3da583ffda
SHA1 745e60206f43136fe228d740b320cacf34d18ffd
SHA512 2d566c4cd91efa3eff355ad2cf0a432979b47cd6e61e8b5767cab1d1c658113c9367f6595c03cbd2351916073331b216ae29c8a8cb1fc06775597b823d4c3b87
SSDEEP 24576:V0Le5ji0hmxirMf0qF5u2p2c8hIG6b+zpdhWUA:VPji0Ac6Tod6bMpdhW9
TLSH
T103859E16F6748331D073C0B9C5D2A68AED7230865B308ACB4295D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ca82d571f3163d08815a487d0d13e0fca9a5f8035cf8846358a3e8eba48c354c
MD5 e05a37fd49de0efa3417872246683533
SHA1 e78b9e3baaf926c9f8cedd4cc25d03890da9b5c0
SHA512 678faa6c58837bf7710bf0c4a789bc6b49937d432c1bc7524174172555e8b7279eb22827a3a2c1c7d1176c17300aee382e435b8cf5f97ff83e387f19fa0adc9e
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuJ0qF5u2p2c8hIG6b+zpdhWUA:H/ezSC6vUzPvxHjymTod6bMpdhW9
TLSH
T14E755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2be77e6c9d1f434bbb0fb41aa9f30e31e77653c30abdf2ff6d537b6d68ef97ff
MD5 ffb0336e08aab571c719131735a391f8
SHA1 05246e5e842e79551ce849fcd21a197785179131
SHA512 f4e78c3078e62496cdc73c6d7fcf4cebe6ada11eb8b47ffde7cdeb2447d1049ccbd845cf4f6f4ae57261a33bb4dbf2b3ab07233d2bc3c9b6dde51d1710fa3104
SSDEEP 24576:MVbqPb88hv/l+6y0qF5u2p2c8hIG6b+zpdhWUA:MVO88hXl+LTod6bMpdhW9
TLSH
T119559E66F6748331D073C0BAC5D2AA9AEE3234415B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0fa515094905dd7c81b5ff9127cc576322c5a77e118573b267d7d232e8ea67a4
MD5 f1854f0ca5e334c9390ebb9ea63c06b0
SHA1 f857a187ac2658e3439f50105b2a4e4c97e1de99
SHA512 1bbb151829da6e9cbb7124dc87e51e9d9f84fc24cb3d4aafdf10c5cb00be20e87fe28a21c435955bfa34d1715d28be22087f2748b92cee10b5287007df756ffb
SSDEEP 12288:aRofLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:aRL0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1484523112798B562DF3B9AB9AA8DE980E74EBCF4DCC36D0794F0775496B0823C1F9901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 aa0d5e927711faa429f6f0a470d3968b681baea2110179e73f29c25eb60b8c4f
MD5 3c9794934de65e64292d6bf83f9f952d
SHA1 6182907587131d1d455512a003d63859134b668b
SHA512 6340926624e9cb3fa31b9d796a129e038f6cd50db5c5b164cc8ba224e906ea1f138c2a52e7b663d8ab085f3bf42851c90fa55b1ef33c1b0ae59c76e97a44ff4e
SSDEEP 12288:leBNUbTVO86UFfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:lJIUq0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T15865CF3BAE28FCD2C27E8DB95A91C640E76278704F52A3CBD174820EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b9f8bb9cb676172e54595bcb62771ef28d5de239573b1414e9d3c31dbd366ae1
MD5 e0ea38353cd34977e0390db19c065569
SHA1 d88355fe7acaf1346de5efb39933d152785dadb2
SHA512 9ae7352f34fa9e2966f8b8672e7f8d5486f8c04ddc0d472c27c33609bce92aabb05eb0e0142a001e20767e081e051c4085b7555eb4278439016e57fb303c6d2f
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:TQvGAdlCEL8c/yRNw5Ca64pdhw
TLSH
T1DB266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3944a607d97391bba3c535e56c14cc7931d5e853b415d7b3c9e8c86d919dacab
MD5 962de665e7e140582c95e5f0b5a2402d
SHA1 af75dab7cc4a7ef2dbcbc5dacad0e60090b5afa6
SHA512 ebf609b950a0507cff2d04c4c6ecc1cd941c59b42b73a176f0f6f2858cfe24a0a0a3e9a3c2b01f0d845867d07aa222cd1c6a88b734b547003790f92c26963a39
SSDEEP 12288:iAwSfxL/2Dc34DLLmt0LDQewsAjHfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7p:ndewsAjk0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T19575E031FB74E032C77F0DB61B26C706542DB9604F922AC3E3E89A9D99701D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2b5aab3b7ad14496f2a21c0861e157093e63b84ee7927268948ab6284a953c9c
MD5 1cb5cb462116243535ea9066f54f20c2
SHA1 ad6e8fb8f1b87e000092557ab63116edc9ea7bfb
SHA512 1d35320e00c69a4ca056401b83ef23edcc8bf8406b3b021f3c9acb05315eb8619800c807110e443f3ca3c8eb2dbff9410e8657a3d7bd94e33e84aac253411726
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHU4zhw:gUEtQevvqc2W1cpV2EI325y
TLSH
T176474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7c2c5cb87ff45719224fc7cd1fc65b2c37287ab51eb20b97d6703d37f7b22d61
MD5 904fe90baaad092a7cd45b6fc21242bf
SHA1 441996fdd909cc86688b3d1ca902bc7d98949622
SHA512 efe969c0580d82fdc2e8527c249e810312421092c9684a714a0c4b6da6cd4498706de77bc19421bf2fd412c5c57569c10758feb5a16a943f6a4d48caaad84faf
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zqTod6bMpdhW9:7oqtVjnmW64pdhw
TLSH
T164D58E0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bd252f0718b405d0b1e42238d6eb3a65ed0b4f1a4f9aaf5621f8c17faca195f6
MD5 03bb433c5f38b2aa9c4fb138de0eeffa
SHA1 f5446a38cdcf36892cc1bae884dee3e54a742e01
SHA512 c2163d611d78db8618cdac68399f5de3412e55c79c4b508f673dff413d5d347cdba832fc38e636a1816f3e772c417324368fb3685f4eb480cf4447d1f8f7113c
SSDEEP 24576:6AhGLJIFoiwtA5l7S53N0qF5u2p2c8hIG6b+zpdhWUA:6AMyFoiq5FTod6bMpdhW9
TLSH
T1BE35AD81E7F955D4F5B3AAB899B68570EA76BCA95E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d9659c60ee95beddea0ea3fa7aadc12039e053df6ad03a59254262390a21ee85
MD5 4f59e8d4549694eef284f219930e46c7
SHA1 de640796b2fb2f892db5a9e846df1e611345b4ee
SHA512 9459b1c7d22b3aadad18eb1f7063adf56d06f88ab920d46674af340d3daafbe078dad97fbf25adc4426db8d0d949dd02aae91172ab89cd2918a3f9fa4437760c
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+COfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYD:TwuoOWY0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1E465F10637A41CF9E96786398687C536F7B2BC512A61DB0F17B0C65B5F33221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8f2465502a542321b89faefaab86cba0ad301b88ca4df69801a567711ad45cd3
MD5 1130f8c6f7ab301c42a8d96e452f29d6
SHA1 05cc89d549cbb3ed22afa7a1315961f05a820549
SHA512 0f3bcebc7b8084aa216d95c9f95ffd0bfd980048dfbda8a0eb029b726e21e8344af309109442e196be748a79cbe7049d82b1365497041ab321e21b2dfc46d699
SSDEEP 12288:WBZ1IyXfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:gZuX0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1BE55121A33E830F5D667827CCDD99A40E7627CA667B243CF11B042A56F72DD28E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b3166e0bb90c0584e75230431075ab6c9063c0fad92fab6c5c85d7fa6b0c576e
MD5 f5117a9d894dd0731f581fa148a96dc1
SHA1 6768d7868ac0fb431949419674f6f4d894d25e55
SHA512 ea2baece03abe691553506136b886a7e0c23be4119ba066592ed127ad9e53ee4e939b4f0b799846571e8b2a59655e3cea3f8ca6c3db2657f9c6c5c4292e5c472
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:YQRQyi36YOcPQLvw2gAf+PN3P64pdhw
TLSH
T149667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a4317bb19506beb9db868619428fd10a4759852e8fa309f359bbadb0cfe7f475
MD5 3ad422a1a665abe8b854e8ee7cbc2e82
SHA1 c4f09332425400b13902980d4445571c920b6da8
SHA512 c593a388ed6c5717e9e8c9863dd4931b617c31528006b7e57f9d33a5905286a6f61c3c978cf0eb1590032bbb6b8bb40c4c8fd64373661229f69edb4a04ab85a5
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:+QRQyi36YOcPQLvw2gAf+PN3P64pdhw
TLSH
T15C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6b0df6272f582113a509ad9cac885a665fe19c2852c398ed9b80381354f15d84
MD5 6e8bf15087d7903c5ae119b1fbfe0ec3
SHA1 2335f767a58402b90af0378a2a5356742c96618d
SHA512 07a863f0fe9030ada1476504f0dfd0c10c7004a0cbfaa910b4d7725360318b1970766b660b34c0edba155446b635161050e7f62d9249c5ac8c208f3d305e0836
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0n0qF5u2p2c8hIGW:V68Qg55nhheWu7PNU3/6Tod6bMpdhW9
TLSH
T1BEB55933B2F200A9C44DE1769F4A872196D27C75CFE1E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cc0e3ea5cadbf54c75c69203464004af63c70e5e7aabaf6349c41a5d825c92ad
MD5 717cb1ce4f9690baee0eb087aef760b0
SHA1 aa25f9d3673b45f06d37f9f1ebb94d167f53540d
SHA512 8e85952c9580935e16fcb0c4fd31f28c0921a86d8261dc45ba65426537bed1a9926838ce7b6fd76f918bf62d70d610d4215665be62b5690327045b5af0ce0140
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:my5112gYy5azzVvL69nLKnhZo64pdhw
TLSH
T175167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c260ea47f8c487a246a6306c817d1e6be2c90d390bea90effe642e5b37cb8935
MD5 7ba842ad431825a18189e6b940dbeb30
SHA1 b7997c83e3539fb480b5d2927e58dc513b0caa3c
SHA512 f7f5bd5d65984d5f735ec45d7ea9b7b48e1ab209bcc23b0c7356679afb62e2c569502e8ba967e8a8aace59da648fc6b61796521286acfbad51fec88d5b34b19d
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqTod6bMpdhW9:Ru6JmVxd2dR64pdhw
TLSH
T1B2D59D13F2DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 052a2368aa8376ef94e870bd9dd538eff3fe9f1526cb1529284ddd8d1459ed24
MD5 65990dbbe33d168a7bd365c5a2f7839b
SHA1 0f37666e991245072b91feee8511b01971d766fa
SHA512 7f4fb1a31545b29147644da2f16e52a8cdcb73d8b36c349ad58dc48390846480805d3049ec60fccf76790537b480b9b293c73ea9ca66e48ac48e0e253fc09ed7
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4xITod6bMpdhW9:wmifPbRW64pdhw
TLSH
T1D7B5BE13F2D900E8D06ED178875A9232EA62BC450B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 38abc061225afa6ae1030d30526d16612f0045d78f0da0951e582795b499824a
MD5 93433e27b082509f2d346d3e61c7e927
SHA1 756cbce868111d2c19e166a41c07291ce12767d2
SHA512 69d060b28752b5fcdc2a1c223227c4c3cbc5d7a792337c69848b3854751eae94f19b2d6b7c28b553c927c689b11ef2a5df97310630732fc15bfa28c4cd0a2ab0
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqXTod6bMpdhW9:a5dKTi61864pdhw
TLSH
T13DC5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 382456cf03731f0f2147e9a97f9bef1499e3b57ba6d401088c4d791c9b0638ae
MD5 fb1b6086607715e2f3598e5667035d33
SHA1 07f344b3e069f5faca96f3f12f9d1e1e632b1e31
SHA512 1ad1cf82e9c487658ff1c4ccbf816d98d98104cc5cce660ba5d9d9306d6a8c45b4beccce7f1a73728c19ea55a1242042149f20dfcea1bb2c6476857ca42e87ca
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5w8Tod6bMpdhW9:KX2iyphy64pdhw
TLSH
T1FF95BE13F2D900E8D06ED178C7468632EA62BC150B35AADF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7e2e4147f2aec594337e8b5846986152bf3e4b595e36b73e4972f5e38426aac4
MD5 bb83e0f4056358683ffbabb87bfd8a6b
SHA1 b5e9aa593b08beaec2d8aa356024fb818397aed1
SHA512 efce6234b49552988c574297440c8a6dd69f1d454f54b881e3b764a145e16240f89d00160fb75182217f255287b034e70be2a28b5740acf1b77f700080ee51d3
SSDEEP 12288:KQfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:KD0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1684523153799B666CB2AC6F99A4DD9C4E74E7CF9EDC3290BA4F46210D7B0C2381F9900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6d33de46defd234c90ba45ea2b8a1ac3db7faaf3bf17b2e9b7185f186710109c
MD5 c68f55ef6dca22ad94150eaa4351a516
SHA1 4bc3a1d0dde9279ec2fe8dc4a4c6664ab62bae25
SHA512 29004db5a9b35088270aaad5f412e3cc84b0408b35354f647640a71a1bef56badd195d95575abce251de39f1db1cd1e816fdad20bf42ad24cfe9b0d9af84820b
SSDEEP 12288:iLfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:ig0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1E745231537997666CB2AC6F99A4DD9C0E70EBCF9EDC3290BA4F46150E7B0C2381F8910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4a96f469405da41cd1d6afa23515b3540ad12848a1d0abba9043b9509426d1f6
MD5 a204cbdc7ff569ca4cc0e2c91ef5a8e5
SHA1 5f52b10d50d22b8256ddd559f3b4ce01fd882ede
SHA512 0e7bb7fb950c7c09643ca3ebc39f2cbd21586960be605a68e643ca40ef9036c83324c741e29535aa38f33993db1ef5db6c8c429b4cb9157de2374b85937ef66f
SSDEEP 12288:LtfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:LC0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1534523153799B566CB2A86F99A4DD9C0E74EBCF9EDC32D0BA4F46150E7B0C2381F8910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 49d92abb167cf719480c1337d96b2d34ef920eb67f8c0f960fc9c1408590e029
MD5 861c606f220162a69154703726fb07cf
SHA1 9a9abb7fbbfd5439d5d624bb2dae735d939ffd24
SHA512 978f4d911c565ed2105f3320eb133d5381e903f1dd18797fa877469a859f0a0f622bd94d87215bac4e029d91f17d426a56410fd58f328bb7c55bd0d28ff25de3
SSDEEP 12288:vVKfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:70qF5u2p2c8hIG6b+zpdhWUA
TLSH
T13145231137A971D2CD37C6B9CE4AD580E36EBCF4EEA32A0F95E016545FB0962C5B8E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b06bb5d28d2b75073f20bda5367e31b0e75742c2137e4e0a3372e6a3698abab5
MD5 c359210889bbb6c375cd14cf0501318e
SHA1 68f2bac924275340c3d5b678327650b280b36e38
SHA512 ff92c1911569dea925dbf0c85325252ecc4a5f3aa66e9b9114bb734c51393b1661caacca78dd818d5647f0623ecd6ff1f819c2e95a4bad52dd3012b8ef8147ef
SSDEEP 12288:5CfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:5V0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T19C4523153799B666CB2AC6F99A4DD9C0E74E7CF9EDC32D0BA4F4625097B0C2385F8810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6015b0ff07e6cfa6ccf95dae53a355f78dbb99ed6e11216c2ce7f7e1bcab88f3
MD5 1577b3e9330de8a06e2d377533db2f8d
SHA1 0a5d9f8df6fd12b6d3e5e04434e7616ae9501976
SHA512 06b6cad20587bd3fcb5bcb1ac4936c31f3fb2290aa1ce4e6aaf586f8996f938f87d6add15069e24de8d477f1d5f419540825fa9545116e78750fafd0abddea56
SSDEEP 12288:bPfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:bc0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T18245231537997666CB2AC6F99A4DD9C0E70EBCF9EDC3290BA4F46150E7B0C2381F8810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6868ad03f8f3c5dd626c86684706f5fb5f01657f570faa2330a6ee2a6aa23b30
MD5 f257e37440f1f32614cede991fe5e145
SHA1 f5ffe71f418b1fec4cb1ec871a8b799397e5220b
SHA512 932eef0358f9d1deeb178c64980ae9a90d00d35c0a6a898b014c26362a026fef5581ff13a6db6466753ab921a64d88a18db195eceddc897398709f50569be121
SSDEEP 12288:fDfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:fo0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T11D45231537997666CB2A86F99A4DD9C0E74E7CF9EDC3290BA4F4A150E7B0C2381F8D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ece9323e7c68895de14ff2e91ab427e87cf06839c42dd55df8d6fa07a40ee211
MD5 9e897f75613a9b44ac3db568efe81f49
SHA1 83f72dcec9018e553dc74c4816f25489a1e9b136
SHA512 7802107c07b785e1f20fd78cb7e8798662c531a156f84321048448c36fefd41fc6289cf9dcde87ad085222f28279d63607daaa7fec4e2a2dc0470f2388d29e2d
SSDEEP 24576:0ZMSzFVSOA0qF5u2p2c8hIG6b+zpdhWUA:0ZMSzfyTod6bMpdhW9
TLSH
T1A4650165739028F8DC67823ECD558906D6B2BC6A4BA0CA0F03F436665F733A24D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e07497a8e2d4acf4293a07cdacd81cc0b2b906389d4a70c4f3e341699f866133
MD5 e358932d37791e4e64556eff8ab77154
SHA1 9b8a2f826ad9ca58fff013449469e24b2326f23b
SHA512 2ed528b32aa6863640ebc2e02eedd0d867fc14d024fa31866b8fadab2e190d6efa15a1ee2bed8f9e7fe559f0824c9d171923022f6ee05bb5a7f4353d02a03ed6
SSDEEP 12288:p8fLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:pH0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T19945231537997566CB2A86F99A4DD9C0E74EBCF9FDC32D0BA4F46250A7B0C2381F8910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 997f7a8de4a6b1aeb67c3d3ba83e48a59e1919abc6fd0d32508af3fbdc8a5391
MD5 461044838ada781693ec17e982d93ac0
SHA1 4d26f24cdf1aade05aff06e1d5e68c3c40363e69
SHA512 a7269262c3dffe6054aa5485d68aa7172c88085bdb639201810b8f6072a2d18c8d2336b52e5ed5ca7dd115ea737197f642f2c3c6523a9e6c69d17c481529c633
SSDEEP 12288:a4fLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:a70qF5u2p2c8hIG6b+zpdhWUA
TLSH
T13645231537997566CB2A86F99B4DD9C4E70EBCF9FDC3290BA4F46250A7B0C2381F8910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4c8b3d5d0ad16f6db5fd4f1e0f21fcaf3b17b9cdecfa5650100379cbf4982f15
MD5 ccd07654db7cfdac3eac079fac4110b9
SHA1 e9f5f2028310d3aba9cadac4b0564b6fc5a56559
SHA512 e90c5bafbb670596faf47316d5b316afb165b73f035ee39f5ac3f98533f0886f3bcb55f92053a5c36b387d3a03ae3e3830ce302dd1c78cebffbd3eb94c07510b
SSDEEP 12288:AyPz5L8XfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:xzyU0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T15455121733A530F9C5378278C9965A01F376BC764B619E9F52A003762F336A19E7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9e586617417f4bba7d9baa63a00a6888bd52fde221febe197876be06f40e41fa
MD5 3e645fda883cfa0426a2f28b4356c2fe
SHA1 479276f2f3aeb4f83bfc429ab72faf767a8668bd
SHA512 8a7dca5da43a2f20da5c960e769a03591e691720e2f07c5e8744a49a0f43fbc987f0e0fcf95a6887534fb1e8a298e5399651a04f5887fdd95e56cfbff9eb8f37
SSDEEP 12288:/8fLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:/H0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T15A45231537997566CB2A86F99A4DD9C4E74EBCF9EDC32D0BA4F46250E7B0C2381F8810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 49ccf9336eace3db8fffacd84b6ee947b37f2b86c1423227a9246ec711918796
MD5 8c2cb81776cfb175d32e5ae405b6c50c
SHA1 85729c85f68475ece7cfc1e0c53c179c887bccbf
SHA512 af2b4c79d09b113466d67af3af9156abfe2330ec202d2e4f1d1aaeaa254e02baa1589e593726c5ff7a0bc3a01dc4c9129851c4668f796bb1b73fb9a6fe8814ae
SSDEEP 12288:B8fLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:BH0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1FF45231537997566CB2A86F99A4DD9C4E74EBCF9EDC32D0BA4F46210E7B0C2381F8810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 023cf172dcf4f7a6d00483df86dc3150ce7abfd245c1d8af2ab28c62be3d434d
MD5 117d14320b780dc21f719be89c943da9
SHA1 eb007820a3bd7a2525b9af9b1b6bbf97a3cd4928
SHA512 7da079a6033eb2c0a710abec725f0a05e98ef87a677ab030808c33b984f0d1fdfbd5c66d565e9de7aba6780c8676e676dedc49ddd2a7405e20fbced84d21a94b
SSDEEP 12288:cyPz5L8XfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:FzyU0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T18855121733A530F9C5378278C9965A01F376BC764B619E9F52A003762F336A19E7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a75747d2e5c4f86e8789c09e21b0939c22e0f531d470fedfc49b45d8349a9237
MD5 fedce5cca76c6167c2782dbb915efe09
SHA1 32549b631e77519e68a57f5e8762f65390e41421
SHA512 fb7237013523d99acc177ff59a46cf8922bbd013ec6be1223bb03a3c33ad5b9c7067133f5f4a9c0b16db2205682bc9bdc54f033e1e55f320fe415b0274e5c76d
SSDEEP 24576:eTHaLl3z0zDS0qF5u2p2c8hIG6b+zpdhWUA:eT6LljpTod6bMpdhW9
TLSH
T1DE650164739028F8DD67827ECD568906D2B2BC6A4BA0CA0F03F436665F333A15D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 16b8a47bb054bc7285565b754171cb8e4e417c55497715b0381a9f791bcfb1fa
MD5 d74a6ef269f176682f3b96e850caf33c
SHA1 cf8d39ba32863d0e2c0b7345de11a28616e2c51b
SHA512 509bab822994f7b0fc229019c5bc68130b78b4b5ceef7df51062079c872c0e299215c6368e86a866b98f82a9cd6286aee1c5dec79d48eb914f5799e3cf3ca281
SSDEEP 24576:B37d9CHKy7GZu0qF5u2p2c8hIG6b+zpdhWUA:x7d9CHKyayTod6bMpdhW9
TLSH
T19175CF90B3E410E8F1B7DA35CD668511DAB67C995B71DE8F03A4261A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3cf75d73368167753b7365a47144fbd5103703cd406b9f44f9609ba620c163c1
MD5 20b91104c8779d19e382ec1bf2829da1
SHA1 e191a54bf95f47729e1c7d3ce087e3ccef474a38
SHA512 27c89116c4d470e2ee6da6a43fcd64fe9597dd2d7410a894988209fc57745c13aeceb6887b508642f42f84ecee67ce2c86324b2f625b1977b986348ab2137662
SSDEEP 12288:cNfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:ci0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1B14523153799B566CB2A86F99A4DD9C0E74EBCF9EDC32D0BA4F46210D7B0C2381F9910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 69d966bc59e9ccb1b2076bcd0993fe6a01fae8c7d44c821e64359ac3e2c182c7
MD5 4fe78e1cdc85e54b7efb6ff49fa7b0a5
SHA1 f1d1d24b7dbed343c789c02ce6db34fb3cb1dab1
SHA512 f1798b17f725cdc621cdb98e4d4c7266aca124e9ef42a16674db9a6037e73612fbcdd2d65c5451f55ceeed8ba227fc508d746ecda469254d2dfbe960983472ce
SSDEEP 12288:J3fLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:J00qF5u2p2c8hIG6b+zpdhWUA
TLSH
T17B45231537A975A6CB2AC6F99A4DD980E74EBCF9EDD32D0BA4F4611097B0C23C1F8910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9dd007d5d7253030889840b0f864d82df3dc72680152df16f98a199fd468e5d9
MD5 38d71a0bb6887dd7afa47cc7616da7da
SHA1 4ec4c52299e50b7ab2bb53d78050c0c7698daf27
SHA512 4fcc6a57979399c9d84b3ce62b007d89bcf4ce81af420cb1426e600f2a4427393cf06ce9749d4faebfc33e4439663b9d20146f1079c431127ca721d69aa90538
SSDEEP 12288:1mfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:1R0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T11845231537997566CB2A86F99A4DD9C4E74EBCF9FDC3290BA4F46250E7B0C2381F8810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 67d26d83ad648308758b900d54a43432e367203244762fb17721994f5fa76a75
MD5 ece0d22a0dfb995136921d139816da5a
SHA1 8b11808af2ca719a30cedf0e161226ccb0e081d0
SHA512 08d11046456c597082518c788228e99ad70a153c2e4ee55fbfb51febfa27467d6bf339f65c06855d0b28f8a87f6ad23c888a0e6149b0d4f051427cd680ca0a32
SSDEEP 12288:E8fLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:EH0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T19945231537997566CB2A86F99A4DD9C4E74EBCF9FDC32D0BA4F46210A7B0C2381F8810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a01224353820e7acfa2fa52580228dbb281fa0ee79b4a12a3f9d6dab33d38940
MD5 41f8c9166e8db65d6976770e3c245cc9
SHA1 9d5496451906791855a5613227b053a495135b9c
SHA512 85970897c7a1bf17201763b995887936a1f3387594f5389e80ab0fe67e09cf8c2b02800e80d267add5bcf1b55f0c989ac4ef733795ded4c69bce7e90837a038c
SSDEEP 12288:GNfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:Gi0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1D14523153799B566CB2A86F99A4DD9C0E74EBCF9EDC32D0BA4F46110DBB0C2381F9910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 aeec6401f74b60329fceffc5afe30457283270d87dd85b8617f663f65ea09897
MD5 40f25e237be77d6ddd1f6f7f658527b4
SHA1 5ff8d08012751d639160947fec76c6040b8c4609
SHA512 549e4789fc0e9d7f150d7ef4ec26cc6de067f5bbd1c9485b55f01aec8011ef3918cd592db4999646244b9621760083fcc036852abb111bcec5a5c9126b1680fc
SSDEEP 12288:c0fLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:cv0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1CD45231537997666CB2AC6F99A4DD980E74EBCF9FDC3290BA4F46250D7B0C2381F9810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e067dfdefae032f5bfaed7ce739b36589f49b30131904f5910809f3c56b8cb8c
MD5 eb8e669f5183b95a66556c5de190e89e
SHA1 d79d17f68b82ff0e6514b55e961850ba6a7352b5
SHA512 4a8b62487c768fa2563f58546cc65a1aa7297d3d4ec579c013aeb4b284fe5eb697902e00b5b3a6f8762f85108bc8eb887abcc5674670d9bc50e61c26dac5c6b9
SSDEEP 12288:VCfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:VV0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1D04523153799B666CB2AC6F99A4DD9C4E74E7CF9EDC32D0BA4F4621097B0C2381F8910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 fcf8960d6a11c60d19e8fede3e3c9ff0e507e81277a9077f37b4ab525f86c9d4
MD5 1fec316c88915cfb616532d4c35ff6d4
SHA1 564a82a4b0815359ac5034fe529ecf8063671946
SHA512 6a3577518896e5f758aabdf37e75f08b89f8ab6ea75090d9e8ab16d568dc014d81014ad16e911803936a3f128b1ce4556c7581961466d087ce17de6668b9ed79
SSDEEP 24576:Dfwvok9RX6wkyAIr0qF5u2p2c8hIG6b+zpdhWUA:lMnYITTod6bMpdhW9
TLSH
T19985D029EBDC44E5E177923C9DA7860AF6B178691B31C6CF029953AD0E33ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2154259fbffca722620d2b44158eadfa28ff4e23a3152d344278b59ce2cb3340
MD5 afdef25e47c31aaddd3000c78bb5c66e
SHA1 4bd70b1011414376afafa86dc0f2448b9267f2d9
SHA512 7e4d1c26f8a7b88bfc94751cb1b3745b3d0e33a3c4b5d831d45fbc3f115e0f848ede67c6748d2670336322d68fc7eae9c8e3be94d5a32a8d274592944349d731
SSDEEP 49152:EYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cTod6bMpdhW9:KySzPv64pdhw
TLSH
T1EC066C56A1A841D5C1B9C1B98F0BCC1BFBB134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 35287f47726e1123b58b7082fbdb37daa9a86044a3d25c6cbd47448b521e1e63
MD5 31482707a049d8bc299312310dd11de8
SHA1 8e84081ac084e6624c59ba41923c8e65734eb763
SHA512 686bb7c24a6c04763e589e744ccd8d434a4471508156dff8538cb5c1eb8e58c9bbd487e4f3d48edfad9cb1e7ba20a106a5ca10f4ddb5d601f591282a156720e9
SSDEEP 24576:d47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYw0qF5u2p2c8hIG6b+zpdhWUA:d47JUQj1irIhCnDHUPfF/sTod6bMpdhw
TLSH
T1C565AE1DA3EC01E5E17A927885158A5AEA71782D1F32CACF12B0437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 56be12ad824213b14a1ddef2b740b78a68621fdb6e0018f9bbb884ce19e96338
MD5 a0ccc3ab364522510d4dbc1bcfe547a5
SHA1 0a804c0d86666ab89688f341d726f73c094f4e20
SHA512 1ce1b88745056bea7a12630228d19505f717be40954a2e1aec74e85670efbaa5d916bc69546b96a074c1b145f7a40c394e831953064ad934e4cfbb0122d41e05
SSDEEP 12288:jNsfsfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:gX0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T1F9550119D39812E8C06EA279CB4A8A40F3277C6597E2D3CB52E0F53E1F715919DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8ecf54c1fe41241a22bfc321a27c73f50c63e330a8e4e185e5aa6f4e19c3d97f
MD5 ff2122cdaf3e5e498b386a49a34832c9
SHA1 f225d1d7ee0f4166f371217a2156c2995909e040
SHA512 d1e99be7ef10250618b367efe1ebd3247f75783bd45c0ed8b81dc3660ccce8028842152beb946bfcf4da56d2e2caa0803bcd7729836dfce1a781dcab8d61426b
SSDEEP 12288:4I6hLXEU3fYkEyUIYIp/NBuYVA9kuUoyvGqMPOiv/poS9jB:4I6J0UP1i7Ty+qMPOSpoiB
TLSH
T11D3528017626DB5FC6A940325E33C2CCAB707D01FE456B0372C98B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 c26a692db4cd16f9970fae7618f50f3d0ec66ec160ff0522edb29d432c20e5ed
MD5 9fb2c102b1907ece8734f3b8204f356b
SHA1 4c6f63fa99e2203b334d072cf7235b924f7e4bc5
SHA512 67af6c189cca8c84972588e3be8b97ab6c432d930fac284e8fcd7f044c471379e69a35c0e712c66c949ea05f8b29972df0b4dc79adbb9463bf101c350dc28523
SSDEEP 6144:DYnUEtn/Bl8bnIWCZ73YZNIVoIMAbvF2XFQytMxlCfBeiEodQytMx38//J79Myya:DYnJn/BCbvZ42YwyNwK2bdkzn4Km
TLSH
T11475F8815536E78FC1BB603207269B4C6BA8EC06B7096F2773C9453BD86A751B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c1fee56f79778f6b40c17af8d8330d1d3f751c469c37152e0fb1fd1881b0ff54
MD5 b4677e0e5b541b5d8ea2759e8c54e270
SHA1 820ca0d61bd953119a386a9ae4b2b28a3a005e4a
SHA512 00c5f5130c28b7fe8c9d4782b59d17093f97922ab33a553e78c57feae203ac05419a96c41a7dd53ab37a8a10a54dbf75205e976a46c3cc5284cf25f1559e25b2
SSDEEP 12288:9M7kfLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:2/0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T166452321239CB956DE3A96B85A4ED550B70FBCF8DF835987E4E06250A6B0CD3CDF4A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0d555d041b522a5a1fdd190eb8c71291219b7d2329eac0034164297acb0b0c57
MD5 f55ed1ddfe9ac4c22f3a81eb5934a22f
SHA1 c6870c501892069dac60fcda0d56f782edaa943c
SHA512 66d9ab7a44818285722b7d58105e191f471c1e4b3481b20145dba256cdb9b874ccee9e46923c178589ae0abf68206f9f0f58ac50eeca27906a3db7b302da3e7d
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYJ0qF5u2p2c8hIG6b+zpdhWUA:Jgb4mBIBhGFeTod6bMpdhW9
TLSH
T17565AE1E22EC02F5E0FAD2B8DDAA4417D6B278161732D2CF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 331fc69c242c4606a8cd9449dd423b90cd78009f2d35ef8cbc009aa1ca7526db
MD5 0fd80647f2da67390d79b51791c4eb07
SHA1 3e331fc0ed4ca1e8df59c397da7657958c761613
SHA512 0b717e97f7a206b9efe013a5c965e1116cc241b0bc5c58d440632628e2568fbb07d857b92482c6355794734fb0236e7167e3053ebc0952f82f9a5891b2ecb1b0
SSDEEP 24576:4G88u8FpJqH1bzria7/mA0qF5u2p2c8hIG6b+zpdhWUA:77ZFPqVea7/RTod6bMpdhW9
TLSH
T1D885F12577E101F1D47BD1388A864663F6B2B8250365EFDF06A88B511F23AE14B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8a9730fc3bf3f562c98dc3a7ec2ac532519ca19f414058fb3c57ddfea621ec40
MD5 0a39615a80ecf7efab9fcd139be76d9e
SHA1 14dc383633b56296885af4b0e1f3dc6dff2fa480
SHA512 df1e1fc82a063fa501fc9410f777e9aac746ba250cd94022ee337d8d56abe83327498a78d5c7eedb07815af647ea5745723f65586fccdbd5ad0d9dec4d6444b0
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjiTod6bMpdhW9:aG05lO43bA64pdhw
TLSH
T118D5C06A62EC11F9D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 792b05590ccc4bf1de84d05d9134903e27358bab1d127792a001ee300012c3a4
MD5 758698f75a1c91ec6e7b3a01b56afb01
SHA1 76013a88a2257d4f069a7439bbf421cdbaf330cc
SHA512 6e59aeedd1daea037818d751806cb952a3a60d75b3fc961125aa04ce5080ee6937351e62bbafb1d64dbcc822bbdb4e57b386efe4521de20d4296a6787de04b59
SSDEEP 24576:tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn20qF5u2p2c8hIG6b+zpdhWUA:da5POZ3+Jt2pasx2+m6Tod6bMpdhW9
TLSH
T17465AE5EA7FC01D5D579D17DC5838A1AF5B1342153329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 96c38b804852870f9400cb9f8dc187c0031d020fc9d52b5feb25d14481869332
MD5 1ddc82c567635b22edb432b7fcc13b35
SHA1 730d4bfeff5cdff2166d5dbeae7a981a9b601955
SHA512 24b188430927a7a78f7323908b32f73fb703eddc182fbdd6cac17da4adab55c84a057df22dcfc70006d984e009d8788a9305cfde88d7933bd42d4fabbd3a40f5
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fk40qF5u2p2c8hIG6b+zpdhWUA:eNc/zEOVHFxTod6bMpdhW9
TLSH
T12B858C2623E901E4F5BBE1BE897B9546FA71786553308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8414c0f600d0d71fbdd4da4724578b035b6ebe0798385b17f31f616dcd3b6b39
MD5 1632ac391c6760da7b8d5edc8198396e
SHA1 50ac61e39ab93748bd1afb0d5b48cd412dc3839e
SHA512 46c3438cc96ac4f2971e4bb0d0dc948e7692fd047b33dc08a071f20f5049ee4b4747556b6be1be3311fa2cfc2edc7d100c5cec0d9a7c55bf24e597fbee268ef5
SSDEEP 24576:f8kNvNnaFeYhJNtmZBmQ0qF5u2p2c8hIG6b+zpdhWUA:f8MwBtOm+Tod6bMpdhW9
TLSH
T12C55AF2EB7B846E4D1FEC6B4CD238512E6727861073293CB5290C13E4E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 abea475fb30a9af58ca13b729b22a52303485da5116858fc20ff74d743b0b656
MD5 5318e4d594754d83d5d4653eb6c04549
SHA1 52c56aa3e344cb19ca43dbdaba38cabeaf5c72c4
SHA512 f87febd758d8e682c1bd99c85599c6cd884eac464e02192ee0d6859359527b1f0be40c6bfda322e826b87af32408e6c5947bb75fc92ff4a3734786618e81bdb2
SSDEEP 12288:MHvUrBFrEjwaQffLQ02aO9jaNM5up2utmIfg2cT4LR/IGb2B7V+vLYodhWBiP3I:MPUr+NQM0qF5u2p2c8hIG6b+zpdhWUA
TLSH
T13065E12F23EC18E5E676E17D89868609F772B862175296CF01E0817E4F63DE4AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d6a602c4bd2c217ead3c681c4beab42614012b23da54cb50d994a0e4816c0546
MD5 1591de17cb5c3c119d5582c58908b54f
SHA1 163367d3a9c2312d48a52664df3d94caaf729664
SHA512 48b948a121c538263fe2fdb5118476bfc606ef914c0d5f52baf48d139c0f00b1431b0884ea7090dfb0cf79fdea3bd8967ff743b62b7ec0114f2ce3b6869a92f3
SSDEEP 24576:DD3FHshBIYQgAj0qF5u2p2c8hIG6b+zpdhWUA:DDVHeBIAArTod6bMpdhW9
TLSH
T11275E13EE79C04E4D57BD1BCDA538A06E77138A903226ACB01D481B65F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/936-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/936-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/936-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1324-47-0x0000000140000000-0x0000000140433000-memory.dmp

Download

memory/1324-0-0x0000000140000000-0x0000000140433000-memory.dmp

Download

memory/1324-1-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1324-8-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1324-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1324-44-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2788-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2788-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2788-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2788-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2788-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3436-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3436-72-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3436-66-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3436-303-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3564-61-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/3564-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3564-51-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/3564-57-0x00000000023C0000-0x0000000002420000-memory.dmp

Download

memory/3564-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3764-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3764-84-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3764-318-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3764-78-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4264-125-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4264-123-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4264-131-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4264-322-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4344-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4344-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4344-323-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4344-118-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4344-111-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4344-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5108-99-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5108-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-339-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5108-106-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5108-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5308-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5308-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5308-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5308-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5324-142-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5324-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5324-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5324-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5324-145-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5528-94-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/5528-89-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/5528-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5528-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download