stealc | 520ed213ffa60e033205d83412a024ac84dd4058ade5461fc2d7f9a8c65ac251

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.1MB
Sample260930-zmc95sttht
SHA256 520ed213ffa60e033205d83412a024ac84dd4058ade5461fc2d7f9a8c65ac251
MD5 530c76d05a6cf00dcb012dd626cdc742
SHA1 1459968d836bea4c0efa52807d54f4468d9acb6b
SHA512 a2e71c1d0faf623623f40e1a942402d8a5d15e68962a05de04ee8975ee133a1fd5db18e984ffdd93c9b0c15c4c12ca8677cf8b62b3201d5a4c5c0b481e3cf1be
SSDEEP 49152:iTAtjNPJxkkevJKGUJO0xQF1Aae2yDJfEccfuDoUIMuT3jhDmg27RnWGj:bH2adMmUhD527BWG
TLSH
T1E5167B0BA6B940E9C0BBD1798A579517FAB2780A873197CB4791475B1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/1844-35-0x0000000140000000-0x000000014042A000-memory.dmp	family_stealc_v3

Executes dropped EXE 10 IoCs

pid	Process
1788	elevation_service.exe
4632	maintenanceservice.exe
6076	OSE.EXE
996	PerceptionSimulationService.exe
3144	perfhost.exe
4696	ReFsDedupSvc.exe
4520	SensorDataService.exe
5880	ssh-agent.exe
2256	AgentService.exe
4192	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
	\??\F:\	OSE.EXE
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b933c9513a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zG.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a19d7f411d51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf8d79431d51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000110294401d51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac81d8401d51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013112a421d51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7e232411d51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f6942e421d51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
6076	OSE.EXE
6076	OSE.EXE
6076	OSE.EXE
6076	OSE.EXE
6076	OSE.EXE
6076	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1844	2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1788	elevation_service.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2256	AgentService.exe
Token: 33	4192	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4192	SearchIndexer.exe
Token: SeDebugPrivilege	1788	elevation_service.exe
Token: SeDebugPrivilege	6076	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4708	4192	SearchIndexer.exe	100
PID 4192 wrote to memory of 2132	4192	SearchIndexer.exe	101
PID 4192 wrote to memory of 4900	4192	SearchIndexer.exe	102
PID 4192 wrote to memory of 3016	4192	SearchIndexer.exe	104
PID 4192 wrote to memory of 5616	4192	SearchIndexer.exe	110
PID 4192 wrote to memory of 1232	4192	SearchIndexer.exe	111
PID 4192 wrote to memory of 5708	4192	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_530c76d05a6cf00dcb012dd626cdc742_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:996

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5880

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1900 1680 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2988 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1900 1680 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2988 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b5343753432279a2c3c306dcb06202c6e6706b8d990a3b3fae86e0c5a158435b
MD5 72154c8168efc6adcd40c9846d25d1c6
SHA1 db3436486d18a2321f3ca396277547821efbdfd6
SHA512 7a8c658d50f6e79fa7aaf91644746e6711513fc795929e710a96375a01c67c9d264f85d270f8c485878efa01371acb902b674d8561fab6ca9658527b19af92f3
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnzDmg27RnWGj:63q6sjBkD527BWG
TLSH
T11BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d137480d38a0c5f634f4fde436c60509df6d8027b0eba09d74e86ddcddd00a98
MD5 9de7c6541a1d038f8fddab24814170c4
SHA1 23495e5208055b62577504056e820862ea1c08b3
SHA512 9022e34d5549d12b1f7001cf85eb9a68607419025b57d71ccf768f896ca9d484c4d338a3f2e71dc741db93bbc0214142eb3140b1935a6ca9d15c58f2fcd165a8
SSDEEP 24576:XXYfDtczAfsqjnhMgeiCl7G0nehbGZpbD:CtciDmg27RnWGj
TLSH
T166650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1a95f3100034ac74b1da229e8ffa6ca6fc19cea326ac162a6b5bb8ada5bb0815
MD5 938b07a86f0b7d4e4d3a00d1c9bbf720
SHA1 ae642d815eabe12ea97d779d360f7b5df8f42e47
SHA512 3f74b3831d392e25bd2f703f3605c24611e31318d6a519f5a51b2dc39df3185c4dd05c69e125c8564961384aa12b17132a7c77ca7047c3cc994df0434e2b23dd
SSDEEP 24576:I0Le5ji0hmxxrMUsqjnhMgeiCl7G0nehbGZpbD:IPji0AjxDmg27RnWGj
TLSH
T1B8859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dfff494076393572e1773918f94f5d0fa5494a8746e24be5193d1b5c3b584ad3
MD5 df80dab61f0b9c028c5025a7a19db3d7
SHA1 ee857e1e8f536947c7840b7850ac1e608d4966bc
SHA512 cf792570c40f82043b7a0a212d7ef7ed5552689a40b34dcf64a4d51220cfe0ac5bf17dca999690219c3cdb40d32f7a567d8bcd733ec90a4a1902b11c4e247592
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWn6q8wyu+sqjnhMgeiCl7G0nehbGZpbD:A/ezSC6vUzPveHjylDmg27RnWGj
TLSH
T12E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 76da3165a60085f756773f97b70490fe2d224c53334a67e6825b47539c926bfa
MD5 0aa4fc3a163e3382059b9eb290d7b07e
SHA1 a4364d244611bac2c1b5f79cb005d085bfba8398
SHA512 703261171a2e750e11561f10a1e09a2e4e61cddf5bd5e9f056cb08e29878c786ebd6f27e43cf80d52abde1eca91b786f309af562ac38b81c1d5b27e96322e819
SSDEEP 24576:JVbqPb88hv/l+YrsqjnhMgeiCl7G0nehbGZpbD:JVO88hXl+6Dmg27RnWGj
TLSH
T117559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6eab95f820ae01da1607593b3fbbf0b790b14e8a47ed073c58715da705f3fadf
MD5 2608c99e8ee9aee5cd448252a47c8853
SHA1 af1ca418e1c9fb8e4a022df0231c47b6a6ced991
SHA512 c248d8078e6e37c9af9e7ca30766f93b6f294904ca312db8302757e5e5768074b9928cf4e0a5895f034e85b75fb29bef027ed595a07bbf6d94da31bcc1d4bf5a
SSDEEP 12288:4LAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4LAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1674523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4c1360fbdb9c088318835f96da79c25fc0948bf2105b9db729a051cbfbbfda00
MD5 795ce1efa65de8c604cc81e6082e26bb
SHA1 07e21aa198bb4b7c8606d98c593c609cf154642b
SHA512 4e35538d7d7f5e5d7c37c56806e7b6d6d0aca99db0e7a4dd7b6ee46b5a83c87f4ba03f2d9a2978ce1d30d60598ecf6ec212feb1d913fd43bceb7351c914be984
SSDEEP 12288:BeBNUbTVO86UzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:BJIUzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D65CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b15db2ab837bd5e497ec8dc72c00ca2b4e0583b3f3441473031e75ee6a9285e
MD5 acac9ea47e206d94b9b7d80310638349
SHA1 9d3b67dc97fbc531d9c575cdd10079fac323e291
SHA512 75d44867270e1ff9b4a07483aa1119e273ee447a70609c8f954093712453aa077f083d3d4015dbfcf000c387a1800bad09cccaa1c894a799a5401cddc79322e3
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:OQvGAdlCEL8c/DRNw5CCD527BWG
TLSH
T13A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 026d35f681453c3faffb5a33b94c822537eeeb0bf39485a409e4714aa7b09839
MD5 a571f211fab34ceb5bc2d2f3ca6c4636
SHA1 1bac59dde5b7e27a5e1a7bf6c82a81b39b5d624f
SHA512 5e460d69fe279ef38a551ff62a388e8f6236ba852e5c64eb5f537134096470562d6fb45373bbbb58c120db54b1e2782c110e0713cc0e18a13b7b1efbacf955c6
SSDEEP 12288:sAwSfxL/2Dc3RDLLmt0LDQewsAj9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:R0ewsAj9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 be547861c8e8442d98e41e8f04b804b261ab63788c930ebfbcb47d5f3e88f828
MD5 94954cf3a32a8229942420a0203484f4
SHA1 f785f08bd75f71fe7685c6b39862d497b0c575fa
SHA512 adf819e7b22f0232afb2a437723f94521339ae0d1f1ba2de6a5b693de28d504a06c4d066aa578f7d2f04b9d5bad71b42b6ed276f2851d4a0c7bbca63e1c8bd51
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHJVQBWG:MUEtQevvqc2W1cpV2tI32UB
TLSH
T1A5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a60f3eae290fed4348a67e040348d856a5addca67d66b96ecdadd3d93fe9cc46
MD5 d0a7acfc6d9da5104ad32c72c2692d74
SHA1 c0f33252da576cd0a5bd297eda16db88a15bf2cf
SHA512 4afc757fa23cb442eb2b2400a276bbc9ec3aeed21951d3a145903a22e3b1be80a427f7385714055fdf0340ed59791e61a317db1f296c89518bc8e43ef37f220d
SSDEEP 49152:9CbRquA/m2yL5zTfFiV+XenmE3/zBDmg27RnWGj:6oquVjnm2D527BWG
TLSH
T139D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2b12b10eaa684bf229ee3a89639cc1f631a15ffeea35fecf39656f6cc4022f64
MD5 0a7fddedda18e92b7d52e05cd048878f
SHA1 2c9b66e4e920a3d942e8e88e41555680d945e326
SHA512 314862178d2f6650ff0c2b1cfd779dafdca07af68cd6ed785e71998453d16c4f2c98f87fa3a2358b090b8cb06b1ab5aa1e81e734237fa8613b4798011a313299
SSDEEP 24576:wAhGL3IFoiwtA5l7S53SsqjnhMgeiCl7G0nehbGZpbD:wAMUFoiq5mDmg27RnWGj
TLSH
T1E1359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 584d6ab196a8e30df239b77d11d792890e26f8fa6764d65e8e8f8c35599c6c8c
MD5 5dd07d13f1717b1f7b3509299aea2980
SHA1 fb4b1e25b7378fa23a841bedf38c27b504995997
SHA512 8d6ede475c34cdb652005b461e7df997d07c8a47a177f9b0e368cd3dc91de2b3168173a7142628f290d501b6d384ee5b86a2780b0d1f355e90a99550e8b87aab
SSDEEP 12288:Bmw5HEjsChNVBFgl0WDm+CeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:cwu4OWxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C365F15A72A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5132da009d86455110c290972afe5273bd4ab8c66855938d4a557caa9b3129b6
MD5 d0e341c9d8b4ecdd9501b83e1c074955
SHA1 54d78a0faf3790bd7b249c9679643fefbc9eb44c
SHA512 5674e1654f14a2aaa31c117fa4773c2ec3391f224d53bb62a4fc57c8d93d40315ccf79f823049d88b890d22bf2bdeb9181ddad716c1aefd5fa62bb916187703d
SSDEEP 12288:yeZ1IytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fZu8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1695512AE239820FAE163417CC5E5D609E7337C62673003CF166655AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f86d8c41a067743376334059a9bc7386998186e71024fbb9960a8f04a7c0e0d2
MD5 374a8eaea7f276cd43978dbaf1e4b9a0
SHA1 7b70aa6d00e6d041e45533444b63d19c63354054
SHA512 b31b82bd9d36432dbd5b8ea83f618fd590599b681f3bd14e1b71cb0ed11cdc2b8ef43e2ad6432879bd31f01fbd90724d0281b56551546f9781aba0600a979887
SSDEEP 98304:/QRQyi36YOcPbLvw2gAf+PN3bD527BWG:OQyiKa/X+PNrVQBWG
TLSH
T190667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1230aae44eecdb7c5080aae0a9f4822c935afd4de8871b798e46da39fe63d873
MD5 7c859b5a880688bb8c15a03a0a21b1d9
SHA1 aeba688a71ff10cb1886cce0b918f19cb65aebec
SHA512 9e40cafeb7a21a8011467137e352894d2341efdcad472dcbc7369deaad8c929cbd32afecd5bc2b3cf3620e2176937e8e53b27aa0b5108b263db93f33f7259a50
SSDEEP 98304:gQRQyi36YOcPbLvw2gAf+PN3bD527BWG:3QyiKa/X+PNrVQBWG
TLSH
T122667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f460d8c6286b858dadc494a35ed2be521ef767eeceab1e02cd779067bf2c0b60
MD5 f40a9b912bdbf907b0463283ae65c6d6
SHA1 68f3f07365c49b4828ee5b7516c220e6e289af05
SHA512 dfc54b72a5763ad023e5b92023ce9f28f8296e57ff7bd9ad842a3e762a9125d5ffb3cd420cf68b5617f3873b46cb1ea34e18c3e6e08a02bbadcf0d68671a2f41
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0MsqjnhMgeiCl7Ge:i68Qg55nhceWu7PNU3/xDmg27RnWGj
TLSH
T1E8B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bc1dea8ba21a8715da6b11ed8769794837a7aa9be7ac9c9a1806fa7dc8271ec7
MD5 4fe432d78a5f82ffe37f12d2f3f9588d
SHA1 0776924bd719c256c94887d14f43082df518dbae
SHA512 ce459d3bf7af9f80532795db05d9774e18c4d4f4d66885797422fab51b2b9c69787a3559ab82cf561d3ccd5fced36515e331eabd192b470ed83649c82a0a8935
SSDEEP 98304:Iy5112gYy5azzVvt69nLKnhZ8D527BWG:hLIHEWheVQBWG
TLSH
T1FC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 48842125ca6f2a288b98f133a3391942bf906cb7da710f91b3594c2e3921ae7d
MD5 2d17d72960975a8014fade5cd775e1b0
SHA1 0f7e8a3ab333b15f5aac2b7a9be0b2bff323f157
SHA512 6642ca97dcce9d8888ed0d7d94974682bcbaf6600d4e031828a83574fb9def629cd1708868d396e40e4c3c53ab6b193221821933af2107312c709e553e9703b5
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl4Dmg27RnWGj:zu6Jmdxd2d4D527BWG
TLSH
T131D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fabd6057e112d6bc9da94882e64b0d118d060d2e6bafc90acdd32cce02f8fa45
MD5 65880cf3a39437d8b2a795a0d7c121fe
SHA1 1f8cd4193b668e33c973ddbcf6a7b8ff2ba390cd
SHA512 61938b36b943430a8a277bdb08b3f91c258b9f087fbe881018ce62e5f72aa20ec9cfe939a375753e58a8fdb63082093fb3c85e5b81bf6ac3eddc1cf6d8a17114
SSDEEP 49152:21hpsNoJpF1A63U44CwH7R4xXDmg27RnWGj:2mifPWR2D527BWG
TLSH
T124B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 74d08f2019962a4bc57dfd8bfb5e134e450a4cdf88f22aa2473785358bd090a7
MD5 5497d1188a95705a08b4d01aa2ff7f66
SHA1 bebf47944b0664f2e65bdcc7966dc408759815ef
SHA512 384d03016a04e3ec47fd828813195ddec0d99aa000e392e9f5fdc1a36b378396f23f2f1ed1287c7f4a58cb5fa96a8c8ac28f67118e39a8e70b579de0de28e875
SSDEEP 49152:CSuZQIY0Be2KcRVtOnks6NMHqoDmg27RnWGj:c5dKii61oD527BWG
TLSH
T1B3C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7afd16217bd48829b87ca9fa13b79b43f425f0930e735d20516d53b169eb0943
MD5 e30ba8c55cf33ea999503e4d6f10ff20
SHA1 be2ee60563e9d17f536360ed0e5f81c1342ecf44
SHA512 be73b9a74530f384983c9beef7a69010ad99e2993bcda61af41b470016d3ed64c307ba478a18b124e8190d7cd859bdaf6510e1f571f34dfdbf330dc783890147
SSDEEP 49152:ohtSn8EApI0fig3giDn0AP5wDDmg27RnWGj:5X2imphqD527BWG
TLSH
T17D95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c3eb6ede1527b607df9fce006221a43d795bda0882726ed6fa7a069e0836d5ee
MD5 a13c8b80577d50a12ba10be5380cfb84
SHA1 c10e72242e7674fe0fdca583b2b3a538ccb8cad2
SHA512 24c0cf767f8159722777adb6f7e56a5e3a29c48c3c97d5db8f8f1f915e66006b91986e00bcecdd8808ca826bcca87c2c25e4d0fc829813a49ff6866f7a0e6171
SSDEEP 12288:KIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 124ee288f6170a3c55a2d583bb0cf551a45327597dc8f0aaff3a12295f781eb2
MD5 6fe2d141f944a29cf741b28fb749fdc0
SHA1 b6abd8b7a5bb88b0ff4c8022976e584c049d2be9
SHA512 3f40afc45da89ff8caa77f88d68ede2e4352bd645930da9d37bf5662d4de33d562e3216b8ef9ff861ef855fdcc57027c97b18969cf5e1c3a07d423cb47b2d890
SSDEEP 12288:4pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4psqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ebd0aeb496651140bf01596aba4a337437bf6188b81462c08cbd113367d00743
MD5 3ad2c8ee37d961f826809b8e368a1c29
SHA1 30bc1bcf06a80bb7086879a6169b977cb692dc55
SHA512 3c585c82df558e7f726fe09cd251ab02f096cc5aab12612b2632a076932fc7cc32c5991cd9da3d46d51afd9798b6a7dc2e939241e0e446a8aca979adc6fee7fb
SSDEEP 12288:d7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 41428077be4114adc9a0c73c814adb667ddc7fcfe01955549a7ea54a89181e69
MD5 6da06b910274e8b27bfd63d48b584657
SHA1 39a69923db52a2d397a41c9b9fcb0650ad1a73ec
SHA512 28c62b183c4cb2db1ffa8fedeaca012f94a564feb7b548cd82388ed0bffe5ea26e0fe8aca7aa01497ad3353edd4b6a8338844d34cc36d93743320d62c6bed36d
SSDEEP 12288:0VyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B45237F675C00C6D83285B5C2F5E11DE8237D96EB30059B6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 286ec6915284c966d07d1b780e3346c0cb9e2a71c3bbd9d2a43f01ce2e1a05c2
MD5 1e65d8e44a2c214bc97b55dacc2c64a9
SHA1 1779e6a9cd0282a2f2cda42a96896a7832e3499e
SHA512 1c5be32c9cf0c20ab76c522e195d94a70a25aedcedd36f216fdd928514b508edf528251ea0e2880cbdc07a821d360da57d592e0f8acaf356c92e00fb3a31abf1
SSDEEP 12288:AqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BE965C41CBE52608B5C3E6F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4fd09c881219197eab9895d788c1b6f9662008b22972aad602768e0848402706
MD5 6b8b573e99e8a7e2dff0e43948e67b53
SHA1 7154d9418765e8f849420e5cf1e217886d108f68
SHA512 5eb6c2bf9b18daee0ade0850af0894abf6b42d76b6e9d249c4de3883511cf4eddf1acc27b7e9aa2b4db0af6239cd0d6f95dee4fd0bbb91b4c529df83b7960046
SSDEEP 12288:bFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bb602cd2967297470a95c2c26dfa32507aa503b74982726bc382c0a55280289a
MD5 a3ecc88a99a85e1f7e1959ee55263619
SHA1 fb81b9ecd869b7373a0cbc9b8ba594133ece81b6
SHA512 1d37daaf9e5ba13495fbc5e08a9e30825e855da137a6c47fb472179d28a8f9b70bbeb234ee85dcd1db228154366a3ce4909dd6ece3b8f95ebab73259b9247370
SSDEEP 12288:0BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BE965C41CAE52644B5C3E5F11DAC073E5BE9200483BA6BBCBDF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ac1d21e8073b0d145b3f63c5198a2677ad88aa61552e0ae2612d3de7ab09f934
MD5 9cadeb243fc4285f3c8ffebfe10d7c02
SHA1 a4dd308ab50fb667bc284cd49c2d9638b66d32c0
SHA512 e41ba3f44e70b9d75401cd1a70073a5c30d88ee5f98b20833a4135fcc31fe65614e62f561def78ed93ee0c4a1b7d7269a9e79a9fbe99c148fdbe64af033cb070
SSDEEP 24576:EZMRzFVSOJsqjnhMgeiCl7G0nehbGZpbD:EZMRzfpDmg27RnWGj
TLSH
T1486501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2182a2daf719aabd25a3fc687954c56b93944b5c35b649b424972ecc3bf5a230
MD5 51c9d6006e33acc15cec76d3d5ff0334
SHA1 e91b74d17267b69505566213d1f451cd0fb349c4
SHA512 a702cbf40bee2ba7cbc779c1727be55e9c722ca6cfc739db5ee2cc753699e87e916663082e60a8e42596f09899e5985b43879c1e80d3d0650a91e1c542c25d24
SSDEEP 12288:zsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 eb111b74428e4aa63212457c23152193cc5f94bd7f5359ff312d17441d621a3b
MD5 a50285dbed5464afe4d55936ba5b7fb1
SHA1 373fa33964be3c5461c2b2ae4bca275813bdc45f
SHA512 b5eb147aeb7bce8dba992cc2ccb11f4b353bfc9ba93d648d10f3518c83e2a33dfba77f3594522d52ee561dfa168c07790c04ccc2dca2925a805f261ebac7cfe7
SSDEEP 12288:uwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F4523BEA65C41CAE52608B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 55ddadeea02314025ca9fc8eda6be55ccb1a39907359cdf282e733ac0d589211
MD5 2ce4de6d74d1dafce4074a4f37ce76a9
SHA1 9ef73e1091cc7e1e4e6db7c6e96a84a10edf84cc
SHA512 9a3b7114d88ff79d0a2aa1ff800e103780476ff6591fec225869fb1161333b48c6c811d7247152bf3039e2b7627ebf63fbdba4456650821d4578eb82a3dde0ff
SSDEEP 12288:0yPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E955125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0d0f94b7b4291ebbc7317d1d886a576f780ee07276583b516bbb0e2e3b08d82d
MD5 61115043f55b5f03eaed9cbb71eff7d8
SHA1 0c986c2f4bc5ef8efbaa44cfe4dde9eed5251be2
SHA512 97987f5d302395d6614703aca8f62f43cc79d43c465858f6e6aa4dcef389afe3eb444edb0569d1269c6d182c72e73606c251fca2ed0d95bbf481de601ad3dafc
SSDEEP 12288:3sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fba5c8260d3ff00dc77b02bd92ccdba83104a70b67c7b679426efdd7066a0ba2
MD5 8c81deb21add82f0299b26bd3280c4ed
SHA1 cc41c45cf3afa248dfcab761d18d186090e7f4a4
SHA512 067993e4cb47f021e3d680a92558fcc869355ad838648d2066909238d7e6e7b2db6cdc1a4fcdade587d2f9f2e034ea17cb6c4788880034c45c0f37315631bcc2
SSDEEP 12288:MsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ffc68ab141124f36bb984239c508d0bd19e02048119284493732960dc4f7077f
MD5 3c252f01a268a8959492e72fa8f741f4
SHA1 b05935dd7791f937c841ef6356d67242d2744a7d
SHA512 797b615b236e7c6b04380a19ed05638a441d7e975d15baa93ef0232d2c68be4b9ce0b1a9da12c0218055996093cd8fdc342127efa5838364bd7c5aba650eab99
SSDEEP 12288:+yPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D55125B73A530F9D1368138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 29195e0c390d06e281abe24a55e6b20ed1ba8bee0d8aa4be0ace2b1342c6455e
MD5 e034fe1632d9105036e8b560fb9da0cd
SHA1 14a4b5041a915c575c3c698f2a54ba74dc670689
SHA512 bc17b274081f648d5d1a26d53316a1f9bba01f75c6eee3396ed87062b287d7d5de80c6e304e8a94ec3c82542dc767940e1f586333b7f7c27aa49b1de824303d2
SSDEEP 24576:8TDaLl3z0zDLsqjnhMgeiCl7G0nehbGZpbD:8TuLljSDmg27RnWGj
TLSH
T1206501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 093416a768ec5a54ebc781f88fbb4a84a642205401195625653d538e60ed5875
MD5 d12b9a01a8263572e00313b8cab0b31c
SHA1 98959a575a6431bdfa18c1d21ed73e1c91dfbccf
SHA512 354ddf5568b49b2cf80db95c383ec2a9e272050dd39bf57e6094c66533d3e32444207081e952507da6a64c1be252e14946c7a89992301c9f486e5b2dce459467
SSDEEP 24576:y3vd9CHKy7GZnsqjnhMgeiCl7G0nehbGZpbD:Uvd9CHKyapDmg27RnWGj
TLSH
T15375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2b9acd4b7d0ac9648626d2d68366b42bff85fdcfc57410d8b2e8e992436c26f2
MD5 f5db3492b6479a6542a9c06719c20818
SHA1 27a997053b33eb6e209f534700b2ca4ee6bca3e5
SHA512 8f2f5d20deb6fffc6ea5bc25bfe9fb10175ea09396860dfcdda0d0561377613a70aa7123c6cc72273533da9a4705f249b40d670caa60bd276662aad6ef3d2ea5
SSDEEP 12288:MbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 367921c97ad24059c8a226b3b24145561476b1f4eaf222f68380a52e987c6c6c
MD5 2e5e9c9df66c18646c042f1516886214
SHA1 a821dc6948824675dcf45dfdb69b3c40a38a1b00
SHA512 90efcc13e01e05fa74019a485bf31f0144b4e55765343a2ae689927edb23b177a96022448fff18c290696011e9b563399c8d72b5e3311838d894156f91e40e9a
SSDEEP 12288:PNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BE965C41CBE52644F5C3E6E20DAC073E5BE92004837A977CBEEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2f5cdcd639d6a4e443909201fc4584b5000102647eb063fcaa0bacf68fd3caf0
MD5 b254ac7ec7396301ae1da8c9f3b29110
SHA1 8a396372544de1249a67062ef9e1394da26efd3d
SHA512 0eb38d2363a0baecc91f7ffbbb0e5f6278a6939cf6d5f91e426c4a8c8c0d173850933ac9dddd61d33912fb676a32894b58de011335347b523659a7cf40761216
SSDEEP 12288:RWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BEA65C41CAE52508B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3a8ac7ff58200c3661cb8d7cfb9d34461fe19e32e30c11ca476ee6652df4e32c
MD5 01024e3c22431f3d43564490b0f28942
SHA1 02139b39b76970c81997a00b49efe95ebb6ac577
SHA512 17d4681b11c29473c3c7c549c54e9c459765353f15d093bd319a0bbf714ea8961ffd056706179ff4e421447bd85269cfdd3473c067fdaf5d12db8051d6b1b171
SSDEEP 12288:WsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WssqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF965C41CAE52508B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1a79b436954cf5ab3ffbc99a1865dc9ec5b4987ee81bb613f729180fbbe70bb6
MD5 0fb2d76e7a32081da388f280eefb7ead
SHA1 d7c7a072998d17567cc61701edf055efe5d25852
SHA512 f1b1df85ad71ba7d7c7ebeb39a5b8b66807e6b29134f0a56cff505474696a1b96a5be2c9010e569e3898eaa566e5281437ae0ba83ffc50f21acbc34ec2003ad5
SSDEEP 12288:xbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 36a936f69b15cc8a1930b7d58d33a92015a46f39d0018a40f8bb7b0b91f82814
MD5 53c2e3416850ac2b7c8f1206b4654597
SHA1 5dd9a265d951cea32e7a8d76a4793bf28ce3ea1c
SHA512 f8cd5e4bcbb203a7f7331adc794b9cca7e83e3ea2ff32bcd071250f739b74a78b9127afd60966469ab760b5ea2a2cbafa9a873fbe0766bd4985e53e36383c896
SSDEEP 12288:GkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BEA65C41CAE52648F5C3E5E11DAC073E5BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 bb4ca5af599c64f960cc656d7fc4877416574e47a44ee80d435323e0a377bddd
MD5 5212c9b01f7bbde0719334e50a9f9bec
SHA1 62189dd895ab5f2b70bd13f6a1676f02fc5bb2de
SHA512 c81a9254573d093a818b4ccd95755a0f4049330a7899c08d320fdb87669c3b64f30ed0151e6f098db3fd77b0a9e3077acc44c4f733a96e46b2d67c75092ea56c
SSDEEP 12288:FqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD4523BE955C41CBE52608B5C3E5F14DAC173E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f6ebaf4f289408daa1f6e2dc4e9127a648781f99f6954924fcfb4a298d29e0d2
MD5 fd028e1e075c8bebd9eb7ba6266e7f7d
SHA1 e72b596d7eb9f66e74782c7f6f4b7e1085af015b
SHA512 ea88946108632ff6f789bda60c2d35cd45df938a8963ff4fce32832d4fb5edd3793195063720208c84ec14024d591acc64eadb0000922026c6711da415bf9f32
SSDEEP 24576:qfwvUk9RX6wkyAIgsqjnhMgeiCl7G0nehbGZpbD:6MnYIcDmg27RnWGj
TLSH
T16785D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 929948c1b94af8b0a2c33e60917320ccafa897c1377b50d0c86cc2b77496d381
MD5 9819ae69ad31934591a8f5cb1f08def2
SHA1 70d4fb8482916dda4c9971309eb634539d5ccf95
SHA512 34d10b9bb1829666a9f8c1baecb9cdd32319234b557ad23ae0e015758ec8bbc47bf5161154e55537b0e2aaee0265fdf12c52e4326c9c637ae42899ebfc0727e5
SSDEEP 49152:cYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jDmg27RnWGj:bySzP7D527BWG
TLSH
T144066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a47850f9deef163b79602553a6f9cabb4588ab574931f0d943808c62fc7ef6bc
MD5 e64543038b19d702eb64614467b25320
SHA1 c947601c5597d664ad7398b6b9b91d0f9aef7927
SHA512 d682a793c8a2509fb9886580511db569c79dc04970a9c38843fc28a1b680c52e54f2caf23521560d57ca37979ce9a48639c3bbded729f2ce4efde10f71a85b07
SSDEEP 24576:n47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY5sqjnhMgeiCl7G0nehbGZpbD:n47JUQjTirIhCnDHUPfF/TDmg27RnWGj
TLSH
T1AF65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 af6abb963c10e63015d179b70f5af436b17bcdf162a52d5fb5cc615b8acdc2ba
MD5 45d8b9e68475b23ab8b07292c95d51d0
SHA1 2bce6684c983e320d91f7af60f887c9fece717d3
SHA512 239f06014e67c611db56442da882675900ba2a1330b291b093fbb07637d288ca0a64970db4c8d578017831222259d6545d04da259ff03eef5fa9859c18124052
SSDEEP 12288:6bsf8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A155015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 932e14f34b3e63ca15cefb44218683a2360304f9b796dda345c50acd3bd73c3f
MD5 77bd0496b028f01f5d1994bb9bbd6d69
SHA1 5901e80164668b1a6916765b68d1724f57475934
SHA512 4e2f29ca202d702de9de0db764236b2aa809cbce108620a261ae223f805d00b1ec3496e01b02fac6dbc9e095dd9f98c8014d0c50558f864d4c3142799b90760c
SSDEEP 12288:scz42BqFgqSTdbG12T16iocG4waRMTfE4b5uTOe:sD2e9/ctwaRMj7b5c
TLSH
T1254528107666DB4FC6A980325E36C5CCAB707D01EE04AF0373C98B3F9576659BAF2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ea3101298315a65c877c5b87b83d238ce4879cba2fbe317fc0fd32917a3d8307
MD5 61c32869baead8726dc3154d7c9e2f59
SHA1 511c84a0a9a7b2c5f3be75a09bf4171e91efeca5
SHA512 1882a5c2fcaab65a9816a2764f47ff923213915cb52eb2031bc7e4e0bbce9e5daccdd8b1d58623c5edc89570f580f232cb64cb906beeb9ef441d845daac2f518
SSDEEP 12288:t1h8IXABcqBlWYQWrl5fxsZR45SBdKeq0wA:Ph8uEfqR45EdNNwA
TLSH
T1E565F840A536E78FC1BA5032033A5B8DBB64EC07B7456F26B7C9053AD866B45B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1ab585ee5bd2a743cc1eb0aceb1f50a3c16e60d934482c250d1ebcdb0899b5f6
MD5 e105fe7eee2e2b609bf82621694fb90e
SHA1 c1987bfdcaa28a6ac86bd17986e6f38839275947
SHA512 0a5805f10aa5a6cf75442eb49db7a8d700eb103b6641d740c414a055693f796272612b3c3ec3105c51fcf8b52e7a9754bae8f17475dbfce59b778afc7cbd42ce
SSDEEP 12288:L070Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15245237B934C518AF83609B482EAE12D681B7E669F1044C3BA1778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9c0fd7d54a71932cde362802457c4d64251a13b783251acc09de360ec37caf8a
MD5 26f1a7c28a7a39df850fc87d66f6367f
SHA1 4714871fefcd41dea5fa6f5d70310c9e9fdd44a0
SHA512 b025c6168fefa2e615ba2cbfbe60a14422be8c8cdb5a85adab92def97c2001d2f03b1137afc5905845d4f4cf5cc90e261c1b6e878bce988e6c9d083e422118ae
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bY+sqjnhMgeiCl7G0nehbGZpbD:Ngb4mBIBhGF9Dmg27RnWGj
TLSH
T127659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5639000fdb2dc4a102c8882f7c47aa0d0a5003904d6e35835277903cb42dc458
MD5 5b935127c8803db1cf1461c9a087fdbc
SHA1 3edb34e5c6ac9a8b9847b8b9e42aed8f9a3a597b
SHA512 7ea6781ee6e77890039691c4ef3f7f2d4bf194a431c8c6ba8d4df4a3e507256e1137d81296eb3fbf0bc540cf2cd2269f54954fd2e943b0a522ffeb94311593ae
SSDEEP 24576:vG88u8FpJqH1bzria7/mJsqjnhMgeiCl7G0nehbGZpbD:e7ZFPqVea7/6Dmg27RnWGj
TLSH
T1E785016577E401F1D477D138CA868667F6B2B8250360EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6ea611b3bc9e9d85544d8431dbbb973da919a4f0181b33859ab0f2ad3055983b
MD5 9c22a6eaa1737974b5280f69ee8dbeff
SHA1 b02b4b8836bcde96c8294ee89359b2585788c295
SHA512 4c67756d4bef9b87411a8e453cb362083192cf985e07c96f71934658b34f076dcf795c816f4dfc949a8441c642790488b142d30fd5aca5d5caf8ae08ec006afc
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5Dmg27RnWGj:yG05lO43bkD527BWG
TLSH
T160D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 acab32e5555209de7a6cb68aea89de6bcb4c1e62db170adf7d73765999b63115
MD5 f1c69a6eaf77a1317348b872944fb9e9
SHA1 d996f8647f14fab4c6e1b290e822133b86f75a69
SHA512 3a3db0b25fd87bd699a8e1660a2d27f7ea4825bbdfe8eae4238a2fd44ee2f80b5b25dc759056214440bb35546b47124d44642ddeb0386c7c20668fe3edc07df3
SSDEEP 24576:Ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/sqjnhMgeiCl7G0nehbGZpbD:Wa5POZ3BJt2pasx2+mxDmg27RnWGj
TLSH
T1A865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a34e1d41e324b8fc7cf3773f06cc71c661aeb67009f808c2fc0df9d61db1b1cc
MD5 863c5b7ddcbd2a41e594eb0ea0b3cffb
SHA1 be837375638ae2cc5b134cba0e5508bb7a8f2a0d
SHA512 e47ad2bb0d95730b9333056892b234d794c618dd748281a66eb880363f960fecfd851c411cc698384f8db08bb76a600296d53880ab9df6e9505c00c9453245c9
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkRsqjnhMgeiCl7G0nehbGZpbD:ENc/zEOVHFaDmg27RnWGj
TLSH
T114857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0e9ea2474567c98076eb842f084a97ace7f8f4d96f7d4d273ea69f0be2a76f6f
MD5 11dc1c62db6a07d0d42ee734a5366f50
SHA1 80694b5b7cab5b116f0a9372e78bbb56307486bb
SHA512 b0f2fea4f254b55e4eb0340200fa24ffd22f96b977f08ac48f7bbebebb31083e8fae0ed7fb5837374f4099f2d4b3a29dd14f2180768b296e3892559f623f8419
SSDEEP 24576:5TkNvNnaFeYhJNtmZBmAsqjnhMgeiCl7G0nehbGZpbD:5TMwBtOm8Dmg27RnWGj
TLSH
T14E55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 95f313c8f9f8735e0406b4bdb6da94825bf305fbc68b13c63ea2183ff588d01e
MD5 467e6ae4baf8507a7b5c8cdf6a44cc9d
SHA1 2277311c5083b69de8c9c88ff1df9de9c95d82b5
SHA512 804fb0e4a611c0b32389832d1edd3332d623db6ead4d2f29c11f2db79e7bb1cc58ffbb0ebcf811ef2324ede62deca7072498aacb084cbefbc7f2e71d723f4e48
SSDEEP 12288:1HvUrBFrEjwaQ1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:1PUr+NQ1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A465F12F22AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 33d3d7c91071521006abc321815cc3d7dc09404c8b70978565394139e047087a
MD5 6450b53be0ea3dd57f93fe470bcc9bff
SHA1 2c561f924fdea3248d87a1f43f46f0f0a5e109e2
SHA512 da71b0a1cd4f33babc5a743cd6c555eea5e00520dbe795f5659c64394f601cf054812b73b094db10dbc3396326db158e01cbe919b1372d66fbb6280d0f1f5779
SSDEEP 24576:1D3FHshBIYQgAosqjnhMgeiCl7G0nehbGZpbD:1DVHeBIAAUDmg27RnWGj
TLSH
T1FB75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/996-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/996-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/996-301-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1788-24-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1788-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1788-15-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1788-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1844-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1844-35-0x0000000140000000-0x000000014042A000-memory.dmp

Download

memory/1844-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1844-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1844-0-0x0000000140000000-0x000000014042A000-memory.dmp

Download

memory/1844-32-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2256-125-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2256-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2256-119-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2256-127-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2256-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3144-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3144-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4192-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4192-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4192-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4192-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4520-94-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4520-100-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4520-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4520-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4520-307-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4520-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4632-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4632-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4632-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4632-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4632-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4632-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4696-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4696-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4696-324-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4696-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4696-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4696-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4900-320-0x000001B563780000-0x000001B563E00000-memory.dmp

Download

memory/4900-392-0x000001B563780000-0x000001B563E00000-memory.dmp

Download

memory/5880-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5880-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5880-107-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5880-113-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6076-56-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/6076-300-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6076-62-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/6076-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download