stealc | f9e1b21f7e880124e340004051b3c75aa5da300090279219f14350b6c7223ce9

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.5MB
Sample261001-smwcdstfpf
SHA256 f9e1b21f7e880124e340004051b3c75aa5da300090279219f14350b6c7223ce9
MD5 46a592147d828149d65079fc73af2e0b
SHA1 7d56779033efdcb692252a2626686cde3dbad0f9
SHA512 4b557b740dead7fe785d452db7ecb2e91e974b1e7126cb2b3226e9e67e17ee39d9198385b685b53038d763cfe208f8f52ec92627980b12d0a77d0a48988d795a
SSDEEP 49152:pikTMyYL/XelJpFrm+NEUAzyABqAh2zMlX5boOwcZMzR1dIgdV9fJ1BTvgbj4MYk:TI6uiOVMNLFZ1Vk
TLSH
T1A0266A0BE6B941F9D0BAD1398A979617FAB27819973197CB0290465B1F337F09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/3756-40-0x0000000140000000-0x000000014047F000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
2732	elevation_service.exe
2868	elevation_service.exe
4296	maintenanceservice.exe
5624	OSE.EXE
4620	PerceptionSimulationService.exe
2584	perfhost.exe
2612	ReFsDedupSvc.exe
4816	SensorDataService.exe
1184	ssh-agent.exe
1164	AgentService.exe
4256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5de1106c7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File created	C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-01_151514_3756-4372.log	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000020d76b2b751dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f1857b3b751dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089acbcb2b751dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a77c6b1b751dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1a102f4b751dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3756	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2732	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1164	AgentService.exe
Token: SeBackupPrivilege	2612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2612	ReFsDedupSvc.exe
Token: 33	4256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4256	SearchIndexer.exe
Token: SeDebugPrivilege	2732	elevation_service.exe
Token: SeDebugPrivilege	2868	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3044	3756	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 4256 wrote to memory of 5452	4256	SearchIndexer.exe	102
PID 4256 wrote to memory of 5948	4256	SearchIndexer.exe	103
PID 4256 wrote to memory of 3400	4256	SearchIndexer.exe	104
PID 4256 wrote to memory of 5156	4256	SearchIndexer.exe	105
PID 4256 wrote to memory of 3176	4256	SearchIndexer.exe	107
PID 4256 wrote to memory of 2496	4256	SearchIndexer.exe	108
PID 4256 wrote to memory of 592	4256	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3756
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3756" "1448" "1320" "1436" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:3044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4296

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4816

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 23bcb76d84ee1a2af573a2d721d66e0f958de4bfda75e15feee470a9332ff8c5
MD5 f91f369758fd0f70619f019d9367fb75
SHA1 4e394ed8733c60c34de72f2a17f7222c1ab68504
SHA512 4b736bfc7c8218536952e6b88e5067af1b86750903434d8fb95c7e6a019a0bfd571c41cde511c8948fe48957e5053b5e99b2cf53679f334afc38dad77d2a59a8
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXj4MYPVyGL9:d3q6HjBfVJ
TLSH
T159D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 290a7a87e9fbcd0329972428f88b9c4eafbc9da41474027b17accfe2ebec9349
MD5 383a8575a83074aee702d57fc6f2971e
SHA1 dcead561c69a7e6613b3bf7a0ed3e3dc9155578f
SHA512 f9868992fdb96d7da4f6c45652d89d3d311aa6ae68e5ac1fdb4c24790afe56201639e7e27fbd7f1e8759c6fc5241dd68a14a94816d1b702004befdd96eb097d1
SSDEEP 12288:s1XLsswWkxy2lRq2czAJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn99:aXYfDtczAOSnnrFb4PM4MYgLxEVyGLL
TLSH
T1BE65F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 45191100b89ff5d340cf10063635a7c7d184a656b2a5b63de62d904a6a721f13
MD5 9d7c45f5967e34c9f858692fb56f4a7b
SHA1 3a1c292d8f23d713265f2b71068843d3d6bbd8d2
SHA512 20f8667bc43dbabc5c2e7d243be857b39cb598ecc13777f2d53bb3eda6a3c354c685bff8121d0984a7eb3a293938e1ca3569dcca292d855c2eef73080b7fc178
SSDEEP 24576:50Le5ji0hmxirMzSnnrFb4PM4MYgLxEVyGLT:5Pji0Acnj4MYPVyGLT
TLSH
T138859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 32b06e07e53924272ccafe1ac3673850b429577bd2bc73bb8eef8e08312ebc75
MD5 070b7fd014a5dcab6fa95d5da0a32b7a
SHA1 009b6df256ff59d19d84a74d9df31e2334add15c
SHA512 002aba804cc09fcb40e0aabc19afcac47d9751252f712fc17d81d8cfa42872760505305bcd8271642fb6c1bfe697e3807b566bc37cb9707dcf902dc70510f0c7
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWE6q8wyuFSnnrFb4PM4MYgLxEVyGLL:5/ezSC6vUzPvxHjyTj4MYPVyGLL
TLSH
T1AD755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9d1a95bc99f9a52edce388c47f9448793ac9c5c680ca1bc377491931f0d449ca
MD5 3be1768cc28ff517998ac51d7320b6b9
SHA1 c3ad2742517fe942a30d6cdce3bf033cf6ba5789
SHA512 2875d81d08d2e4ae0221dbcd8c1b167030545a687827ad162e4bc2e21dd14b812017493bb6eb3fee45a20229c19c31a33412cdf1486026ca97f7077d2396edeb
SSDEEP 24576:hVbqPb88hv/l+6SSnnrFb4PM4MYgLxEVyGL2:hVO88hXl+oj4MYPVyGL2
TLSH
T1B0559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9a651bc86ce673087099644ccbc27426fb5af957166228b2cce23b2ef3057150
MD5 44953c36f7cd4403f19d097c5c0e50ec
SHA1 92a5c8355c6e1940d4ca8469adcf321bbd45ad77
SHA512 af67abf74a108238385c71dcd35bb6f56d99128a628168ce56c283b9f1a5ae1c10073dca9a5c2779a0cafabc881a50aebdbea7c10402db362c144f2977ead08a
SSDEEP 12288:eRs34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:eR3SnnrFb4PM4MYgLxEVyGLx
TLSH
T1894523A66BDC10EACFAE15B0D1F96AC8E2157C61F875B20B6741785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 53be9db8a357ea14330f015ace7a19df19eef420349f607a3c251d2b7ecd7eee
MD5 f302f9ab69f687e3a84cabf6c26c3b21
SHA1 04abb2413dac6d2e32492de1b2f9339fb545a873
SHA512 633b0c3da72bfeec1646eae19b69b31b158d33764c2b03d2d8d41e5a03e8d505be8bcf88d1c7636a582270825bc6a0b0a4a1cf41e5430fe672113cccf7b228b7
SSDEEP 12288:PeBNUbTVO86UN34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:PJIUKSnnrFb4PM4MYgLxEVyGLC
TLSH
T1A465D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7fde9f2afa082946d221156e7f5aeb74ad3b0cb80b1b0f39277cb9fc14aeae85
MD5 0da37fa21245c31144d8407a58ad23e0
SHA1 30d40a3cf0ce8beac2b32d1e92f87957ad7e8093
SHA512 ba67f46b3da90ced84a3f23a6d4ed3f8a98b9d65854e2c6aaef3698b411c15913763a3c313c1e8a39749fff8484e7576191a1059c5f728116cd8e6327827ec8e
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:AQvGAdlCEL8c/yRNw5CPVY
TLSH
T175267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 053569957421fe2b7aa8df027f5d534b6a0f60094fc23b4cb61a600b04eda127
MD5 1184f7ae76bd0a73c865ecdc71ea6661
SHA1 d361b422dde7ead75bea00e05c1d938ecf2e70be
SHA512 e9274d4be9ff333aff0ccae822a963a7faa9a8c0a953ff941f0849dbb3cf1b49ed2b89e87855d3b1886bceb608ce1a682ad38b1001468f0058a32659963ead5b
SSDEEP 12288:tAwSfxL/2Dc34DLLmt0LDQewsAjL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAv:edewsAjESnnrFb4PM4MYgLxEVyGL4
TLSH
T1CD75E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f54dc1f8cee6b4babc582c71592ef9552192ce38cc56db66a0305336594ac4e
MD5 d03b9f917441bd6740a19681d6d18b6b
SHA1 9cbb9adbca59715e821ff8bbaed04d41c1fdfa91
SHA512 87340fc2a22f23754b4c1e3657ecae69d55c3de077237d09680b1d365b58923a270a36cf30fa07b33ac8ac8afaf78c506ea793b8a84fb205d55e2f691895eca6
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:ZUEtQevvqc2W1cpV2EI32
TLSH
T155474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d16f34d34dc400152744bd045fd5f4d6c188a00a89f63ac9955cb46fd9b4a07f
MD5 0364a6747f8aa9bf3f2ee4ae9bdf7111
SHA1 8b28b8d076a3fc48faad13f2e1066746bdbc00f9
SHA512 32280e1a2b576c0f64e72385257438569fe79a096fe94c3be14e062434e28b8bf6bf0e5acb55c6ec985ee8c2e3880b8d29b5f8550a11b00146eea5b80746e0ab
SSDEEP 49152:iCbRquA/m2yL5zQfFiV+XenmE3/zXj4MYPVyGLc:noqtVjnm7Vo
TLSH
T14DD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c8f8f24a922725624e156181ec1cf0c83726fd9824827903c3de1643fe760f60
MD5 34d28747fcb85c13a6fdeff070c94419
SHA1 1808ed1effbb3e061b3376743a3557aadf63fca1
SHA512 359ffb84609ddfe2927939500139151b41bef2f4812e7844f3cf11ee3c0f62ed04055fed8f098fec5426787bc80ea5f6efd63b3a1c13593ef4bdbfaabcd5077c
SSDEEP 24576:7AhGLJIFoiwtA5l7S53hSnnrFb4PM4MYgLxEVyGLf:7AMyFoiq5Kj4MYPVyGLf
TLSH
T17B35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c9a26505401d051db67a3ff20a1af8e0fa6f70e09b2e7617c0462a86a2a14fae
MD5 b49b58687165e02fec3aadc1f1d04514
SHA1 479a0dbd2e632148b903e8ca4524633b3c0aa975
SHA512 c4d72d26ba201ad07b8ccae10defe84b0449919adfc73a747fff14eaf14ed9d816f9bcc509460a57bdaccc442c023af05207943a238b0340a244a11a1c0af80c
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+Cu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqO:WwuoOWgSnnrFb4PM4MYgLxEVyGLY
TLSH
T1EE65F04637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8dc716fd14f1690556681b726b114c2de8d6c52310b72d71d14cfc621eef97cc
MD5 6778e65214131c79a4dfa00ae9b0746b
SHA1 2ca8023459cd9293582ab0c7853df5dab19cdb20
SHA512 72097c489e54b0642315baefd51e291c26fc515a9fc475c1dd6cd61abd458047de16ed553ad76f303069dbc31ac0bb706009734c5313d78d1aeffc41d074f153
SSDEEP 12288:mBZ1Iyb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:wZurSnnrFb4PM4MYgLxEVyGLR
TLSH
T1E85512AA37E820FACAA74274C4F55688E3327862B77293CF1650555A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 171444d6889c2115ba6fafdc6416dcba62528f789fb7fafcb7ec501a84a4bebd
MD5 ea219dfc26d30228984d9fadb6ce88c0
SHA1 3870ad9490d615471c36c40476c93d4df29c673a
SHA512 5958446d193a18788b93ea4775655f819e86f5a0e57b6d0332344cf169851b5751920fcdf6c92294939ba222e77905ff2e241cee54895afe206c870cd4e49828
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:FQRQyi36YOcPQLvw2gAf+PN36VC
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 120531495f6753a2cda45151f4315bf2d966163e86b290771c386e19a0867f34
MD5 ebe63edb2a35f6cf85d674dfaeadc023
SHA1 29d0ec8faa499a3e578d09a177cafe7b0c9af1c9
SHA512 0d5b85941a4f995c438494c859fd2d09142a2f1529d7040ea80b6d469cb68bd3359bab10b9d8d38b6036d45833ed65e7944f2913763aefc394a5fe56f1c541b1
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:XQRQyi36YOcPQLvw2gAf+PN36Vm
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d354f1167c3e1306b793bb1ca2b2021831ab4a74d9b067fdc4ab9200c4cb7c18
MD5 3f6067ed6388be4fcc0507005be7a819
SHA1 70edd5913fc18cad96246edbc306020ce1e30391
SHA512 ded0676cf156e51a6f1b4eb83c4bf275a43d2a941ab571f3dde25ee01eb8acaa3bc59911c3ac25e8ffe7158ced19f24ec7f85b99daee8701aa2af8396e0b0976
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0bSnnrFb4PM4MYgJ:568Qg55nhheWu7PNU3/nj4MYPVyGLS
TLSH
T1F4B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 54d02ca82cd9eac87761e3caf891789e26a1f7c7e831ef241e6b65624a8374e6
MD5 8f06ade250d2f548a03a8fd852ac37f4
SHA1 be4cbeeee7284290cfc16592aca471e72c9eea52
SHA512 5fe920cf2db0a05a53584b2283bf3de15f0f27c29a4bbaddc54cd3e2ee01388bb847b1edfbce6c6e9506efa1787b70cde088884dfd8efdcb85231218544f286a
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:Py5112gYy5azzVvL69nLKnhZtVi
TLSH
T128167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 848c0d2902442711bb15d1b15fc4dc62dc4832244523e55bdc065dec534a7fb8
MD5 8b9d86e36a9e13e88ca7b44716d93d39
SHA1 37becdfdf483dc0660dc9be4c10edab8d37dbc11
SHA512 9cb0d47f6b7ebc36bbdec08970dbc2a62da1d0fb9020601431b5665cbda1fd40117586fdd0379ffafd03f5a521ab8d4c672e755bec91c630e58569e2066ea4c2
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyj4MYPVyGLT:gu6JmVxd2dDV/
TLSH
T120D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 14a4a4c2b70db4e8e4c23f399f0586b222301d4eea2f491516f64625eecb0b15
MD5 5263b74cb3f544ede8300d754ef31bec
SHA1 3e939dd80f5582d9b48fc4154ca78fdefdb29f3f
SHA512 25f08160f7d91696d2cb8de98ea85f204c6f7d832ff4692ff85e2ad4a3a2d01c2d191ca3045a14245d0c36100e1bf104896279d12eae6eb5233917ca18c14e91
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xlj4MYPVyGLg:FmifPbR7V0
TLSH
T1D2B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 927bcf17b0b4f06108bb7fa48e25d51912f55ea28a6c3083da51abb452ec92f4
MD5 45f01143481dd5480064dd3e06108485
SHA1 45f95a8d1ba69538aef95913ae3cd349a7577b0c
SHA512 978a17c0c6106192e74d823c2464750326008d9eaada56f77d53c4689ff57718d1cb0a704a6b38040978521197cd950689e127242a304baa6642688a5d1ffc23
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHq0j4MYPVyGLc:y5dKTi61RVo
TLSH
T1DEC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a5afbe4be95d5fe8d0cf5370b3bf46907bb479aec907b6d171d775c1b4aef976
MD5 de9b48a213be43a0ec8bae15b5c080e8
SHA1 2ffc878698ffe4398826a76a43a90fb557656a8c
SHA512 172bbeea9a7a95362d62d34f1e0287c3be7c5531e4b0572605e3c3004a0ef5a20d294af742b1ef636f49e123a95d07a1e6a0c09fdbcc9a8f4bf880a90b151a01
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5wpj4MYPVyGLI:KX2iyphnVM
TLSH
T17495BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2ec146efae5a5153d23ddff48032f841df357948c27fa26bd61e75c1f0385412
MD5 24fc2f83ed5b4b5f8f9974e0fb389772
SHA1 f1146c5489e90475719f9417f58c0d9619230b64
SHA512 67038d62f8b15b4cb4b8b0efb6467d62db4ce06fbe2c5e1ca014cba0bb064abcc08efe4dc0fddca88e712b046e155211a7e32ed2dc4cb1c34e7b8384a4bc76b8
SSDEEP 12288:RE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:RPSnnrFb4PM4MYgLxEVyGLk
TLSH
T1DE4523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B20D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3a57ab85b03f66149731c4a4e2f1007ca462048ef49e6b1d98f0fa13398ae434
MD5 216a470e219bdebe9b774b5a62097a4f
SHA1 1d5567e5fc764f467d8e82d9899ef0a544c25ced
SHA512 3e47f095eb5052f669a626b2b040775d3f1b5dbd5b21abfd2b813c081be26329ebdd43f2be398e039802c83585e10dbd057b1c2020f06365a2ae73cd34512e57
SSDEEP 12288:lH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:lISnnrFb4PM4MYgLxEVyGLd
TLSH
T1764523A62EDD10EECF5D56F0C1A566C8E2097C63F976B20F7B4574073B3B20D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 01b27e7ca6472206382cc1522656a61aa56752a0680f9b0d8cffbbad4e98cecc
MD5 1ba13518f978475974207ac849327338
SHA1 aa2955a7083c24bb316ed031d0b01ee56e82bb81
SHA512 5d9383b31f0f0085ad4796b486e5aaff64155d650bf7d8b15483ca67d6f8303a3c97a60e713ecaba388864029565ef52c0985ae24b82ed7fd63521e44450d178
SSDEEP 12288:iF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:iCSnnrFb4PM4MYgLxEVyGLd
TLSH
T1484523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8aaf3b774ebc7d1fde9d6a1ae806d9822c290f5c4f04b055ea9d63375f21445a
MD5 a136c321c238d81cfbe5c3ef45c1b4b5
SHA1 c583aec5e4e28948856e7077dfab5f868437f5b0
SHA512 ccc2dfd5ba91e7bc90f81743e5ac3221419d68cad8f3bfa70427b429aa8bae72a167b49d4a608e780f1455dd834371ddf74cc692c3a8f23dad7c2d298ce89a12
SSDEEP 12288:EVy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:2SnnrFb4PM4MYgLxEVyGL2
TLSH
T1174523662BDD10EACE6A96B0C1B556C8E2257C61FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0de7123128b1f54331184781bebc8bd2539cbf8ff0c6a48f931344d829e48a9d
MD5 bd8e89e6d13e9b3623beb3ae7e114d27
SHA1 9ab5b7856a68304d8ea1318362e006d87a1343f2
SHA512 53d411f48250a40c86817a3fcb02c8a8fc3b731b6fb740eaeb8bd45fed918b79a31f5ac0ad9676ccf3f72e841fb2bfe83f0460bd37703c947e25b907e5ee425a
SSDEEP 12288:A634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:ApSnnrFb4PM4MYgLxEVyGLj
TLSH
T1E94523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 da9704be4eb5254533c5ed1e48653b56b7cb95963f28f7140fdf700507451dfb
MD5 a62861d89f49d18876d7a0fe84b3f5c4
SHA1 980b066059b1665e6b111d0dc0fa6d68d295ec1f
SHA512 e7e128db3c24357b9acecb5a9dd66a9c0661662b899cbd7265e281d01109e9b9c3bbf5a92bd7505f52b413d0202ddb63fde935c6dd555e7fe546c5ce49734052
SSDEEP 12288:jD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:jcSnnrFb4PM4MYgLxEVyGLo
TLSH
T1924523A62EDC10EFCF5D56B0C1A566C8E2097C63F976B20F7B4574073B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4177ab6cbd9bd6c5ee60ba69e78038e4fc72e06d36a32dece9861e278afc28f5
MD5 08979292f42184433e7771d34164125b
SHA1 a1200ab942170d165e630ce24601e1fe5e47a77d
SHA512 b91fc37f66d8276cda256ccd3b4bfc0ceadd651eab0e185a4874b60edd32b634e3fab43824ea962310c5ebfcf2e0b025130ec08188168f456e59cf167891cf45
SSDEEP 12288:8P34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:8QSnnrFb4PM4MYgLxEVyGLg
TLSH
T1DA4523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574073B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e21274a72125d6fb453e9cf4b2e08db5db061155cd001f41860d8de2e4e09cc6
MD5 07b58c8fba083620a2aaf1687f2a742a
SHA1 70089f55e9638770e7c55aca42aa1453c33fcf94
SHA512 a7ff984063b991535ba63d63b2ff21cc6bc0c097ac2e1c574690219f3c4a61d7f8674462f9f2f30812d2d092ea2c4fe417d241f104b5460536b11779c9e71095
SSDEEP 12288:UiZwb6zzFEoS2cPvyn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2R:3ZMSzFVSOoSnnrFb4PM4MYgLxEVyGLg
TLSH
T1ED6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d6750e5e07b82c7c968a5dfbb03e810ef4e45ff03d87e4c0e811182dd58c7cca
MD5 fba5bf23489af6bf0fb1a0089380e73b
SHA1 aaffd273363c85d0da6934ba079584d7bde07783
SHA512 d340579bbbe789fe9e7bf369e45f5564d9d631c708b2c9113e1aa98b102007aafb84431862e91725a6a7a6e9012ca29aaee26b554a3ebcb51bc6d66e20df8e16
SSDEEP 12288:/o34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:/7SnnrFb4PM4MYgLxEVyGLd
TLSH
T1F34523A63EDC10EECF5D06F0C1A956C8E2097C63F976B20F7B4574163B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ef3254798afc8cb1e03141f6c4614bc10a1160efcc9db23d62a755817a6d92d4
MD5 837564a73db4a2785af2a268680668bc
SHA1 bbf267ee985eb95107ba08a0ae96cad8d186e7ff
SHA512 88adabc979bcb4058306fa46b6b2ff0320b93a3c241ac6b40bf7f1c0dfa8094a5902c643c356dca37df0e34c393d15fd74c05e4724771efd1f519692ef13478a
SSDEEP 12288:r834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:rHSnnrFb4PM4MYgLxEVyGLN
TLSH
T12E4523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574073B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c0712d93fdfb6b928d66e164feb9eda9d1ebc522ab92aa01c48a6a2849a8d9f7
MD5 dd0c233f997697e21aa1796e917085f1
SHA1 c45c52e187aeef7bc2c06e2be2cdd74104d751da
SHA512 795b4eef85bc436a698b18dc097d70082b91cdcbd005fd40b8c7b9a2e5c4cbe2127e4952002b20ef53e3c834596fbfeb3c5b3149bdd88f523915467e5f315495
SSDEEP 12288:HyPz5L8b34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:qzyUSnnrFb4PM4MYgLxEVyGLT
TLSH
T1FD55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c366112f30e7277d700c186e9c39b2f6c6d09de2204744b75e336e0906da5831
MD5 bdb9608bc535cb494a2f9760c51481ab
SHA1 05bbabc0e20dc6890f12de5d6ba0e58ee5d3256b
SHA512 663212212b3c9ebe155fad9919c79b18ab05e9ad57d0c98dfbc3f101af8ff951f74aa75b7d521d25f425056d00e6972ba5cfe6c1355e9f5b35aa19587b4fa16c
SSDEEP 12288:io34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:i7SnnrFb4PM4MYgLxEVyGLU
TLSH
T1B84523A63EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B8574163B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f87542161ddacc26329e424083a7fc18d6fee565241f2b033bb140e03413ccb5
MD5 0b972bf16037f050d7f73d1dfc4832b9
SHA1 e8f8c229d001f1238d664392727258d504f815e4
SHA512 2641f8868832acc08d3f887b9db8a0dc603b4e55c05c017397fabb8d03f8038282f4883dd47d63b206e6da8bb38276782fee5de1526f1629865f2b93fecf66d8
SSDEEP 12288:Xo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:X7SnnrFb4PM4MYgLxEVyGLR
TLSH
T1A14523A63EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e39e21e7ef145d2f8fee4adfae121b13648f71b07adf38026c9ce77818ff4d0b
MD5 aae4ee745ec8dc4c401551dfe7be4f69
SHA1 8ac1850a251df120757db080394ce99fd6bfde20
SHA512 c13e28fe93a21501b541f77ec2bfd5401356a546ddf96d3e1ab822d7544da638d44f95d77c2b4436b9927e795f4b559bd0d28388d7eb1ba5199a7328f96c4b1d
SSDEEP 12288:XyPz5L8b34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:azyUSnnrFb4PM4MYgLxEVyGLy
TLSH
T18A55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f05617b4d79a8a4791e9bdd0a2aeb8ee413d281f9148f246ff1cc30ae09c8cb3
MD5 220e2222c07ad058ba576f97c39adb51
SHA1 70e4475e66b705b784e1fde2dd416fae614e6d79
SHA512 3ed587451f97857fe930e9826f3c1da166b5408a9de0abd2c60c1d928071ee06a80974e61650a58015fc18ccf3c13912cf12f99b0e93f8dc47c10107afea68ed
SSDEEP 24576:bTHaLl3z0zDySnnrFb4PM4MYgLxEVyGL6:bT6Lljej4MYPVyGL6
TLSH
T1026502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 47ab87711f174b43a78befcabb2652a2beca2e7c2a975220eb73a3ff1450bcfd
MD5 1ecd869f48a2e0f322c1ed8e3c376877
SHA1 aa6c4e311b778d5d738fb51dec9b5a6754545eff
SHA512 9409a362cc279d250d20c146c5f309c36abfa0ec9ef0ffa6a968bb45d9ef1bb7ffb519b492547a0fa5059c8ab26a4c24fecf01566644684be65e1af3cbd9ab40
SSDEEP 24576:Y37d9CHKy7GZGSnnrFb4PM4MYgLxEVyGLI:i7d9CHKyafj4MYPVyGLI
TLSH
T10475DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4630b8e203611ea2f6536c5432f32fd54dbd4477a114df3966dcc3ec77c60e37
MD5 5eaf76700810c17075f8ba272bca3975
SHA1 80f61babbabdf68b8769277454ab8ab9c6d4568e
SHA512 93616df9d7e0828d815cf2ac1a685e6fde6ea72eba60720b1b45bbb9998146ddc6c759be884e07dbf36537c3e8b691096ef768c55e2cd2f4b9455bd32df96918
SSDEEP 12288:Vl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ily:ViSnnrFb4PM4MYgLxEVyGL8
TLSH
T1FE4523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 224ff00ae0831bcf993fd71d430210d6c8d1d1c529c37fb8367e11db69cefd8f
MD5 3b7de467f866e564b4ac34139ed8f66d
SHA1 a7d774c836647871eaf282ce1b52931d777947d0
SHA512 e10baf7a51bc6c0a1ac164415cf7b4404a9b5102d6137ecfb85980b6afe5957df3070fa4ddba9ac49d4def15146d351a7ab16931d9b39000e693487e2c3383f5
SSDEEP 12288:j734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:j0SnnrFb4PM4MYgLxEVyGLy
TLSH
T18C4523A62EDC10FFCF5D16F0C1A956C8E2097C62F976B20B7B8574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cc9b8e504a096f0265eb3996d7cafd25afb6b1392851a32d5d58893805031199
MD5 d438ffe68e68c94e3157fdf2e2790acd
SHA1 5c08ae0ba41de38f2a73ab6349f9ab3bd5d0bb28
SHA512 79c61433dd83e19109f70e8003fe20531330e6dd772c09d5c47693090697f68217dac89728a4a81bb564736f45141dc61da78214f7b3e20b71e8d550b940e226
SSDEEP 12288:GW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:GNSnnrFb4PM4MYgLxEVyGL1
TLSH
T16E4523A63EDD10EECF5D16F0C1A566C8E2097C63F9B6B20F7B8574063B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4e87d5374dbc3544c8784191c6d38ae260a6c0c1a5cb1409d61cfacb891a02d2
MD5 f8d1b08f669ae1b5303dbe85d0062eae
SHA1 ae01456d3f35e47868936647dde0545853ba681a
SHA512 37c7f1fb2e9c5a3dbc80f9b84d744b3f83e1dca4ffa05a1d377d9f01afc94333f738e2afd5fb55a41a4dc019cf77552b34faaf9698a5b481cb1cb8f538b3bdf3
SSDEEP 12288:5o34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:57SnnrFb4PM4MYgLxEVyGL1
TLSH
T1394523A63EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c35efc4807dbab4cc863e7927da18fcfaf403ea18a6e8cad78d24f3ac6955048
MD5 3b421c43d63b9d196edb9cecb0878607
SHA1 24c5f04c7ff0bfdd17e1dea0a35b8ec834e7c987
SHA512 090674f0a1d3031d095bad8eec9e21101ecc776a2507e63ed1df421d168819094cca20012ef71bf45fc3f4df1196084d987484705b696120bd61f22bcc7dc26d
SSDEEP 12288:9l34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:9iSnnrFb4PM4MYgLxEVyGLR
TLSH
T1DC4523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5c5ae83cc3335ed0beae2b6a4a524abad0941a74b0019bcb8a8c0303f9a76035
MD5 7eb49c28151a6bff168ccf2109a10445
SHA1 6899145d78becca5e70250f65243df908c209c97
SHA512 0d2a177382d3cdfb27e42e00cd5230ef287fc8def949807f13be61ab9fb77386c8a9c02ac04e8554b64381ce9980aff8f10d60e276e326210fafcbb7c254c59d
SSDEEP 12288:WQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:WjSnnrFb4PM4MYgLxEVyGL6
TLSH
T1DC4523A63EDD10EECF5D46F0C1A956C8E6097C62F9B6B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-10-01_151514_3756-4372.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-01_151514_3756-4372.log
Size 1KB
SHA256 ea071d641708b47e1d8c020c0e21bcd3db1558420f1c56b3224b7f75b428b836
MD5 361c70442d016f20e7d92bb90350cd13
SHA1 8136ccc84fa806eaee4ead07e3b1efa8c8ebf563
SHA512 c07e4e02cd9682921b19c8c9a35435c26d1249f2be443d464e96e00c06eec7e123cd6576e813869d5ac47a43a4bce39a36dd8d6367cf7f46e386c85cc4510925
TLSH
T1ED219D062BE84A05FFFB9E8299FA14539E3939962834D60C10A1434E5871F45EEB072F
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 edda5e588d4fcc4748c44bdde0f84a81ca00e2f4e5cad01ae416c8f20e601a19
MD5 283aa0f0b3b84a36a70c1571cf712a6e
SHA1 2f7d8080e3f4d6179982f3b429a00b471147aa80
SHA512 3457f98a57a85e0bd2fc09a0b20119efd7655cadedd21d212aa720584e77874dbab5b1c41f3fadd1641bb80663d3f76aebf3b0c67d395ed1ae576d32d5da761c
SSDEEP 24576:Zfwvok9RX6wkyAIXSnnrFb4PM4MYgLxEVyGLg:/MnYIQj4MYPVyGLg
TLSH
T1E885D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 364cd2f118d894aca1d599b5c49c4d7b32fbea99e88d23e42d54780908b7c24d
MD5 bc6abd1e7f4ef34fad1a1d27bf05fac0
SHA1 56327594960913c0b8e797ae1589ada368382a1f
SHA512 90564afc628c54f7498854f9bda5888f786a572f807baac831871af83e9be3967f6320385b9799226e037c0a90fe458b2cae7a537cbf1bb4156b069d2ede583e
SSDEEP 49152:wYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jj4MYPVyGLt:eySzPaVJ
TLSH
T156066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2b68803ba36509e5895657afc05d986309abef4e06639b55cc407504c2db3e2e
MD5 67eaedc68aba80b4fda3f3c33e113fcf
SHA1 9e8e434b718bb536357c9421b9a66f75f976fbf9
SHA512 581812f8953a07837e443aed55e592fc0917b4a4798774f7384b94acc8094f02a47836d1b443a5a849ea500830c911e77ae38e68fa9e8290bd364ca1f29ce702
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4SnnrFb4PM4MYgLxEVyGLA:a47JUQj1irIhCnDHUPfF/Zj4MYPVyGL
TLSH
T1A065BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e3eee2350303a47e88a90aa9adb3ea3c871f8b513354800fc6e04461adf35d43
MD5 1e2f39588c79efe5f69afed71d0d05ec
SHA1 b68709314f429e3db1877cf706139e966773d1bb
SHA512 bf86135d2425258698e9e1a2fa682834d85983b996d615d8a2e394bee5316ff1d4aaaa1cb7523522e7ddbd38e7f696c3e495308156b930635cb2718674483fd4
SSDEEP 12288:eNsfY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:HrSnnrFb4PM4MYgLxEVyGLP
TLSH
T12E55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1008KB
SHA256 27212b15f54e322482fc14ca2b21fac8518f47524977fc03f20ef0b5084bce72
MD5 9a8f220ac19a57bc72587fb84c333f1a
SHA1 86af304c49aecdce7983a2d326465aad13b6b753
SHA512 26455db80429fad8771a4d3d774c08754d8f8c193ceeecd160faec23a8aa48953ebb6df0426f72913974fb0f648742308cb8fdf8d052b7d820b2456945645121
SSDEEP 12288:PIiGTXbU3fm6PTJ5i9U4POdyskpalL3NQrLqR:PIiKLUPNtgT2JkpalZK
TLSH
T1BE2517517626DB5FC5A940321E33C6CCAB707D02EE05AB0372C9873FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 45874ca9384bef01caaf5b4d8313eb39fca3c4a672eb1acebb32b3313b03e107
MD5 cba6450da136ce07dc14f3f301fc37ca
SHA1 43493f220449fd165e9595175bf0f33d36dd645c
SHA512 66932561b94a73acc63439013476b5312958b0351aff21b290d1c02f3f831e1a29e8903e0219e1c89d2acc42ff4e397c26588b26fbd975c0b6072b8e6fb60f1c
SSDEEP 6144:V1yWe5bkIpmi828lCenMUwBE7ol47KGJrQytMxZQytMxyKUp4uxKlLXhrCc:V1yWe5GlC+MUwBE7ol47KGJSK9Uc
TLSH
T12755C681A536E7CFD0F76132072A5B8C6B64EC07B7095F2763CA053BD86A751A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dd09c4cee39dccd4ea08174617ecf2435c90d2360e9a59203a3610b8ccf4be25
MD5 049e52588c65e55679c170f22b03063e
SHA1 f797320ff938ff40d51fd5aec72a9fa3be6e9da0
SHA512 b61e98e6abecf9ff78b5dd1858f5df7e3b9eb324e848edcc9b752fe834c3179b3447d0a298f60eb243dbcee7270c27b75d3e070cfa00e41e2c8286a1532f5424
SSDEEP 12288:eM7A34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:bTSnnrFb4PM4MYgLxEVyGLy
TLSH
T11C4523722BDC14EADE7D16B081A95698B209BC21FF61F18BB740744A3A3768C9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 01fa156137c008d5def1ce4474a57533f09681f2154ad34fbfcb469a57c0c2c5
MD5 5896f450bac52bbafb493e981ac5251e
SHA1 6b2498c8f56e02c8a189b8325001c123848313af
SHA512 a5097a0a55fc9dfebe1ed41a8d16abc6b1d957bfab1b6c3109510491279a34a75ce9466f240be9c61d770e739c9b39c87479ae958c213ffeef60308161bf9df4
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYFSnnrFb4PM4MYgLxEVyGL5:2gb4mBIBhGFLj4MYPVyGL5
TLSH
T1F665AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a43d9b0915e050fbfb7c349c1d3a8cebfa9568c92f7acb259d770022037d0115
MD5 a21a97a9176f7d12f92cbdba60f32b06
SHA1 8ddeaa51798456466b7edcd7ec31114b320f7065
SHA512 80cf2abc096490daac45d414a435e6c3fca73abd27a1177e755634b10e6b2e0dad2243ead06af6a48a31b84acf0bd159e4278862f918ac0e6421b797b4ea8cd3
SSDEEP 24576:kG88u8FpJqH1bzria7/moSnnrFb4PM4MYgLxEVyGLO:X7ZFPqVea7/Gj4MYPVyGLO
TLSH
T15D85F16577E401F1D47BD138898646A3F672B8211370FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7fb4eb28250e425f49714debeb366efc226fce782d3c20178276484b176be125
MD5 34f54cc77ddef4a989962c4650bd61cb
SHA1 53b126933b12b526292f0c18bb0fbceb1e50a303
SHA512 634993de15ecbaf9e8247aa03e286f2728fb103d889630af24e78d0e6d9d16dee5c1b4ddf022f1a8ddea2a592b88b42d52d1509462bb494762469c5ca6e0056a
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPj4MYPVyGLt:YG05lO43bFVp
TLSH
T1AAD5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 260d5310c7fda1632ab80055f21913a6abb9d2485d1b66c17db392829c274d36
MD5 5738ad43920d1d43a24c41137a9a5bc6
SHA1 1c3798042d9d3e2bd8a87077b5ea4e4508220743
SHA512 06ad992d5710178721bcbd93be5d9f632ff6001459bdaea2652b11e3a059546c0e1b3b35388e15e4d68d16855ae744824ab9c6672c3cd92af1b25ed67bb2a4ed
SSDEEP 24576:2fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuSnnrFb4PM4MYgLxEVyGLl:ua5POZ3+Jt2pasx2+mnj4MYPVyGLl
TLSH
T13665AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7425446b119a3b582c0a740364060d1215144837fc8d255721d1b720e493fd1b
MD5 406e6533111b8910af69d6f3e2ada34f
SHA1 2417edbb5414583a9682f4e974d0abdd3cf26729
SHA512 cea0a7eb6833bcf565f1fd744a1c197152d40eba696fddc63a455dce8681ec220a19f7d5687587e84eff7ea22a87bd0fe606cd6e74b07b807fb5079b9236ebfb
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkASnnrFb4PM4MYgLxEVyGLH:fNc/zEOVHFmj4MYPVyGLH
TLSH
T11C858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c159acf522d7299ec41f9b0cf37b2cffeeabb9b7577aad42e120e47dda63baf3
MD5 73d2eb240f904f78ca65902ce31258a0
SHA1 1dd56e1291d68318900457c9c7c7819375949ccb
SHA512 1f6177aa87262992d71c51e1a5efa3a94c8bfdcb1e5c7691b05cf623989ab4c4134b1a2ff3d27b3e64cf1245c82cef8d3b0e8c0124f8f611dc94eb2c6ece1bfe
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmdSnnrFb4PM4MYgLxEVyGL2:n8MwBtOm2j4MYPVyGL2
TLSH
T18B559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f5ea9034d133764150437fb8615b4a2c4dfba2141fa86e7310986ea25492ad2e
MD5 753fcaf4f52747fd05824377f3737694
SHA1 977d668f4237fb522d1455cd7f60c34cce84642b
SHA512 02e3de26aa112104465a16393f25f6f1478ab412db1b4b6ad54e74540abcd812c7c3edf9ce09e440a4a0a8488b1129d0135cb7931a25bab42a5621caeec025c5
SSDEEP 12288:9HvUrBFrEjwaQT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:9PUr+NQsSnnrFb4PM4MYgLxEVyGLP
TLSH
T10D65E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 73eba98a0e242ce574d2121c385184c6368bb3ff21e4f03796ce3b6c45ca97aa
MD5 c50602de729d62cf8af6a229232eee98
SHA1 9d906642d0bf3e6cee369711931424ece7c31721
SHA512 ce2378ac0ae368f6e7abe19c10925e18d8cf5879bcd3514a4095e0eeceac8a5aba194c433ad935a68639de6f3a694c42fbd9a5c890c780c6f12abc755123d88d
SSDEEP 24576:rD3FHshBIYQgAvSnnrFb4PM4MYgLxEVyGLY:rDVHeBIAAIj4MYPVyGLY
TLSH
T17275E17EEA9C04E4D57BD1BCC6638A06E77138A9033266CB12D491B61F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-144-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1164-141-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1164-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1164-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1164-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1184-123-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1184-129-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1184-324-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1184-121-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2496-413-0x0000023B082D0000-0x0000023B084FD000-memory.dmp

Download

memory/2584-318-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2584-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2584-88-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/2584-93-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/2612-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2612-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2612-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2612-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2612-337-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2612-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2732-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2732-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2732-133-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2732-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2868-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2868-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3756-0-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/3756-40-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/3756-41-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/3756-7-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/3756-8-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/3756-1-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/4256-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4256-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4256-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4256-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4296-48-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4296-60-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4296-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4296-54-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4296-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4620-305-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4620-77-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4620-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4620-83-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4816-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4816-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4816-116-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4816-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4816-321-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5156-336-0x0000019CCAE00000-0x0000019CCAFDB000-memory.dmp

Download

memory/5624-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5624-64-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5624-71-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5624-288-0x0000000140000000-0x000000014020E000-memory.dmp

Download