1dfc7b369621edc462ac17c35d4f4ed8deee78546104a10af109e72802eabb2a

Analysis

max time kernel
123s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
Size 2.7MB
Sample260702-vm3sksav4v
SHA256 1dfc7b369621edc462ac17c35d4f4ed8deee78546104a10af109e72802eabb2a
MD5 8f894847f43c541711e91e2a31e81722
SHA1 180cf7d90e2ea7402dfaea1b52b2fd72cfc9ff2a
SHA512 4693ea6ed3fc37a302efd4995d9642759550ff3cc2638e2b4314f4ad57ec7ba1c35721c4c718c4fb71e07095e1bdd56f12866d4202e84f27fbefdacd3818b9ce
SSDEEP 49152:dSu7ZdXW7bRtySmnScQXSsGhF7LfXTiS/aZh615UfqkdirbGbc:seX2+cDG3vfXT5/aHA5UfNc
TLSH
T114D59C0566AC01A9FCB77674C8ADE5229A627C414BE0B6CF02D07D1B3B3E5F1B935722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
1532	elevation_service.exe
4372	elevation_service.exe
2404	maintenanceservice.exe
5400	OSE.EXE
5196	PerceptionSimulationService.exe
5016	perfhost.exe
3292	ReFsDedupSvc.exe
5596	SensorDataService.exe
5764	ssh-agent.exe
3264	AgentService.exe
296	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63d431fe43a2495a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\java.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003190c448450add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000058ea1b49450add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3d26a48450add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000017c8b48450add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e4d244b450add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc9b3449450add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{280DBBFF-4C46-4E5E-A4EB-A89BF8DB8369}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{EBE7B6E5-1429-4F0A-A1A1-A7F94E3A7EB6}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
632	explorer.exe
632	explorer.exe
1532	elevation_service.exe
1532	elevation_service.exe
1532	elevation_service.exe
1532	elevation_service.exe
1532	elevation_service.exe
1532	elevation_service.exe
1532	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	3292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3292	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3264	AgentService.exe
Token: 33	296	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	296	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	296	SearchIndexer.exe
Token: SeDebugPrivilege	5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeShutdownPrivilege	632	explorer.exe
Token: SeCreatePagefilePrivilege	632	explorer.exe
Token: SeDebugPrivilege	1532	elevation_service.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
5776	2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
4264	sihost.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5264	StartMenuExperienceHost.exe
5628	SearchHost.exe
632	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 296 wrote to memory of 5484	296	SearchIndexer.exe	99
PID 296 wrote to memory of 5568	296	SearchIndexer.exe	100
PID 296 wrote to memory of 5104	296	SearchIndexer.exe	101
PID 296 wrote to memory of 2300	296	SearchIndexer.exe	102
PID 4264 wrote to memory of 632	4264	sihost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_8f894847f43c541711e91e2a31e81722_cobalt-strike_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2740 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2740 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2436

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:632

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5628

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 db9931d2584ff4ce9dbf1593e96e2a0cbb0702b96533324acbb53a76493ce6a5
MD5 672eadb7ce930adaba892f8cdc555bb2
SHA1 9df9aa103a9d43ea52520718b215ebe9aec0431d
SHA512 485ea026fa0f4337352f89e519cf611c06d5cc926e28b5aea323cee3b2bc414a4aec9c203b37517bc9ad2f975cdcaf2e69434d9b6b304efab3b7ce2951c1074e
SSDEEP 49152:qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn55UfqkdirbGbc:c3q6sjBy5UfNc
TLSH
T135D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ad3a81dfee73dea0098e162680bfd82824485005cf51e84fdb5c6e67ec212adf
MD5 26eb60bc30812f33129ea51a748f3d0c
SHA1 13de52ca290b3235adb39abc8938fca9db34d133
SHA512 152638fa39331a34cdd0347977fb362800d8636f99b2af9af6e00843e3937b2e993058793392ca8dfde95abe0548cbeb00ac0625d8bf1d55e76596f80618f464
SSDEEP 24576:0XYfDtczAWt5wXWotDWi//dirlvZGMApYSRiO:ztcT5UfqkdirbGbc
TLSH
T1CE05F12877E508F9ED67813DC8A28501EB3378914790E7DF03A4AA251F772D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 60b2ca0e6a1a859f1a14753d7822b27dbe8e5efd0c279c47add43cb2f396c9f4
MD5 416319d64f01a09db5f425d2f484910d
SHA1 1aadb6995e8b5df79d7e4609616aad86a7659ddd
SHA512 dea2bcd479bb29a6e7dbd355c0f234694d00e8e47a8a8f6ff4463263f8145196c9656b0730a248a446407222e3e112a44949bdc15fe4e320e42fd45786a141f4
SSDEEP 24576:00Le5ji0hmxxrMrt5wXWotDWi//dirlvZGMApYSRiO:0Pji0Ajc5UfqkdirbGbc
TLSH
T13E359E16F6748771D073C0B9C5D2A68AEE7230825B308ACB4286D77C7F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7980b0775aeaae11aa52a64823996e857dabbb4a31d8904915223ee5718358bd
MD5 0eb68b9a2cf98a15460690b8921a7bf1
SHA1 6fd75a83d515f8e9b8e51d5c2e935d75707ae707
SHA512 bda05ad425fc64ed7b46f41b655736e1449c079e6ce4adbe195cec5c4e1a4feeb9813363232becd964f5d091405ad042956dd460e1334e3e370b7acac952237b
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWn6q8wyuVt5wXWotDWi//dirlvZGMApYSRiO:P/ezSC6vUzPveHjyw5UfqkdirbGbc
TLSH
T166756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b49f67f5f96d9fb1c43013e380edbe9a2c8ff4afad1414a8bcb6da523b7fa937
MD5 d51f010149f1f67ed4d52cb89a729eba
SHA1 f40dddec24d1502a85ebc6af60d97c42445cf4b3
SHA512 28b49a5d130ec2f755702ae0afff7ac0167ac72bb1bc240970ba025586233ecfa363de865090cdb0d349d11c72d53b3d6fe9f92d0c66dcc64eb0bc6d11cb10b9
SSDEEP 24576:kVbqPb88hv/l+YSt5wXWotDWi//dirlvZGMApYSRiO:kVO88hXl+L5UfqkdirbGbc
TLSH
T1E0559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 81342d65b5882cabecac593766386368d787458b567ab6ccee04e109c6e80d8b
MD5 d230cedc38bc7b7b1728c8ec3001113d
SHA1 827cf66b204bd04c0c724ac393e3c8557e63ea46
SHA512 b44679ed42f5cfcb4fc9e9e5520beca65dcfa98d9712c0f7439386d144f24bc28b45229da17b1461811d0320dc3d0f0b7f64ba9292305f0397f2c7f0b9621b69
SSDEEP 12288:WLnYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:WLnt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T125C42349DF9558F2FB5B4632B06D4E46AF627EC088C1C66E49603B685BFD0B0E13136B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 81f386fb5c884ce71014363da688ccaac04dd1cbad7157efe8852b92244faeb1
MD5 19891be2465f81d0e669dbcdce0842cd
SHA1 826de48d2d45826065f79d55835df4e64ae015e2
SHA512 93ecc94b346f2814e517b1048d5c7d2a27e1d060184b2054c3a876024df6fcd6601de41f05027616b57ecfed6fe8aac01b23a3ad462b1f3042a1878efda78af5
SSDEEP 24576:YJIUKt5wXWotDWi//dirlvZGMApYSRiO:YJIUa5UfqkdirbGbc
TLSH
T13905CF3BEE28FCE2C27E8D7956918600E77278704F5293CBD164830E9E275E05E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2ddda51a927889bd0b7097385411da71d8f2c14cbcee63dfc075bf347553b36d
MD5 b9959a758b0b45d6e365a74cc2b9f056
SHA1 dcb380d2432bf6ff166a5f13e265fc6cce7a7b80
SHA512 6fee1f5f0f1d61d8780efe9d0d8d9a7137390532d3817fe071d5eafa733329ebfeb786ad15cdb70f029406d717d10f09cb8b37f4a05a3fd81979af800a533d23
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THm:vQvGAdlCEL8c/DRNw5Cz5UfNc
TLSH
T157266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8b3995c729daa0721a4418600d0149106373683fbe6ec9170e0778fc80104521
MD5 92f372faa18ef4c6a943211641fb72dc
SHA1 6320d22cab1226ae3c06c852d3e6d4e2b0a03b40
SHA512 a3d6885bd3c86902920c2b194403dd713d06d12de70ab5a8a0a24b7968cc7126f67d3676ea770c47bf4f7c4bf70a6d821db7a93cb66063d7df7803b167513526
SSDEEP 24576:I0ewsAjEt5wXWotDWi//dirlvZGMApYSRiO:9ljs5UfqkdirbGbc
TLSH
T15015E031FE74E432C67F0DB22B26C706583D7A604B911AC3E3A85E9D5A742D26336B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5ad4e4780c29d0d13611b3da5e3946e40619080c3201a68cc86963d35b4802a8
MD5 3e4f88a128860cee8d441ae76d635e3c
SHA1 6ac9395770866c344df2379e70b8915cb6030528
SHA512 69960aa66c6f5494bc1d7cd2292904b24c42525d035e54b40508f2c61e938bbc0d4cec71554ed88ca6d3a7262a84e5c756b51a53b70e032a84cf71644610450e
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHeoN:jUEtQevvqc2W1cpV2tI329N
TLSH
T111474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e74922a2eb11b0ee710eb512adc62fc719abcb84d65ec6113d665e713e927d59
MD5 86b6f082b6343e1871032a46af7585e8
SHA1 216486678a1fed094500db1b3bc1ceb46baefc79
SHA512 520668d38640eb0f5bb8dc62b9e3bc708ae4977b270d9741b5c68ea0dd9497a2b6343af8e80cbfee095eefc875f7c30b6cd2ff50bcf8f5120c3653d573433f24
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/zM5UfqkdirbGbc:voqtVjnmX5UfNc
TLSH
T10FD58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 677a10db9995c4abaf482a08cb41f33466bfc1678d7492238a233cd02769977e
MD5 e06d8cc7f409c1f2cfb1add04841f4b2
SHA1 19b105a605f023720eeb0868fb8e434f93234e22
SHA512 9f91dee6348dcbdf3e5b0206b94c7c37a1bf0ea678d58d9f0ae0ac6291c343e12819f37c939593b628350399b0b6eeb2d8d22d0161ce9458af16aff052d52f98
SSDEEP 24576:qAhGL3IFoiwtA5l7S53Zt5wXWotDWi//dirlvZGMApYSRiO:qAMUFoiq5n5UfqkdirbGbc
TLSH
T14E35AE80EBF955D4F5B3AA78A9B68570EA76BCA55E31C20F1160D21F0E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ba0c5a866bc6fbe355a38a41abcb3604445bc6ff5813bc67dec2c9a91fa3939d
MD5 4d59cd9c9ecdaecc9621cda38b9824c2
SHA1 bea3504a7a220d2588de1e5f0e1c52957484ab51
SHA512 b5d9779832014a7a424a1abd856d5d67b6b2119983d8b5b89d6c75ed3c9f35ccd15347ecaa9a00eee74ae66239a379e30537e79fc5b646a726e4070d026fe472
SSDEEP 24576:awu4OWYt5wXWotDWi//dirlvZGMApYSRiO:awvO75UfqkdirbGbc
TLSH
T1B105F14A77A40CF9E9678239C557C536F7F2B8412A21C71F0760C75B6F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 276fbcd16da1c52ac5b21dd73f9d2cc5ba0103c409ce74dde1c86f6bef3ebcc0
MD5 a8918394a112f2d3fd71da36b7ad2205
SHA1 181ef9113d424e3d8ab946e77e4f6a9aabe5c157
SHA512 63bd21244258e64c108f138a3d643956c646095fd4fa120ca4d109a539f04902c20d15773bd1978ce9468c5b98ff20ce689a9a147cec961ce801aa4ce1b9d363
SSDEEP 12288:NeZ1Iy0YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:oZuDt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18EE4129A37E420F6E267823DE8F94A05E7727492576283CF062023691F7B6D1AD35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3fa2bc0927d79e345ef6783b33a58dce631e25fb43f68d89f3a6119db313f963
MD5 805b7493ad9fc38235e4b7a719c62cde
SHA1 be3fecaeef0524fee5bcb19f4abac35c1323ae72
SHA512 c2938d47802d63c3e8ccab150ce1b3999bfd9fa119b745bebaaba8ccd3c542d2da8c3ba53b2ef6e82ee6911ce5e2a07e3b7fbb0cc9e01f7c1191f3dc80829445
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:vQRQyi36YOcPbLvw2gAf+PN3e5UfNc
TLSH
T1FB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 314a743dca0029d6ec810e2b7fb5090d42bde3dcd7ae4c248d29623b5e1cee0f
MD5 c4a5d9b50b9e86a122f0af10ff14b7a1
SHA1 b1182663285755a9e161a637c60dcafb46852b7e
SHA512 3ef59a9389162bebcd1435d7486827d937a264f323d44fd1b0ec4c563b10ed2d27e38cdb82ea0d0c18bad0f46048ff281198b7ff5a5f9180cae09babe38b5c22
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:7QRQyi36YOcPbLvw2gAf+PN3e5UfNc
TLSH
T178667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3799f8cfcf14a23ee043fe0073e86c5249c76075e8ca4410e4e5a25dd5e336f0
MD5 506b8a582d30b60c4c40c8b03d6c9622
SHA1 60671e2596b782ad2d394ae2f4c8f4d0be8ca7ea
SHA512 7059781c36ff9740f6e2085c8d5f750b4bfc0ad31c523852d508e2eacaea8a37019b1fc19586d10afc330282e477b963cbc0a5d2860d27294c99a614c412555b
SSDEEP 49152:b68Qg55nhceWu7PNU3/c5UfqkdirbGbc:lthLRc/c5UfNc
TLSH
T176B54A33B2F600A9C44DD1769F4A872196D27C718FE1E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 697d5b3e09fb06291b55c7bcba22cd92e72a9d4d93951df25a76f77567e73a27
MD5 ead061d121ea9a266caeb1d0fc25ea23
SHA1 a4ac890f32182507c55fc0a6addf7150f0205ed3
SHA512 47cacf6b040e98454d4900f78735e8b858bccb70611c01107c1e0671110b26dee9e4b974132054b6496d7fe93f486caab09ba0d97b89bddd1beb3e7d1945cb34
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99c:ay5112gYy5azzVvt69nLKnhZt5UfNc
TLSH
T137167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a5f90ac8b6279599f36d87cb71e2cc585900c1cd3ee031b659e8c1a3d6d97870
MD5 310f6f7a6d716a55584d2e06852e29d8
SHA1 04161fd7cde78d352a4784e8714582bbe51a22aa
SHA512 3941dff4e6caac8929b7244a17ffdcd6f0a0bbc7d1d764d711a3d6ec37fa80a8b3a031d0f7cc85ebf7d4230148ff38630e359a345a10fecb78f8ad566b2fc64b
SSDEEP 49152:wB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glW5UfqkdirbGbc:qu6Jmdxd2dW5UfNc
TLSH
T176D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bfb2a5bdc06c1f9a4d936bf3ec0be51aa863d39b0c2bf7b53555bddfeafa1b62
MD5 445123dd517c503fdb5c56594d6966ee
SHA1 bcf4105c7a5a7bb4e21f6475899fb4add7a17344
SHA512 43851f3cbc0cce60dae299de2813f7ae9f12f02e195d8e58f5cac6d59b6c1716d2b846f385860bf96b7bc0fb301421a3affb3ac36ad4571768f00ee56c31d50a
SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4x65UfqkdirbGbc:zmifPWRX5UfNc
TLSH
T175B5BE13F2D900E8D05EC17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 367eaa9037a35489c853a364bc99641e5eecbf1e1df258ca4df5750e8fe0b7a8
MD5 b400c8766e1fc5b8195284736ca48743
SHA1 9b4ec9cf03de8af58da92552a35cf74a33fa8ce1
SHA512 4c2e888a2b1b427cc723582afe8637bb84d4d8505238412de7d8351153968992011016d423f5a1f317eeca89b16d5bbe4d7426d95869452f1b818af342a8a93e
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHqJ5UfqkdirbGbc:A5dKii61J5UfNc
TLSH
T1FAC5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 093a32c5299b1349f9ffead90fe4768ab505f8abe427ca283df5f74ea28cdeb6
MD5 17a5675009173cb8ba14d8b32a02fdad
SHA1 9887f975f04770c3cf98027a8b5eaac08e5eea82
SHA512 33d14d0b88039c96c54d56f29eca20b7a3522627edee1cede01e5822f2407cd9c0f65b1e7646f4857f0cff404f5d0cddc5008d0b60e8238ba175ba4092b8da1b
SSDEEP 49152:shtSn8EApI0fig3giDn0AP5wm5UfqkdirbGbc:NX2imphb5UfNc
TLSH
T16B95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3717770979162b4216494dd2c17d2e5a56b708c04eb4e4f552eda58192d92619
MD5 81573a9776d4c8ca936e71a7a4c04c63
SHA1 3fb5e03fbd33678eff70552664e9816bc0b21923
SHA512 ecf2dc5ceeec373c9dd8c5065fa1738334c1f4c32b9578a8ff8df70f40848e2c2b39caed33cf52e07deff8140ba8b6c4e47f3de38bc947e0ef0af60b28066d6a
SSDEEP 12288:n/YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:n/t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1C2C423499E9618F7F60B8672F06D4E46EF257AC1D9C2826E4A60332417FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e952056956cb1344ad4b4ac6c668e0876f6c5011ba5a59834e676431564247ff
MD5 115ddbb5cb8587aca46290de5876c9eb
SHA1 9d811910e5458150d3a0a5b434a00ce8e254caf7
SHA512 9583f54f7c9c4c8364d9636f12a494674520791913beeca62aca00a08ef4ef80d4da182bbd365e43cfbf42e17666a006c3d640fd8fb6971463db51172e69227b
SSDEEP 12288:SAYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:SAt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T174C423499E9718F7F60B8572F06D4E45EF217AC1D98282AE4E60362417FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7b4c84ef911470653b97a271eb9ed8f9a34ecda2776919dc702dc7c3fda21cc4
MD5 5089d0e3b61e2dececb7bfc9b80612f1
SHA1 e2844769de8c8a2024172d4587ef9b1fcabe5cb2
SHA512 fc645fcba13325d15fbff8e85753784afa2ea84363976802be8597eb91b1fa949b5cb07ef9293d0b2c2c237d0baad58d8c5983624fd1b26cb3bb3fc9e4812e18
SSDEEP 12288:giYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:git5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1A1C423499E9A18F7F60B8532F06D4F45EF217AC199C282AE4E60322417FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4e44b81946cea3a164a3aba12a0d3e8ce4cc7d15c495da3b9753e490009e6efc
MD5 a7347b29fbca2faa834e6a4495b6e004
SHA1 66ce8444951d50a9cd73fbe41deddd6d1b9f103e
SHA512 74451f6860f77ac4edab0b470aeb6687bb8ff6511a169ac238f4a8ec55fa9e79f49f7658ff86490cb0b94abadb7048503715ea00bd647ab0ee185eb2cda7edf7
SSDEEP 12288:mV5YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:ct5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1D0D423496FAA04F2E917C635E4794A45FB717DC0DA4283EF4A1036281FF92E0E531B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 02cb9e564a6eb6f6e1740c1ec2a3a62093a6172b22ceaad018071c19615e22ed
MD5 a6a179f041dde5d7e98527c7fe2ec199
SHA1 4864e595305ed89d85ac2b152baf6fb07d41adc1
SHA512 db66f1e9d0faa1c1980fb190305a9e3db55eb8164d99d288596b1936012c89ac62cd60d5db7e7e235cd9a9b6ee21a508c787e0b7f4390cd6302cd2222ad61061
SSDEEP 12288:PBYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:PBt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1B8C423499E9B18F7F60B8572F06D4F45EF257AC199C282AE4A60322417FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 729d9e46a8e71b30a0421e39d4c8178c0775a52b9c6b09c321f2a2b61b3895dc
MD5 52a92c2e7a3e043c64c333bb1c1e6dde
SHA1 b1ba38eb8fa62b1f18ad650294d9bbdf211efd57
SHA512 de43de5d1cc105a22e59c1b83bb37338ad8d60642b761d1a283ec69723aeb90706672fa2ef34545d53bf6cb69ca39491da86060308fe55bfda31e3405673b20b
SSDEEP 12288:ZcYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Zct5wXWotDWi//dirlvZGMApYSRiO
TLSH
T14AC423499E9A18F7F60B8532F06D4E45EF257AC1D9C282AE4A60362417FD1F0A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 55aedc8613fe59ae157fb578d1b0d2a14b2eb7cc02e33b7b4f5827bf6d463f58
MD5 e2c770807c1ffe0c4b080ec42b77322f
SHA1 4f6071580deb2878a9a51c408a3c9348c2a555e3
SHA512 1b38a1c35560ef00e58983aa4d7d12831602602eac13bb07ecb245d9b57f74447f7f5ceaacadf13fa7db56e71b3a298f2fefadc21447d45ed1666f7212a0a1bd
SSDEEP 12288:noYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:not5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1ADC42349DE9618F7F60B8572B06D4E45EF257AC1D9C282AE4A20362427FD1B0A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 21ff3f9f4f428e2c6d42cee9e4d775d4a41548622fb9c3ba45ccba5a9075d33d
MD5 29d14ee8a2809b6707499b0b5f5b89e9
SHA1 b4e46ad2c3372ec2c55fd55ab3ed2e64c1a31fb9
SHA512 feb47e8037d7d6d18b826710f5ccf48b5107b921e3fb43a3a7a81b43b93f5f6d0fffb41cf5c3fa32a39c3964b7f8cfd4cca33e3e6858bc24d37f1fb262370ded
SSDEEP 24576:5ZMRzFVSOgt5wXWotDWi//dirlvZGMApYSRiO:5ZMRzf05UfqkdirbGbc
TLSH
T162050295B3901CF5EC67823EC8658D06D6B27C550BA0C61F07B4362A1F773A15C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 7cdf71e4e8999703faa9ac2b3e6b4b350632b69ea6a6dbc7ddc2eadf862d3fae
MD5 eba5d85bfb1eeda360a955f005747abb
SHA1 ed2e4ca680e77856433528bf6d24cfaf8c52da60
SHA512 faca077b5c0be26e81dbe452e685ad45d6b1746cd259296f42da8179766520009d12c02409a61c0623eaa25eceed50da17e89f2086610791d64728a0ec287c23
SSDEEP 12288:OzYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Ozt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1D3C423499E9618F7F60B8536F06D4F45EF257AC198C282AE4E20362417FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 25887911bafdfade56a5ae03e7c6e3b00a764763422ba10987902f532e0c245b
MD5 56537ae301fe6346c84cface64345d90
SHA1 d4c389b694d883ea63f12d19423bbb2e21af4e32
SHA512 c726b4577cc101234c389e5b1dd7e06f7237da4162885eb992d0a1c9fc0b0fec585d43b42979c81bb2863fcf9e29b12cc6b378874e7c1994c31ca6d6c6bc7409
SSDEEP 12288:gXYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:gXt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T182C423499E9618F7F60B8572B06D4E45EF257AC1D98282AE4E20372427FD1F0A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3f9e390b74bf0f9dce2ae76f1723892a2949e3653a5f2db63fc01ca8d77eebc0
MD5 308da6e5e11a1ae30766c824bb678acd
SHA1 2d9da52c3409ecef1c04eaa2bc4126ad23bd7015
SHA512 f282bbe3dd04353c28330d2d94e389a38c3c5ae8526afaf4b746fcee191778704999ffd0a5f1c109a7f66b42cb7157a904abeb215df6ad8c377dacbbe7696ba9
SSDEEP 12288:yyPz5L80YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:vzy0t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T14BF4024777A530F9E1278239D8660E02F772787147508AAF476027762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4532c2815fe6599a649b4ff093ea39782037a8fd5d03012415062ffa7ab5ed82
MD5 7161fd409b7c0ac745fe19419ec583c4
SHA1 6845e3d64db161620c855985d123d3c86110e402
SHA512 311061114bdff3aef0d69dc6a1707a4561905643689d711747ac2da20b5f5dd6a80f98781608340efc246b3e96da849fecb1a6c25f76e7338af250d3f6d92f64
SSDEEP 12288:azYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:azt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1CBC423499E9618F7F60B8536F06D4F45EF257AC198C282AE4E60362817FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 fbe74fbfebd62deda97428dab86fdc4912845144336ce939d324b00e006fe368
MD5 9f2adbaf2ede52205f01641466296cc6
SHA1 59033465e7dc227c4090caa7213ee349fb36c567
SHA512 b70eed8f8d95b0bff52d3c71f88dd6a2f1ff75f1241b38c97ce751008dba2730cb72b5585b0482c0b84113be74a6c4e5dfdf314572086dc99a6d4aa3fccfa0cc
SSDEEP 12288:rzYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:rzt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1B8C423499E9618F7F60B8536F05D4F45EF257AC198C282AE4E60362427FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 8cdc0060406a996183fb749ec3d81c014a7ac763fe18eee8f4aa08e23acbc235
MD5 3e963a1364dc295f058c2cc58f2f13bb
SHA1 e6020c024f0c97df264b032af7cf35c4cc1413f4
SHA512 e8b342e5a7eb54620dfe4cf689bf087021a7c9c0e1cd0633742bc068fc935f2398231cec6a40e3802750b08a2694061787db921c8ffee8d96c3d0124a3355b10
SSDEEP 12288:EyPz5L80YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:dzy0t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1A7F4024777A530F9E1278239D8660E02F772787147508AAF476027762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 49c6e52b1e8cc0b2e1b777ab8170e2c2b8c755f3bcb4ab61d4a60fea3652a0aa
MD5 10e9c0a2c9ec1ad28987b29b29e07b84
SHA1 52d5373272d64a973223eab2f6b4c83e1b5c763b
SHA512 42fdf5e149f20aeeb6b98e8cb61c94a70df97cae2320b5fdc80a69270285ecf392213967acd000ee517cc6a11fed2fc33a73aabc348b351a4a8830912dd468ee
SSDEEP 24576:rTDaLl3z0zDyt5wXWotDWi//dirlvZGMApYSRiO:rTuLljj5UfqkdirbGbc
TLSH
T197050294B3901CF8EC67813EC8658906D6B27C560B60C61F07B4376A5F773A15C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 721695e584c9807a715f9d4ef504df8f9782a5b990a0d4d1e08de4026ee2da7c
MD5 9089987b2a8f1674abbb4a4f061660a5
SHA1 57bf5e127d9d3c13f4df67253d88900bccbf61d7
SHA512 36b2dfbfe8fbe95913e2b4231729b2c0e3fb37e0318ddc409425221c45549cbf47201d8fd0c901ae1b951d12f8542649eee4bf40d3a14de17cfcd483fff84bde
SSDEEP 24576:w3vd9CHKy7GZOt5wXWotDWi//dirlvZGMApYSRiO:6vd9CHKya05UfqkdirbGbc
TLSH
T11B25CF90F3E414E8F1B7CA35C9764512DAB67C9A5B61CA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ba65e09ffe57dd4f20881207b76312e76d3c3ccef65e9e3a134527a24a394658
MD5 ab206d6bfcee6bf852ad76b053001e01
SHA1 294265a9f161b97f684f6c7e3ab61c0c41defe2b
SHA512 9e538d06f2e780dab239a2a006fa88a5e70284f21362a2d915771947e2ef993b8cdb1cfeaa29db099ec6e622289fc40822d3db9b825f919bd7d471ee138cec09
SSDEEP 12288:lCYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:lCt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1E1C42349DE9A18F7F60B8572F06D4F45EF217AC199C282AE4A60362417FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5af832bce17d663f517890e6bde8e5b961597193c9a7b12f2b675cde8e13a3c4
MD5 cdf59955f6cdf573b27e5b8a04e06e38
SHA1 ca606ad5d28dc0acfeb592e6be4ae53a277991a8
SHA512 44bfa7a56d3880102a94dae46c161f1ea2f80c777dc7b1f8c88525e46268fa384c6c12dc169514d362a4e9e6df781e56fbe5090adbb361ab75f491bb24f9d67d
SSDEEP 12288:pUYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:pUt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T186C423499EA618F7F60B8572B06D4F45EF217AC1D88282AE4A60362417FD1F0E1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 fa864a5a89fd23b6eea44e5b56941db2ea3b26a5f522f5b8e2b5ea044ab625d5
MD5 e28572cb81e99f0d63761b706254d69d
SHA1 a8809b597b9adba67e7a56de52a7144f2eb494eb
SHA512 0f125804fa90dcbb699475e894e286ec4cc25812d10c8854cb417a42244af60000a93bdde62118a10ce8c1c90e826653d7cacab1cdf7f1f012aab014d243d9a7
SSDEEP 12288:BdYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Bdt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T19EC423499E9618F7F60B8532F06D4F45EF257AC198C282AE4A6036241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 790b9add96867c0197b7ab4e900946a80fcd1049b7d9bd4595fb2d550a3cbbd0
MD5 7608604e41630de7dae57ceb9fed27c7
SHA1 e4498443ebc1116bb28515d25bf6d743a3da2a3f
SHA512 83e1b96445648788dd645e2652e091ff9f176534754a14dbeb932b7860675b1bec813c1339bf310f68739f3bdced62e08a2e0f37ca1b805d9438487681a950b5
SSDEEP 12288:HzYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Hzt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1BAC423499E9618F7F60B8532F06D4F45EF257AC198C282AE4E6032241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 585802bdce0a6e16ea4c01ea2a4e32cfe83feb0555fc4f8b046bf512bc40f65c
MD5 1ca79f0125c3dd8ca486f758345a6467
SHA1 e21d1b1c777191a5d043e2598fdd177fc4a9884f
SHA512 12936b00c2341be68589b57e46f10481b1df6eeadc6a90d2d10f1d193010c26258539e9d41c881c9c2b6e6987679bbc9c99c1919205ff89eb2301ddaf9b2c63b
SSDEEP 12288:iCYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:iCt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T14DC42349DE9718F7F60B8572F06D4E45EF617AC199C282AE4A6032241BFD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4f5c3ba61b21443ff3b7e1348c9981493e54023f6d32c59d3c400e70a330bbe7
MD5 1b750627492189e1f04c7c6c622fd14d
SHA1 24b2b1acf9b8df1da2650d7e3502c194495ac9f2
SHA512 f4ff1fce9996ec26cd5fc5f9a9109b12bd6f5a3f5cd1361468e8bce331fd2d970b91d24e859d5c1d7212046164bcc05dca13814770a9fd8113a5e9f8b8b6aa11
SSDEEP 12288:G7YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:G7t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T140C423499E9608F7F60B8572F06D4E46EF657AC198C282AE4E20372417FD1F4A13176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 6c41e43f67ea4bfca12c539dceb3d727a3cac21aaa19c60080111ec9955b280a
MD5 4de23e0e4413121f2e60c844c6e1226b
SHA1 e573e508622c91b9bfb4c121034973e746db7011
SHA512 b31390686eac2a58737f733fd7c6a8ff3c755d3d40769329bda12786d8ad1cf352e4a6ae77547cd1ee7f99a63c278a73c25fdac13b3964bd5d373ae6a962c9e9
SSDEEP 12288:SBYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:SBt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15CC423499E9A18F7F60B8572F06D4F45EF617AC199C282AE4E50322417FD1F0A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 2c74fc2b0bf9a55b9a1b81c2de210c4735604f77adb9534270d1884a452ef3d9
MD5 abea6a7b09a212c03e5202d5e22acbca
SHA1 f3ed9af42c2fff0003d6d02b7bf7364c4aad6b17
SHA512 9a5f33ad8ca5f3e926398584ed19ae95de0f13758b531ab00a81cbc43808a52762b65d5a77b040629621a3650e79c162fc1e2162a2d69b6d9d452fc83b1536d8
SSDEEP 24576:ofwvUk9RX6wkyAIHt5wXWotDWi//dirlvZGMApYSRiO:8MnYIN5UfqkdirbGbc
TLSH
T19535DF29EBDC04E5E177923C99B7460AF6B178591B31C2CF029953AD0E37ED4AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 085584a69d553268923ffe1b86da0afaf4bf51e35975ba1e6f0d76af7f25d893
MD5 ef37a68636c8f82032ff3f79a049d875
SHA1 bfd796c8d7c95f0d24e4afe1b9c5ec1aee4c7de3
SHA512 bf269a0bb034d9a871693c293cdf4727d27602a320f406c9f57bfae97bd1b27cad93270a8f83736d1800f3991734932db73f0bc49d5421f4f80872c8e3dbe03d
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0G5UfqkdirbGbc:UySzP+5UfNc
TLSH
T1F4067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e8082717d4c2e40ebef504270b5e79ba556082b41fc56f65ed4c4419b904a6f8
MD5 3e0890859b7867850fb071f5af33f35a
SHA1 942b5bb70f557aec2ccd4d50a0f91a047222d97b
SHA512 8ff166cf1357360bf3aaec673f28cfcd3207627278b8677044b0ceca7deb75bd22090208ef362ad46ad5b4ec847a71d2676947cc90f947c34a9e324dcdd80764
SSDEEP 24576:d47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQt5wXWotDWi//dirlvZGMApYSRiO:d47JUQjTirIhCnDHUPfF/W5Ufqkdirbr
TLSH
T19065AE1EA3EC01E5E1BA827885154A1AEA71742E1F31CACF1270537D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a36cf2e0f4c5db88f7f94c1d5bcc1f435d5e9adc4d9b164afac129beb6c47961
MD5 168e0361bea42198a970d1fe85dcaa91
SHA1 0b941159f6c839459f2503750cd554c7cba2253e
SHA512 9641d8e29efd936a5a4f3ad9720b262914a41359fc578bb977e8769cf94fc13ddb5574ea6beceb579cf037b2138bfedd7bbd63bb97c13735fb863515d25b9cbd
SSDEEP 12288:AbsfDYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:nDt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T19DE4F009D29801E9D06E5236D75A4A41F7337C6187E1C3CB46D0F63E1FBA290ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 920KB
SHA256 e36f194008bb836e3673216c0f9e52fd117885dbb6067fb806ddca6540f7662f
MD5 7b42a62b21408e17f491cc04d78a75f4
SHA1 160ea8d5e09078b6659c84c4a2034cf6d5a9315a
SHA512 4970e676d699d3355e08bb9302d9a06b29a4c317cb94f275745618e48895f86a6a6ea8575907be9c5d879a8e616928b662f79ef5d3890e6d255a384781b63fb6
SSDEEP 12288:K3GdWU3fuM1BPOX6QzGSpEV3CQs1Qiz22:K3GQUPXP7QicEV3/s1vz22
TLSH
T18C152700B626DB4FC6A980325E33D1CCAB707D41EE45AB0372C9573FD57665DBAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 30cf68b3348eb8a2f4970a28935e2bfcce8ca72e2595a776ad2e049e0208f951
MD5 5d111a8bffb9d1987208984c9a0f20f9
SHA1 fbc6437d37033a5d10b3ea2f4f04df905c2720d9
SHA512 9c6acb1a4add3782035e1086bb245c6e83a20301d1247664c153b0db52007ef9ce58be6533ab0960f12c42a017141cfa18705c95d5122420bff50774705864c8
SSDEEP 6144:dSrjcFpFG26ghlAdnWyw0T6prItMxt5rItMxBzIPnUDycTlZLGt/t1G3:dSrjkLCgHvBDy311G3
TLSH
T15965D8419037A3CFC1FB6072472A9B8D67A4EC0677496F2673C4453AD82AB56B1B93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 dc66882a2fef203d14262db7b0b41c8115b98466de54d0989dd7f607309a89de
MD5 c982dd60d337e0243559a5b1d92284a5
SHA1 886900b9372e7301a3556cc69882bc3ccb12964c
SHA512 8a9a4a4cf6e17abb0d3b47be394cb010feaf0bfd185d7ef46d44c2e8cd5462acef1a4d81b02af1f393d91e5bda8374a18aa18d16b6222de1f33b44f30806b8ee
SSDEEP 12288:BM7LYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:aLt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1BAD423559F991CB6F92B4631B06D8A15BB267AD08F80C1EF8910336827FD1E0E93176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e406aad330a32f0a8207731cf1bfe394abd3f1d42de17ffa0b83819bac153e55
MD5 9d9ce5930a6b44a5679cadf50d4a9cf7
SHA1 2a5ba8862a3e1da56bf60f7be43826fe1c4b238e
SHA512 7b51912a2da91969e9fd903f603b9682c96d871a9e6ad70f34e7b1267aab1471d595adfde40b106ee508521bf05454c4075ca4ede3db645016ec621621e5e473
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYVt5wXWotDWi//dirlvZGMApYSRiO:Hgb4mBIBhGFI5UfqkdirbGbc
TLSH
T14E659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 eeb81205ff28db3dd75fa7ae0551ea9c1159b79ab22b6ba2017d2a70219273c3
MD5 29424abe9fa7fe28a08894f0c530dfba
SHA1 6345c50b03747d4c0eb632ecc7cf65d422236a8e
SHA512 f4fadbd2750e08afe53c313bb615ac712586e248ecf40583dead2bff2252e78bab00713e6c69a1fa4851775c81e6864b061b477862343cb9a639d27a39f161ca
SSDEEP 24576:hG88u8FpJqH1bzria7/mgt5wXWotDWi//dirlvZGMApYSRiO:k7ZFPqVea7/L5UfqkdirbGbc
TLSH
T10D35F165B7E101F1D47BD13889864A63F6B2B4210360EBDF0BA89B551F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 438d5640dac53c18e72a7fff6e7dddba38f7b7ce1e8b6c01b7f40635b38cf2e7
MD5 25729e578bd26c89c3a7045546baaad2
SHA1 b63f548d2e8f3eeccb6cef5ac0ffbd8c1c57f27f
SHA512 7b9a0db6189e9e3bad8bd108b49ef12b0ef561e54fc3242b220b51f7b769416712a3f08f21262de630f83b4d59cb3e11e7bc7f720c84a0df34dcd4ea2d844bb1
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjk5UfqkdirbGbc:fG05lO43b15UfNc
TLSH
T19CD5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e68356d8cb41dc659c3b3205c7069b91f9fbbde2f95eafbe906a299c98ae7093
MD5 51d2c3197177204d7feba2e58c78675a
SHA1 6175a618dcabe236ee0d260b872bec32c1218ddb
SHA512 aab74d612c70182c5a9bce940a623299e5e777e9023b97bf207add1802bf231fbd4b6962e1e9d2b975f908851d11c946100d06737e2f4f6bef098c7ab60f32db
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2t5wXWotDWi//dirlvZGMApYSRiO:+a5POZ3BJt2pasx2+mc5UfqkdirbGbc
TLSH
T15C65AE5EA6FC00D5D579D17DC5834A1AE5B1346153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e0f963d4ad28555dc41d3d60aeb5ed3f7e3d3db20353ddfff991a8b5cec2b29c
MD5 84b5f3a0ac4ea6ed095889b7dce1f3da
SHA1 a3be43a7dd34811e6681a8e30d61a28c96574080
SHA512 ddc3332721fc01c2225ba88a55419b507e1238c7d8001f2a9f54ba20383c0907c10ed84efa75f3158548f980e41a7f08e2f7b62dc594c5a36856927a3abd6663
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7Fk4t5wXWotDWi//dirlvZGMApYSRiO:MNc/zEOVHFr5UfqkdirbGbc
TLSH
T12A857B1623E901E4F5BBE1BE897B9946FA717865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0ac1757fba35f75a707e4b41267ac8f898d2abcc4f233d00564ecd5705474a9c
MD5 79eda61cb707ad71081728f0239de75c
SHA1 4377cd47532fe120d5c17041e0f53928d50b792f
SHA512 dff8a9b660b28585ed64f21e9a9b91edff9048106550c54a8077777e632f6a6c91f1b696f09111ae0dba4fc8722c8d58028862446a0049b9bf30c486c3d62315
SSDEEP 24576:PTkNvNnaFeYhJNtmZBm6t5wXWotDWi//dirlvZGMApYSRiO:PTMwBtOmq5UfqkdirbGbc
TLSH
T13555AF6EBAB845E4D1FEC6B5DD238512EA727461073293CF4290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 551c0cfe5fbbaceeba32306606d8c73168d595e114781b85544beaf7eb81d0b9
MD5 6c70ac48202afc3988ab241dc6215b3c
SHA1 8caaf7ca7a4ca4ecb1cfd50adc3bc031228370c5
SHA512 cb1f9a119e55fd56b375893cad615127771fa9ff74ad06ec027b4cc7f8bdd837e2e8dbf367cad1e444f414041b3789d1aaff1bdc4dcc55a4aa73f5fa8b35ba18
SSDEEP 24576:cPUr+NQMt5wXWotDWi//dirlvZGMApYSRiO:cJQ05UfqkdirbGbc
TLSH
T13D05F11F66AD18E5E67AD17D85868709F771B4620702D2CF02E0917E0F77AE8BC39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 6e24915ea2cb6506e89a5b1e769a907558a80eaaf6b471fcc99aa71df8993823
MD5 d35f7b5a9a05f7c5a3abb9632d87e0e4
SHA1 c9361ff7ec4e6237592eb80292e96089cd311a4e
SHA512 db9a594ac1e1cc6ef3757601a259098d5f9795b76104759ccc69d7164f4e0cda85d1cd0c79526ae4a355a5c55461c9553a0a8504c097dff82eef9f18ae0df7cd
SSDEEP 24576:XD3FHshBIYQgAft5wXWotDWi//dirlvZGMApYSRiO:XDVHeBIAAF5UfqkdirbGbc
TLSH
T19725E17DEB9C04E4E57BC1BCD6638A06E77138A9032256DB029091B91F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/296-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/296-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/296-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1532-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1532-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1532-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1532-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1532-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2404-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2404-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2404-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2404-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2404-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3264-134-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3264-128-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3264-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3264-136-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3264-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3292-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3292-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3292-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3292-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3292-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3292-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4372-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4372-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4372-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4372-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4372-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5016-78-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5016-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5016-83-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5016-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5196-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5196-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5196-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5196-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5400-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5400-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5400-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5400-282-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5596-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5596-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5596-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5596-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5596-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5596-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5628-348-0x0000017205CA0000-0x0000017205DA0000-memory.dmp

Download

memory/5628-394-0x0000017219D00000-0x0000017219D20000-memory.dmp

Download

memory/5628-362-0x0000017219940000-0x0000017219A40000-memory.dmp

Download

memory/5628-361-0x0000017206FE0000-0x0000017207000000-memory.dmp

Download

memory/5628-350-0x0000017205CA0000-0x0000017205DA0000-memory.dmp

Download

memory/5628-380-0x0000017209820000-0x0000017209840000-memory.dmp

Download

memory/5764-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5764-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5764-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5764-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5776-0-0x0000000140000000-0x00000001402B1000-memory.dmp

Download

memory/5776-87-0x0000000140000000-0x00000001402B1000-memory.dmp

Download

memory/5776-8-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/5776-7-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/5776-1-0x00000000021D0000-0x0000000002230000-memory.dmp

Download