29a755270628b3ec7978bcfe235ec4f026f79945c7387166d57d9f0177ad753f

Analysis

max time kernel
117s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample260709-cbmm4scv7s
SHA256 29a755270628b3ec7978bcfe235ec4f026f79945c7387166d57d9f0177ad753f
MD5 ba6bc02c5615dbf15eb741c981bcedef
SHA1 372a53cc2135f2b82bec0ec2aa7166e3c97c8727
SHA512 59f0df8cfd16803cf3645ec26b67c0a6cea38ac5ce1dbb9d317026bb6d7e8864213143c1225c579c78bb3e69700520ef7f1dcaff8e7d5cfb0e6b2ad9c70dae3b
SSDEEP 24576:Tkz/OaSWh1Mm2ouAgSnnrFb4PM4MYgLxEVyGLn:o37OAzj4MYPVyGLn
TLSH
T1F085E016B3E904F9F9B7677888715645EB327C524B30D65F03A0826A1F37A909D3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2448	elevation_service.exe
1056	elevation_service.exe
1856	maintenanceservice.exe
4108	OSE.EXE
4672	PerceptionSimulationService.exe
6084	perfhost.exe
2392	ReFsDedupSvc.exe
5400	SensorDataService.exe
2428	ssh-agent.exe
4176	AgentService.exe
3148	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\857e303f14575bfe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\javaw.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000614ea7de450fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063d71fdf450fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe4284de450fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c992e3de450fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{D0DA364C-C051-4876-A46A-9A11B45EC898}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{11C67E17-DC54-4C3D-A59B-9A94FAD3180E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
364	explorer.exe
364	explorer.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4472	2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2392	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4176	AgentService.exe
Token: 33	3148	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3148	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3148	SearchIndexer.exe
Token: SeDebugPrivilege	2448	elevation_service.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeShutdownPrivilege	364	explorer.exe
Token: SeCreatePagefilePrivilege	364	explorer.exe
Token: SeDebugPrivilege	1056	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4876	sihost.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe
364	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2360	StartMenuExperienceHost.exe
812	SearchHost.exe
364	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 3108	3148	SearchIndexer.exe	100
PID 3148 wrote to memory of 5824	3148	SearchIndexer.exe	101
PID 3148 wrote to memory of 5728	3148	SearchIndexer.exe	102
PID 3148 wrote to memory of 1600	3148	SearchIndexer.exe	103
PID 4876 wrote to memory of 364	4876	sihost.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ba6bc02c5615dbf15eb741c981bcedef_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1856

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4108

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6084

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2544 2548 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2544 2548 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:432

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:364

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:812

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dcda42e04cbddfee86cb29f95399dafe3a0e3321508dded301d97644904c53b8
MD5 6b2ef1a5b319d539a89b60908f05182b
SHA1 8c1d3aa0cfbf2ff1354fe0b90568683d775fa649
SHA512 f35f8dd66f5db35ea5f8837b5d5653ed9a00ae84c73c557cd56a285b224dc009d00d95c8714f8b94ef79d639d2a63423cb11a774a752cc737ad6035d89f36a28
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYj4MYPVyGL0:q3q6HjBGVw
TLSH
T12FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f812c65c7ebc56bf969627c83523027e92f9f8433cff125bae1a7e46856a94b6
MD5 0cb8d3bed720ebac2343c25364ba7bae
SHA1 db0e414c19ad65b8e61eeba024ef8b62f71729ff
SHA512 46a627c0751e485d10c89116561853c5869cfcb08082f57bfdacbd3378cc3cfd973fffeb1494c8dd0a77bc4a7228fe363a1a365067e84d4d8e07861e176a463b
SSDEEP 12288:11XLsswWkxy2lRq2czAh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9n:bXYfDtczAmSnnrFb4PM4MYgLxEVyGLt
TLSH
T11F65F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0ab1a5a0dd2f310ddd7160ba264d9bc17e4418cc3badc8b1f7e34ced8b37561b
MD5 bfe62511187f6893e70fdce2a18b6261
SHA1 5413c8f8d52254a89e4ec96736a54e131827e409
SHA512 e0447601617629a103c6294509208f8ea36b12749b3fc36618826e13b4b1d8b0aee15724cb81f093632d6694e87c4bb637399debf8fea7383b008d4068fabc60
SSDEEP 24576:B0Le5ji0hmxirMHSnnrFb4PM4MYgLxEVyGLO:BPji0Ac3j4MYPVyGLO
TLSH
T16F859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3b9b82c75ea3cfcc4799d66222082bd1ad411f9ceee93c48bd85d03272a05380
MD5 c44c0b53c302342b79563d5b8d33392e
SHA1 92116f8190cf280aafc8e9723c0547b66786cd6a
SHA512 dbb8dfd5210b0edadaae753fbd739cad64d4650878291922d6e8445fdcc0113d697abb782d178faeb5122e04459407462c29d2a98df05b5a5edc9780317f0624
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyuZSnnrFb4PM4MYgLxEVyGLR:S/ezSC6vUzPvxHjyrj4MYPVyGLR
TLSH
T112755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 02919514cfa66dcdab8ed741feff27b5c3cb06ab07b8ae4d9d819483332ca639
MD5 125d00ba719e97fc2193dc8f36bc5812
SHA1 b21eaff3bee71b7fdb30b3fca8707fb5e9db1737
SHA512 f6197c89d1c0913387e738dbe50c22afa78ab6e316181652bd1acd8ff9869b086ac4d6a604fc04306b29c1854ab5fa6963c096dc59b9debfca48e91ee9e66c46
SSDEEP 24576:/VbqPb88hv/l+6ySnnrFb4PM4MYgLxEVyGL9:/VO88hXl+kj4MYPVyGL9
TLSH
T192559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2b9bb11838699cbc9aba805e4bca866d7e931c3ac373d534df8abae1f44819bb
MD5 c81eb19791bce5500884e8554c5c8351
SHA1 718abd9a2fe8cfde7a1921f67207028111508384
SHA512 05ad63c828aa6ac08e83d8e9222e6d9548413a2435ace7d78edfafed703c8ec5e71673e68587755e5a41fb0e0589d55ba78a0a29cb891a85a99c28a660fa0bcd
SSDEEP 12288:/Rg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:/RzSnnrFb4PM4MYgLxEVyGLY
TLSH
T1AB4523A71BDC10EACFAE15B0D1B96AC8E6157C61F875B20B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6c079c4b3ca2871ee738139cfec817ea07f3df195843195a6872c3596d49d7f2
MD5 97ff0d619bf087856a10fe384f685202
SHA1 1282649638f350fe81a54f0d6811cccf3dc848b0
SHA512 94852bc8088a3c67a2b99f6cab66b3884aeb3b9511da660ba11d263858a8dfda59e701a75033c000fe45809cdce3e6173018b8cdd9f38d37c413cd7a80643f3e
SSDEEP 12288:ieBNUbTVO86Ud34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:iJIUaSnnrFb4PM4MYgLxEVyGL2
TLSH
T18865DF7BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9133b640349f0a1efba2e1f204a6fb34967a3a75ca2811b41cfebd937789e4ab
MD5 3a4fe0229731745e27cbb8f39a2a11e9
SHA1 8023bd5f4b9fb7b1b79ed172188a5d495cc58524
SHA512 d4a0a269592f64a701973bc29f00e619fdd4ae283bff6cc6de69dc2d53cf2208a1ad2bd6cc7d4f2b8638d24b877974dcbbc5f6049b2b2f1d01915ecd9c903cf4
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:WQvGAdlCEL8c/yRNw5CzV6
TLSH
T17C267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c70e9f28e921be70d36e607fcdf6f80f89286aca6253a82091fb446ed37212a4
MD5 a721d0422e8183f612446031378c6d69
SHA1 21725a3151c428dc608ee2c205d5c25f0e90dff7
SHA512 399c4bc2f126f42c7fbd9352415383ee8516728ecade8b392a25abccfd11f8e95218a2cb3432f5676dddc7a2f2e1274b1bcd4ccb721775c9f06fef16bf3f3f1a
SSDEEP 12288:LAwSfxL/2Dc34DLLmt0LDQewsAj734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAc:0dewsAj0SnnrFb4PM4MYgLxEVyGLr
TLSH
T19C75E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6c1862625cdd064b453e9dea6840da1c7fe5ae5bf10707e265ad367fd4254342
MD5 deebea0c1b75938d759b7bbb098014be
SHA1 94d4b7d52e626e569bcb7db3e511b42673c28aa6
SHA512 ff28f42fb3e927200a8198eebddf82acd738b5d32d94bec8ae0c09046352623e483fea0cdead6b5f4e3ec6cbe2c0677a465a3a23e0562b6f8a9caa81a681655f
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:ZUEtQevvqc2W1cpV2EI32
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 675988edc28bc89aadce08dd7e557d998ae0e2480c81e54dacead8b977a298d3
MD5 1fcc0e3117c71b957c57b552fa0f8045
SHA1 a8e4b4a75bd3cd068bae207fe951e74bb6d9c33d
SHA512 45f76214f4aa4d8a06d148b3605d0a7b78268931f26b9807a384a6e535f5f111ac17127e07c79c988087163959954cc423beb3ede02b75022effc3baf71659a8
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zHj4MYPVyGLb:WoqtVjnmHVn
TLSH
T1FBD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 79c7acc9073aeea8a57a5b7ee7c3ab0564aa04cb973ddcb7781263314db1b8d9
MD5 bfbd3460d02fd93a3ceb382f945f7d70
SHA1 deb62f56a238360dd7fcbed314426d89be04650e
SHA512 a3b2ed8034388640bfa1e85111aec89dc152306e1931669c7ca35fd0ffe5680ca67061a6e0f7e79c552444b85f3262c73ee8777021adfae6949db66ade544df0
SSDEEP 24576:EAhGLJIFoiwtA5l7S539SnnrFb4PM4MYgLxEVyGLd:EAMyFoiq5mj4MYPVyGLd
TLSH
T1B735AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 18be665edfe3fbd04c6b83d6ced23413bce0860c77e7baacae8f576c961210d0
MD5 0a423e45fd6583a12149c055432821c6
SHA1 90541d3b8ef1fd8daaa1d84b55120d6a33d66873
SHA512 4928510a93d09233f86e7ca8269fdf6b9f647cc9cdebb07832a3e466250e88b9d247476e753577f13b74779b367758724312874a8cf0cd750f9434414fcc9842
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqX:owuoOW4SnnrFb4PM4MYgLxEVyGLN
TLSH
T17765F04637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5af2b7051fbeb4b975216c66f5bd83ea8e74d1fe20aad919421a2f0077e81baf
MD5 f0302b0d537cdf47a1bb3ad7dd1700e7
SHA1 ae06319b9205517a76a93a981061fca6d39cf69f
SHA512 626dbf2f60f98ef15210dd61973c11b71c9ef7b5ae786e0eef183dd79ec6612a0b4a4e6fecd2acd5a235491c6976778472664729b4aba256396d33839f04e3d6
SSDEEP 12288:oBZ1Iyr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:WZuvSnnrFb4PM4MYgLxEVyGLX
TLSH
T1085512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e436773ad430050b2150765b2c45741c6583d14c0b5037829d7acd8035b94078
MD5 d6718af1c9b38175505014a18b0aa569
SHA1 235b8b19c42a9ebfc216cdaa7ddfc1e16fa396ed
SHA512 301112ad60ff48f7c5aa3bb21f085a1f29d5be20d1a9cd8101691a4478c59d73d65e811b4585b7206dd5c25d952dd9188e5f551347ba55dc2fe11d63fd6f615e
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UX:WQRQyi36YOcPQLvw2gAf+PN3yVK
TLSH
T122667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 42ec787e664f4cf2d99a5434d2a3850a5a9c0e7f333483757dd142b0ac65f53c
MD5 de704133964f056524a0b9fdbdac0814
SHA1 20d509b84fe1cc7abd51894037d0d3d7e77ffa91
SHA512 6472250295ee711f9f14aa62e8ce39dbea76ca07da4fdfcacb04ab5908d7561a84bd6babf5463f7d1d225b3d37a2f837263e1e333b52e477509c732e5c68c0a4
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:nQRQyi36YOcPQLvw2gAf+PN3yVd
TLSH
T105667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e8d46fa6e80313d1cb49ac0570d8e0c5fef021fae95ce4cd3fd21799679a1e5d
MD5 70f666b82675d23cac7fa611384e766d
SHA1 0928fbcf6e6bfda2faece5853fc31e2cc7dee8d3
SHA512 8afad811669645d375936ef562f6acec60b97c5e8fe3445c7d851613c3042ea2153b90b379197a77953bd779688c2927162af80c512db6c51682399bb1f9fc84
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0/SnnrFb4PM4MYgS:p68Qg55nhheWu7PNU3/3j4MYPVyGLR
TLSH
T11AB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e2c2e457c3fc81332bd0858274e8901c6cae7abdc736bafaca6ba1fe2a07bd0b
MD5 bd3d284909a18b9cc40eaa84e25eddc5
SHA1 4890a97d006903c9a44b055b40e0ec79fbb15ad9
SHA512 d4278af2d6dec1c778d623ea9c73329efbf29e71304a72a17216e1b54a08171a6d4e7fa2d87b1e629b321772a4f16f18b969d5bfcd32609cb0b1729b8cbfb746
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99B:by5112gYy5azzVvL69nLKnhZpVK
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 88c338871c1cfcfb98cf46890f09ac968e0cf303bb6907c55b92c7de24d63d37
MD5 e7304156d4db9f13a26e5bc082dfaddb
SHA1 0a8a48eb8eec867232351bdfa053576274622a7c
SHA512 5018ac7fa63a5f132e07357963e6d59f91cff691f5ca262df33baf9db65d5417eec0169ef45469b816364cef8fc663f9e98bcaa95638d2c626d18b01f61bfee6
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRj4MYPVyGLi:Ru6JmVxd2dqVG
TLSH
T13BD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 babef7352508c322970f458bc3da76cf0a86c7b09ab16a0732e09a7b0b729120
MD5 50d8e1737d0994f36dcbb5a4df52cad5
SHA1 a8b1fe6ab67c0f537d265581c86068ca3cf92314
SHA512 b602dcdc2fe1acffe85aa393a6ac86f99db7c5ca1614d51d061b61d810ff8c8df690e98e5167ffc85efa1e5aae60d5db982c1b9e53f84a051b7b2a9d5a51f746
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4x1j4MYPVyGLS:pmifPbRHV2
TLSH
T191B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c536715bc2170af2904e16afee3b95d25982cd1810457d45f9cb4f1eaf8d06a6
MD5 cf82778ce12839d9836c940db43300e1
SHA1 a6654427d55b7aeae313f058a14cfc4b8c05b319
SHA512 bf97b1d8ac7b3c27489326f2e0da1d7b3fba25cedee08cbc1385cdc1c3da1011dd696f4238cb4fa19f2900c81ca788b4967d69f592c29b6a33209b9f8ab2db42
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHqIj4MYPVyGLd:F5dKTi611V5
TLSH
T129C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 84745bfc3b65d03b9fdd8c0e330e7afe9efd0f696585c7814450065fa72ae53b
MD5 b0a74fde6d74818db3231dfbf8f303c3
SHA1 539b93d39e15d20bc206f2771a0e83c5aeba1508
SHA512 06854fab1323f67aaf45eafa72a07df094e1858c6e17c6212ee209003111e27549a50e741c92fc3adab71111b0b589f6dc237044eab6571a7f35734a77413a32
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wBj4MYPVyGL/:QX2iyph7Vb
TLSH
T1AA95BE13F2D900E8D06ED174C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e14fa6077e9c4397fd9ca059455ab096592e79159b103738fcc34bc6b8fe3ddf
MD5 74a4d34f2836e674709afbcd3e90c079
SHA1 cef79e40e99cd594174091fd7c2043fab4210d82
SHA512 a3dd18291a1baad981602d5883231970bb3f00a7a749ed44430341324fbca43a197b13c0f1093768bd44063eb1ac4e9f1fad57a5cbe36dea7fa65b4a27fac053
SSDEEP 12288:CI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:CbSnnrFb4PM4MYgLxEVyGLs
TLSH
T1CB4523A62EDC10EFCF5D06F0C1A566C8E2097C62F976B20F7B8574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 64cb3939faba70f39903860ce8d3b189f6a75bb0cf90e1f6725c367b5d3411ef
MD5 51a327c1ab758c90ac23a6b286c44e51
SHA1 ba9a19d556741136d53d44796968055ee0563b58
SHA512 56471e65d8fb109f096da639196e4b1cf6c3f150b0085750cb664e82638c0cecca499c4ed27aa4680d29d36f4ef9d92508297d830a1d56654c3750aefdda0d16
SSDEEP 12288:WP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:WQSnnrFb4PM4MYgLxEVyGLs
TLSH
T1A24523A62EDC10EFCF5D16F0C1A566C8E2097C63F976B20B7B8574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cef2de704b9a597621148aa3434e15d76545f1370c56005e2020d537005b6a8c
MD5 f5db1054ab834375049da0f273e221b2
SHA1 2d73de2ec8667e93b70a862dc2cbe03eb05f6eb1
SHA512 790c3cd6f77ca64afa9d28ac6a1693588631070c8d5179d5ff5fd5b36e1eca52d3a2594d01dd6cc8e5541fa0f2b15101273f3d6d232eb49af06753cebd6c5580
SSDEEP 12288:2F34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:2CSnnrFb4PM4MYgLxEVyGLJ
TLSH
T1194523A62EDC10EFCF5D06F0C1A666C8E2097C62F976B20F7B8574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ee6933c36a9d3f73ce76af54d72415ff5e5d2d1af99960e9206f2a7fcdf55217
MD5 d07f2886b7fc87286fc8cbb89a667272
SHA1 6ed2980b2bef8aa9c6e0b6c03727a4435f585dc2
SHA512 dcd4f316387036a9930421382f4c77e2f84bb38f5d03a160144ad6a4410e6f02d5671f96406c184cfe573e7c0592bbb3642a095eb35fe7c344f473f119c5b4cb
SSDEEP 12288:nVm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:rSnnrFb4PM4MYgLxEVyGLS
TLSH
T1414523662BDD10EACE6A96B0C1B656C8E2257C61FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4e2e63098d52398f9238c92401c8eecd56b1d24efdcefb92ef4ee58b764d2e92
MD5 0220c37f292e04963b2aa7c8265164cb
SHA1 dcc0e9f0232ee82123852dd6dd795598c7c1f7c7
SHA512 36cba1c9b351420fa61a160af01399997d39af5575d589ae21c7608b448033207ab85889b1f212b2318bc8bac366c18a46a36d90b3ba13e6e8d8ff7da9366b59
SSDEEP 12288:Be34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:BVSnnrFb4PM4MYgLxEVyGLj
TLSH
T1284523A62EDC10EFCF5D16F0C1A656C8E2097C63F976B20F7B8574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6b3ef8119c86eaa594c236836e8b44575120a6cf37a5a6fdb3f3ac30387a53e9
MD5 e3761a111d3ea624443d0006af737595
SHA1 abc5c38cd13e486b2b95b47f472feeb685107ab3
SHA512 9f905b9e3a44a285d0eb577c75bdd2b71634f8b64c7e372f8035c0f7d4129284132115280fa85fad97da6aad266adbd629134eedb83145387eff2cf014c1ca0b
SSDEEP 12288:wD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:wcSnnrFb4PM4MYgLxEVyGLj
TLSH
T10A4523A62EDC10EFCF6D16F0C1A566C8E2097C62F976B20F7B8574073B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 64f0e3124179fa2c4ed089e7e9c6533a83a9c353518f317ed3bdad7492ad0718
MD5 5e3f81fc9c4316fa27c349f2a4c984fc
SHA1 fd16e036f6d7567c06438a6b2da0e718a4bebbc3
SHA512 782290a9927a2127288c58774e363df69d015c3f86e868d06416775e11a1f583caec8914c147d12e4c5adfbc90bdf4551d188b52de9a845f229b5b243d13571f
SSDEEP 12288:dH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:dISnnrFb4PM4MYgLxEVyGL6
TLSH
T1E64523A62EDC11EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2af687ed31cd1bf2e1e59d8dfac7475f0dd215a3aedb8e086607df379a2a0fc5
MD5 982b1627af4f30cf2bae98b0e71eb0c0
SHA1 33f8eb4aa73a337a12ce659e5b0d059949b01127
SHA512 2016d8368fe7ee8abc88b68da94580069337f88662f4062401cb9377cbe4eb2fd3b0adfa10bf861c6f4e6698f046d28834b348c74eac4397ee2a8b1a1d84e773
SSDEEP 12288:FiZwb6zzFEoS2cPvyv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r25:IZMSzFVSOwSnnrFb4PM4MYgLxEVyGLg
TLSH
T1386502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bf930be4158d3394797e8ef670c81cada1bd5262856fefa9603e422a99938c7f
MD5 ad906da2038ac5242dc8b7c42ede3f19
SHA1 44356c5543ff9fadf399b4fe2d8bec22cf7b339c
SHA512 a182eab7555e9b3362d659f60dcb961759d506369da2206ab9cf09ba68d81a303789b0c63369e71b4ab1a696b90de03c1efd0967f9cfd3d1d4c3a11046919e48
SSDEEP 12288:BU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:BfSnnrFb4PM4MYgLxEVyGLR
TLSH
T15E4523A62EDC10EECF5D06F0C1A666C8E2097C63F976B20F7B8574173B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c20c5baa336494be105f14b75de6bbaaff8e2a89269808fa7e40e26e4d34d4cc
MD5 b4090ffcb6fc32b43232215b26122af5
SHA1 06a983090d8db84a25bffc5441ed26ae2cd97433
SHA512 ad5275c47e43d88fc6865855cda9d5311520bc807dc42af959d747f792ac0300bca9db9203d16fa3a85013c561c0d6fc33c33680b96b515a9e54896068bdb820
SSDEEP 12288:YQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:YjSnnrFb4PM4MYgLxEVyGLR
TLSH
T1BD4523A62EDC11EECF6D06F0C1A566C8E2097C63F976B20F7B4574073B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 65e34888a813430e6a02e5f46276434a8ead58d1dad5f8a419547706b9ece6e2
MD5 722aa72f38bd492d15fd5912b9fae494
SHA1 63194561bc379d19ab0dc6c886084e037a91e41d
SHA512 633de581d3434a91dbd34c2fc2db54ba63a3cbd9b06b9ca8a00179dcc107600251e66d82659d79d797198d6d1cc81187accf4a1041f67aa10725fd5caf96d271
SSDEEP 12288:/yPz5L8r34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:yzykSnnrFb4PM4MYgLxEVyGLz
TLSH
T17455025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b57098d2b1b2b47cb643735e160fd1e7d91ce02fc9d463abf5dc0351996ffe1b
MD5 78ccd0c35231405726ba11f3de37c213
SHA1 bdac66983b9208dce97c725cf53da6d90438294e
SHA512 5789721b11946b59d05431357d2ebbf63d7782832240a217b0be8eb47341c818f1c82cdb1f900250e3fd7a07f6a8ecd032cb72f21276c8bed8cacd2a64de52d5
SSDEEP 12288:DU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:DfSnnrFb4PM4MYgLxEVyGLF
TLSH
T1844523A62EDC10EECF5D06F0C1A656C8E2097C63F976B20F7B8574173B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a5336f3f8eb88284de4265bb8efcc9023c463c9971605880f6d6a20a23a45928
MD5 cf32a636eecac2528229540645c68691
SHA1 9dc3852775c7653225cbcaede7170828aef7b269
SHA512 beb9eff3f0d304b7ecaac8d25927086ae1dda087d9c14030960b1ffcc530c3cfa42022240287e702c8c7543d674dd8066c5c33b4d534a5d7163cf51cbfa24544
SSDEEP 12288:YU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:YfSnnrFb4PM4MYgLxEVyGLx
TLSH
T1464523A62EDC10EECF6D06F0C1A566C8E2097C63F976B20F7B8574173B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a425e52a8a1bf5337fdc2f1aae9135c0be1dd638af42c3ace2290439b60cd899
MD5 68cb8a143cb6700df7983fd45d4b5cb9
SHA1 4e0b0cf0a8ed4a90b62ee874c62843111288fa53
SHA512 ad6de2a40f7cbd10b929ab512d3224af1ebd7d003b2a1120e16531a978ccc066b74814e0529fe83c78a34aba08c94fc09475ef12fe123ef9cd3251244a91c8f9
SSDEEP 12288:MyPz5L8r34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:VzykSnnrFb4PM4MYgLxEVyGLP
TLSH
T16255025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 97a254ac7f82e3cdde3a2ec9244c007e44a9d15f82c46a68c38c9c39c4855514
MD5 4045b202f24e578b6e7a56993076b375
SHA1 d876ca3ac3c1a3a605280aa168bc3fb25442df68
SHA512 9a4fc674a0b871ea475b1d3ad746e4dd17fc2db943f1d9e5473023b363fffac76843a3030d8ecba7a5f7b659f792a82796894f2d254c486c1714fa87d8abd7ea
SSDEEP 24576:gTHaLl3z0zDSSnnrFb4PM4MYgLxEVyGLT:gT6LljSj4MYPVyGLT
TLSH
T1FC6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a118a93a1432185c460fb7e4cb97e4de0be82760be02c8dfa8e52261c6cd8af4
MD5 77484d2ced2d3233e8117e41730ed99e
SHA1 d3bcc46f2a569ca5b64638f177e91e4b15fcd6e6
SHA512 bdee09150da6be0cc2bc973ef9ec145a65d39007dcd6197ab1620d81c8a67978633ad1d6ccaebef8899066ccd0ab67f2a4d83d697d69a69557daa12183a20bdc
SSDEEP 24576:137d9CHKy7GZuSnnrFb4PM4MYgLxEVyGLu:V7d9CHKya/j4MYPVyGLu
TLSH
T1F175DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d13cb64ee20846ba5ea3e212b2fb180d1b5dd65f2bc37b571dad8a2059387f70
MD5 b9f5d91d256ebf6610de8536aa18b771
SHA1 0ab9a45bb0ccd54e051b352b148db52ec1e92914
SHA512 0765845cfaa4f573e54cb57361d196d2b4324b850b83442ed683e0acc05e373eefc7ef686196fba6be06fb47a824590799214c13fbef332113b00af18871f742
SSDEEP 12288:Vl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:ViSnnrFb4PM4MYgLxEVyGL6
TLSH
T1094523A62EDC10EECF5D06F0C1A656C8E2097C62F976B20F7B8574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a1e418e351c6eabc4b4c4c9b08678f39f926597ac17f9574689ed3d974274c94
MD5 efca5b9ef8d0790dcec124d1aa633444
SHA1 2980f95f805e278f2d612ec3b9c27dfbc241a1ef
SHA512 0785a2d5fd70f55421dcd574ad5248c62ed58340307a566e41fae7b3c068cb7a125ebf7400e604337d0cf2908a189584344ea566076d71b54d948830d9afa5a8
SSDEEP 12288:nL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:nESnnrFb4PM4MYgLxEVyGLS
TLSH
T1FF4523A62EDC10EFCF5D16F0C1AA56C8E2057C62F976B20F7B8574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a9d246282954cd657d1c79367fa9f88339a9d17f76f8727f8023618f607bd0cd
MD5 cc34aa7b61967369d70f2456cfa18856
SHA1 ee7f4fa3542dd9db7ff0dbb065322aed6dceddd5
SHA512 9a1ef6d3e525d64f331cbe55d1d2b369b3615bdb70fa82372ef51a21d9ddc7f6a8b1d1461257bf80a426fde83005e9e814fec2767a6c620de1089e941940c5de
SSDEEP 12288:Ai34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilw:AxSnnrFb4PM4MYgLxEVyGLO
TLSH
T1A34523A62EDC10EECF5D06F0C1A666C8E6097C63F976B20F7B8574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6cba645817025b020bb28dba9cba904628479ac58dc22ab5e24b2e123ed553e0
MD5 f9120dfbe53d0bff5a00f73c8130f805
SHA1 2980cbd3e2eeacda0dfff3a5792fcac5502cb965
SHA512 e59a91fd5fb207d1149570ecb197504ab089d62f391ce41a71b67476664ac7b63ebe29c2784ceaa5ef911cbe33b8054666d12f5bd64c80b3af1116a3e8c88d2b
SSDEEP 12288:/U34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:/fSnnrFb4PM4MYgLxEVyGLk
TLSH
T16D4523A62EDC10EECF5D06F0C1A666C8E2097C63F976B20F7B8574173B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 55d45e21e00d8f622dd36f6c659962867c7cb6a534b82e0d0680b9785e442069
MD5 329f60da54b0d6b54b112cb179666b99
SHA1 faf349c3088e06fabb38b2f65290943cf5f68ebe
SHA512 1ff1b75268be33dd30acd2dea0641b964ae98866358f32b51aaa764674cdd586d3fde9ba44e7214fd8894c7a63a1f62e6dcae498f12c12674ea2396064feac65
SSDEEP 12288:Bl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:BiSnnrFb4PM4MYgLxEVyGLg
TLSH
T11F4523A62EDD10EFCF5D06F0C1A656C8E2097C63F976B20F7B8574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b5570e465f7f534c76127a315875f189a0371223db46990bf21b65951e983088
MD5 af9a4a1c4f1863c9880d002f5d62315f
SHA1 f6d8608549c5fab3e1a1e07c42ad6135da18603c
SHA512 36a95a3c2ad8b769b35704859368e802058357dc2168b3efaf3a109f25782ed4c4416f77d63ef9607e1f313583614eb76b856b1abd8e971253c66575179e932d
SSDEEP 12288:DM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:DXSnnrFb4PM4MYgLxEVyGLk
TLSH
T1FC4523A62EDC11EFCF5D46F0C1AA56C8E6097C62F976B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5d9c1ebed3455eaf7ebd50bcfb53cef1a46fb62e213611fe26cd9ff189ccc4d7
MD5 977e7b26e758f2ec1f42b6aa68582b4b
SHA1 c07a0123c9bd0b157079ac572e92fe2b7df963c0
SHA512 03243ae4dea9bedeb574b45aee0b5054b6b9ad830f2d752714b2c6eaba022dfe31c3f049761586d75000f6b8c3b6eb33e1bfb576955c57a3697144bc65e34df8
SSDEEP 12288:9e34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:9VSnnrFb4PM4MYgLxEVyGLA
TLSH
T1464523A62EDD10EECF5D06F0C1A666C8E2097C63F976B20F7B8574173B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 e4526104cdd24a8e0636334f9e4575182d5bdb63fe55d4fb7c2b392d7e2a7c23
MD5 dcacd416d0edac0e2a791e254b74ccfa
SHA1 86ae42487eda30d65def7995908ee8998cc5eb0e
SHA512 699d67c5dbb4391e96178bc9bddde9598e682bbf8ccb0733d223a27bde5ac9a935d70367209069cdae4cf0ee5e65a5c4670734f27b503142f9c5a91f34536d6a
SSDEEP 12288:JN34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:JKSnnrFb4PM4MYgLxEVyGLc
TLSH
T1044523A62EDD11EFCF6D06F0C1A956C8E6097C62F976B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 449d1e3413371ac98252f4d0d3696313ff05411ca28dacfd0101d74da122dcd9
MD5 5831921fb26454b6e4107cac7a67624b
SHA1 087909bbd9b3b95968270d37c05a749dfe838f8a
SHA512 7fa609c62d0d021ad30fab55b89dffbc97f9deb7b5ffcff2afdbce59269d6c1fd8bce4d228e5cfb708e385792d3eaf493da3acf0768b63eb68ba4b4f4e0b0ab5
SSDEEP 12288:we34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:wVSnnrFb4PM4MYgLxEVyGLh
TLSH
T1B74523A62EDD10EECF5D06F0C1A656C8E2097C63F976B20F7B8574173B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 252d93ccc6a1b8abf4fd806086d36f92ee45149941218ab4cfc2a5b49f8c01dc
MD5 4cb53706f75f91875e0018fb32d79a96
SHA1 ddd58e7172713048975c7d0e7c48dfc76b1faeb8
SHA512 93a845e48c6edbbfb2d0f689bba8c61486723ebb8af4111aca1b676702b0a329a2e2b5b55b4b3d0eadf30470718a1565af4767f4b345da25b2a6fc55085d5d71
SSDEEP 24576:xfwvok9RX6wkyAITSnnrFb4PM4MYgLxEVyGLJ:XMnYIcj4MYPVyGLJ
TLSH
T1EC85D029EBDC04E5E1B7923C89B7460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 017939ced35f2d9bb3f915a8b8a7dc2dd6380b0d079b484806193e202661615e
MD5 a3df2c9b893f5007faaedf3db1ec35d6
SHA1 9f29a709d3d4693f545dba4059cba4eb86c2c358
SHA512 315be72388457de0ec525b5ce3d523889d851fa21f475e22b24ca731cd1e3bdd6a538f1ba793fdf2b4c0d9cd98dbd30a98c3ed3fb8d42d7d70f0cb166dfc875c
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hj4MYPVyGLK:SySzPSVu
TLSH
T14D066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 129495cd2f4b1f05108a1e22cebdb8bc906ea30c2115ccdcad3dab015125ccf2
MD5 2875176691d67f0c5e3fb53bff273297
SHA1 e4648867d95feb9421ad4fdb0905f41c55a6c5ac
SHA512 2bb8086aeacfd9244616c95a370ebb07068a39ad93fa18541ae571d15314c4408755e72652f2aaeff8e336259c04a7c351130dece1a0b5fdb2371d87ff36153e
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgSnnrFb4PM4MYgLxEVyGLI:i47JUQj1irIhCnDHUPfF/Rj4MYPVyGLI
TLSH
T1A365BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5db9c0ed5f7bc7f0111ba880f161187204c42940938b073a1257a79af4e29d0d
MD5 3363a25b2ffd00c1b7f2f0302b571be9
SHA1 26e8b9d78fc01ec216b97533aa147cf1f8cb32fc
SHA512 96d2894a5fd2a343a966e0a75c584529dce3e0e1731cf4709896f7b3118f532cee04a081ae6eefffbc5a3fbb5709fa4e7080b584d2a6e8c9dd68494876ad9003
SSDEEP 12288:aNsfk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:TvSnnrFb4PM4MYgLxEVyGLJ
TLSH
T10755F15AD29801E9C56E6271C3565A84F3237C2197E1E3CB67C0F43E2F3A6849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 8eeaf616f9f7150f40fd792fcf0492e762c3333ba6ab3410edf908241abe5dbb
MD5 2a170ff5421bc931c4959aedd8735883
SHA1 c8d6c205115432dcc55848bf41c234bf77dd0e1a
SHA512 af2cff85697a6fe8ff74c2a21ed74a1b32ea4792da3cbf38d30357372d535efc9406411646bbbe600aca073073a298fe5bd2d268d5ec87af9207f4df63172f56
SSDEEP 12288:nMZ8pU3foZ8fNMBCp6AtXTZPffEF4oAAQPYR5:MZMUPoZtG6AtxsCoXQPY
TLSH
T1202527107666C75BCAAD40321E77D1CCABB07D41EE459B0372CC4B2FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 543KB
SHA256 b4b0413115f4da8d4631ba3ce280755b2c2190d23cad59e8beb766bc0658951d
MD5 9705298b71786e43b1bee40d5bfecc75
SHA1 e654cb16844c07409b271c56c11604550b8c652b
SHA512 2a0322fbfbb90521b8a135d47f7c1f51bf2183373ec272365ef98ef661c844ce77c767e67db756300d2f9ec6808a52c5d672c737198a79b43f497bd12b730f74
SSDEEP 3072:JWcaU5O8YMRl9XflFKqFUK81A1VD1oRnGkur6zd/pHP9f6gTsX8U:JWcaV8YMv9dFhUK8enDaRdOMhHVCgwXl
TLSH
T12EC4F941A637A34FC0BAA17242365B8DB774A803BB45AF5633C8483DD86376971B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 89c02a4183449282390b5a2c6b7cc1c2bb78b4a9a4438b137ae30de63e8800f7
MD5 0159b0b6d0a580d4efa56b63913343c2
SHA1 027e414b5523d44e755e6465e93d7b2c785faecd
SHA512 363946676ee6f2bd1869cc79141f276cbff061743fab39e90b64829993e3b8dbd829de5917e94000e21fb712398477b95617f4a591f53f5d98c46162f2e7d8ef
SSDEEP 12288:IM7c34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:JnSnnrFb4PM4MYgLxEVyGLn
TLSH
T1024523722BDC14DEDE7D16B081AA5698B2097C21FF61F18BB7407446363B68C9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4eeeb4746658f4db935008655bb4d7c1fb1b1bb87484c7605c3e3b418390119e
MD5 fcd94a54cb0ecbba3936e5e9876f8f61
SHA1 26fc7cf213f8e60a9485d73b4c77f4bd7af04030
SHA512 af0bfc5527e020ccfc5bfcab3804aed300abf99990626bda222c8dd99fb3bfa50e7c3e94e8bd7da9f57276ea6e9cd25d0572fe9422ed7877496219f58f789101
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYZSnnrFb4PM4MYgLxEVyGLM:Jgb4mBIBhGFzj4MYPVyGLM
TLSH
T12C65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 09dbfe354bcdf06a6edaa53cc0b4900669057a2c886bc5069a0a109b29cb3fdd
MD5 37a2224146d7d5ead9a6af6329036f35
SHA1 caec98f3ec10c097bb36e4883268f4d8261f99ec
SHA512 f04b1c123928c1ecaffb957b8bf76a213745ea78430098c20217fbea9286440e236b18e4c1b213108e2d1fa306c58b532847625b447148aafa94e2d7cb643268
SSDEEP 24576:HG88u8FpJqH1bzria7/mwSnnrFb4PM4MYgLxEVyGLz:m7ZFPqVea7/Kj4MYPVyGLz
TLSH
T14385F16577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8e07356afed021290d701f9008859a6a87c3798d5b9efd5436d1b9083a8d25fa
MD5 725d0016a47dfe430165f9ebf2fc2827
SHA1 7d96ac5ab816651635c872065ea0e074f8d28d86
SHA512 914584d090e521d5ef873417df0c7ba7a693e2b852a5ded31c8eb977146d7c7b82e661a1c2df5d73fda0d4ce64b411334b07c7341b4ead15489f13ea394cf1d3
SSDEEP 12288:WHvUrBFrEjwaQz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:WPUr+NQMSnnrFb4PM4MYgLxEVyGLx
TLSH
T1A765E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fb517ebbd0a27169f8b23fc65bf6a7a5448aa656c6a87fdcef63e2694b7e46aa
MD5 842a431f5d06957deac43147b15cb257
SHA1 c69df79a0bcbbb7080a091e9df071d273c6b1b11
SHA512 975c3af921ae6e0a34493562bd1d7aeccc7952a68375def25bbfe2fd110b576007c9118baa9a9356c63e091d6475a26a5e4c059900f4470dd73549254032fe32
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPj4MYPVyGL9:AG05lO43bxVp
TLSH
T1A1D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ec6645e3cfeed8917e1037de1b7c206dec4564fa70165531ec951c56ae1d747e
MD5 42c8375e64c259982f9837e909eb6273
SHA1 013c1361d55cfce545c44e7c587371847f59ea79
SHA512 9a6de6aed4dcee67b128d2566014072d0c1dfc78d86044d077ec845b79dc33f204644e2c9d28e5d2b1b07e703b2c37aaa3269323c4005107c8222fb33e743b6f
SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnGSnnrFb4PM4MYgLxEVyGLe:na5POZ3+Jt2pasx2+m3j4MYPVyGLe
TLSH
T15565AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2caf0beb876405dde61a40169e11d58a98eefea904d955376aea121377d186e4
MD5 737732b76f6347fb42b53f0c08ee83b7
SHA1 d3421c0a90a746bf71009fed62b17603e121cdd1
SHA512 27789e2ee59a864e63eca1a4b7db9f43d71d01f17f853c194077ca8f23f2323bd6eaf8e05180e0501c4e22eac3ce39f16c64a3bb5e26d8961395258b8b215df0
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkYSnnrFb4PM4MYgLxEVyGL0:UNc/zEOVHFqj4MYPVyGL0
TLSH
T139858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6d273c293c6cd517ffeb42f45bd91cab5271aded0d429030fec4cbe9d6706fd8
MD5 d8b62bdc345189cde571e44d4e04ebf7
SHA1 e4f0d1fa544e7e4551e6badbed5f0aa7dca319e1
SHA512 66128e03fb2d2a53e53be12ca49c7bc2baacea0628923b807ce852d2a2137f602dab8cd103aea34c4c46b2d1852e55deae201ee9eeb0ad5940b286d6dea1da8a
SSDEEP 24576:C8kNvNnaFeYhJNtmZBmKSnnrFb4PM4MYgLxEVyGLX:C8MwBtOmFj4MYPVyGLX
TLSH
T1F5559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f51cd5f5897d5c90c2f9fa28c1fb65ab10479bb8109fadbe65d70fff8f06b531
MD5 b82f250c09fa5bc5bc34d46c0aa62c26
SHA1 e7211c0e90b8cd57edba186c7b9426f7edbc7cbc
SHA512 a5e2fae0f97a7919e4341055c2d94ea7d963e85d69abdb861c11c005931ad084615400f439eff464dc30fbfaa2824835900aada05e4c2e9892951e10385fda61
SSDEEP 24576:YD3FHshBIYQgA7SnnrFb4PM4MYgLxEVyGLR:YDVHeBIAAEj4MYPVyGLR
TLSH
T16A75E17EE69C04E4D57BD1BCC6638A06E77138A9033266CB12D491BA1F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-594-0x0000000004590000-0x00000000045D2000-memory.dmp

Download

memory/812-420-0x000002CC801E0000-0x000002CC802E0000-memory.dmp

Download

memory/812-429-0x000002CC81D50000-0x000002CC81E50000-memory.dmp

Download

memory/812-419-0x000002CC801E0000-0x000002CC802E0000-memory.dmp

Download

memory/812-428-0x000002CC81930000-0x000002CC81950000-memory.dmp

Download

memory/812-421-0x000002CC801E0000-0x000002CC802E0000-memory.dmp

Download

memory/812-463-0x000002CC942F0000-0x000002CC94310000-memory.dmp

Download

memory/812-453-0x000002CC81B70000-0x000002CC81B90000-memory.dmp

Download

memory/1056-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1056-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1056-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1056-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1856-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1856-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1856-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1856-50-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1856-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2392-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2392-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2392-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2392-397-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2392-399-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2428-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-366-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2428-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2448-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2448-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2448-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2448-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2448-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3148-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3148-378-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3148-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3148-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4108-293-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4108-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4108-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4108-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4176-133-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4176-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4176-135-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4176-127-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4176-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4472-87-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/4472-0-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/4472-9-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/4472-1-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/4472-311-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/4472-314-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/4672-308-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4672-67-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4672-73-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4672-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5400-101-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5400-377-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5400-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5400-107-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5400-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5400-372-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6084-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6084-83-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/6084-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6084-78-0x0000000000850000-0x00000000008B7000-memory.dmp

Download