2f971a6b78d88d10d7f7352554f7cbc15409575c817b70112148dd031d691ad4

Analysis

max time kernel
121s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.4MB
Sample260709-cftbfscw5y
SHA256 2f971a6b78d88d10d7f7352554f7cbc15409575c817b70112148dd031d691ad4
MD5 9b680ef3f15770c73c4f665a341e4294
SHA1 5c2dd8a37c3d7f6764ede31d70870c3668e8d7ca
SHA512 32e6eddf9456e8f892161c6b08b559deac6d6cda9b6d3e72e66fe85b5a9e8ddb81cfad90f303c5f15be46fcbe63f893da498332d3139997a0829cd68b9da2bf6
SSDEEP 12288:Ikn9Lp/1qEqHVRzPo5Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r4:J9Lp/1DqbMSnnrFb4PM4MYgLxEVyGLW
TLSH
T19665F15533E908F9EDF7663489719645EB32BC529B34E66F0390811A1F37A80DD3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
3956	elevation_service.exe
2000	elevation_service.exe
4768	maintenanceservice.exe
4732	OSE.EXE
5012	PerceptionSimulationService.exe
5776	perfhost.exe
6084	ReFsDedupSvc.exe
1532	SensorDataService.exe
832	ssh-agent.exe
2872	AgentService.exe
3572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2ed7e6d02718719d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114953\javaw.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb9377ef460fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000791c7ef460fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008694aaf1460fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094d620f0460fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3aef4ee460fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{497DCA0A-762E-46EA-BC36-F5CBA851629A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{A93E1F7B-2B2C-4256-AF79-F2BEB81A44A7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
4564	explorer.exe
4564	explorer.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe
2000	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2376	2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2872	AgentService.exe
Token: 33	3572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3572	SearchIndexer.exe
Token: SeDebugPrivilege	3956	elevation_service.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeShutdownPrivilege	4564	explorer.exe
Token: SeCreatePagefilePrivilege	4564	explorer.exe
Token: SeDebugPrivilege	2000	elevation_service.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5952	sihost.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5224	StartMenuExperienceHost.exe
1136	SearchHost.exe
4564	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 2928	3572	SearchIndexer.exe	100
PID 3572 wrote to memory of 3448	3572	SearchIndexer.exe	101
PID 3572 wrote to memory of 2576	3572	SearchIndexer.exe	102
PID 3572 wrote to memory of 5180	3572	SearchIndexer.exe	103
PID 5952 wrote to memory of 4564	5952	sihost.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5776

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 3064 1888 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 3028 3016 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 3028 3016 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 3064 1888 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4828

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4564

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1136

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a14a5431b2b8daefde9b2a6587e2aa7e28aa88cb85a893800b58a5d78f69eb92
MD5 6ebdcb17c91f53a5ad4f2490cf76ef4f
SHA1 017d17cc0c051b58cad0894b898138a47de160bc
SHA512 e16c96f3a7afa27d834f36ff085b5e51155b8bbf3977882c520a75e6e35d5c5773605d379354677adffea1f5df4085fa73a7f39e6f785cc9e81ddca272431541
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkj4MYPVyGLB:d3q6HjBmVd
TLSH
T1EAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e5ac33bd15b671019f273c77f4a70068a07de438db9b34c6c79abc011a4f803e
MD5 faafcf1f67d33fcc289447a384099220
SHA1 8a6aa576d828ae07994a6a6837da8f6433f26c1b
SHA512 4b0af60fb32aceae03f2ecb9db0d5ae5427ac2e341fe643f0d9056bb96164887c62f95209f91fbedd9084d240df803535d9d2bcfb0dc378108745bf39f72125b
SSDEEP 12288:w1XLsswWkxy2lRq2czAJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9V:mXYfDtczAOSnnrFb4PM4MYgLxEVyGLP
TLSH
T17C65F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3829890e792ce58b12a7299bdf53e98c0795d0d82a933fe9ef43a0853736ae28
MD5 1d0da00857ba506e44eb933a577b94e8
SHA1 377d4034bf633ce135c1b9dda5ae91cf7f8898fc
SHA512 27b81506e345f940df4035569d1bd3ab20341749946f9cf2cebf56af228760128dec417b223a1292f2c1bd7a1ee3d7257fb52c0068321ab75696a8fc711da090
SSDEEP 24576:/0Le5ji0hmxirMjSnnrFb4PM4MYgLxEVyGL3:/Pji0AcHj4MYPVyGL3
TLSH
T19C859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5298ae0c20a733c275cd6e70cc34bda108eed5a17530e3c2cc9e45cda596df91
MD5 0d984fa69287ad50595d53fc24d50a44
SHA1 8438d683de38b67d783d936fde079e8f748a9630
SHA512 153451414f02a2561ceae12543b2bbf8d1bf396dc8767e88134d0a4c5f27b3456071bb8cb82616d06318f0ed7b0ad47e8d4fc7db4df6fe2aa7a7716adb9ba14d
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyutSnnrFb4PM4MYgLxEVyGLe:4/ezSC6vUzPvxHjyzj4MYPVyGLe
TLSH
T1FA755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b3626a2c318cd69598ce3e44be9068eb4dd75479cbc219bcf369f4d0bdd3b423
MD5 3dbcadaa3014b95252a66c8fd3a1275e
SHA1 e1aae008057bd3ea10e5014736c48510e9442b1e
SHA512 c12de1aadb5f893a8b46d16dbef08e12cd2f2b579fc163f51d2ec9bdf4c3ee64626021d9ca7780a19cb2819a5be5e16ac7b55bd5ec8f35859ccab4b8c3462eb7
SSDEEP 24576:OVbqPb88hv/l+6ySnnrFb4PM4MYgLxEVyGLq:OVO88hXl+oj4MYPVyGLq
TLSH
T17A559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 eaff91d40f98d88b94e758149926de1a5f5e7107ef0498e09908fbffb52336f2
MD5 9a7947fd12b11b31e55c3d171f0a5ee6
SHA1 40e07a9b1e79d249f50296d8aced7bee1ce14458
SHA512 54ffb59b6ff182189179b7659b80dbca214edf55aa3ebc99105338729377d0ee5a9a5ac37fe12c035cb6bafefea391ba6790e5ed322d813e8931cebbcb42e5da
SSDEEP 12288:3Rc34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:3RnSnnrFb4PM4MYgLxEVyGL/
TLSH
T1D14523A66BDC10EACFAE15B0D1F96AC8E215BC61F875B20B6750785B363F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c5a5c62096da199ae639c1114231167faeb6f09bb687ec71d629b31cf3f00879
MD5 7ab710623eb7af6cf07978c3ccb8c2cf
SHA1 aa7bc51fd5a5a7bcec3820dd892b0b86ef180b5a
SHA512 6c108d13075473f7d14a189dae7168e3a5569c8d4d86e3476f08e62219c5542e09c53cffb0a0c867b25be275dff74046f97ad5f8ca02379a53f135d783922a38
SSDEEP 12288:aeBNUbTVO86Ud34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:aJIUaSnnrFb4PM4MYgLxEVyGLO
TLSH
T1AC65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 611f72f22ba96a6cd84baae70e3f4b2f102c627254e006f8603e2b46f9cd3feb
MD5 d768e1b4ee74900448cd4dc3779ac054
SHA1 440f6c3cef132e106a020d618b1490e1e005217b
SHA512 b66a5801b831c5ea501d454879b72ed0071107df40a3a014d3c488530c3c497193910df773337601896a4a86ce670e181490436728ed661cc9f3f209b83970e3
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:DQvGAdlCEL8c/yRNw5CnVk
TLSH
T1F6267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5ed985201f66995d04b6f22b19b6a4c36fa7d1b7b19363ebb779582383731911
MD5 6ddf0a9111447cd217808037817bb8d0
SHA1 dfebdf2208343d1c7bf82c43dbace0da35f43fb9
SHA512 ea011582875e1c4009ae0e93a65d1e3aea5ca5e2ac2d0da10b4e11d2a19a003791cba0dc7bce039ebe7ee8cb169ddd1528cc3766415fa182f1569db3bb4ed662
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAjr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAK:BdewsAjkSnnrFb4PM4MYgLxEVyGLx
TLSH
T14875E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 93fa6441a3b44473ce5034cc31ec6d564b2f4129b8ee62dca14532910eae06cf
MD5 ce38e11d5b8a3647c218fb31a06872cb
SHA1 aa6f7778b2672166e2e7cb393abc26d481d5ea4c
SHA512 8d2aa920f9d46aa7d3187ed566a5deaedf155af07a31f2f5cbb97f12b342d10bc7850000ab176d09115e46518fbeaf4a3c61e60551970f1a40e8f525dd9f9233
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:VUEtQevvqc2W1cpV2EI32
TLSH
T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f9de6cb10cf19ef97705414ac1f7fb91ed4786183692ede6bdca30481733d44
MD5 f19aa4e8236a6004e8b4ac8fb435f5bf
SHA1 1b5d9539e4039f2876c56138fbfde18c55f6819d
SHA512 765feadd93fe51678395080d93957848a20c758f1174f26d4ed48c8c60f4a277ca3b2e3a12ccc166e81782bcf4552525530254bc39df7dbe1fbae1c3f95cf95a
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/z3j4MYPVyGLH:0oqtVjnmzVr
TLSH
T15CD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f8c3de590072fa0403ffef54839c913dfb797442ec61169a628a650f1b85560f
MD5 8451f6ff8f54b753aef970e8114df67e
SHA1 369bf69c8c3376be63cbea3767df32949f7b9573
SHA512 16a2938db9b267c0861e9ed82df73dab6effc2a99f7300fb373aa076a3b37f3ca243566956d1cf582b20827e5c6169b1419c1e07b13c833927de678057f78c77
SSDEEP 24576:QAhGLJIFoiwtA5l7S53pSnnrFb4PM4MYgLxEVyGLO:QAMyFoiq5Sj4MYPVyGLO
TLSH
T16635AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 df4c8f8ab21cff6ccbb119b4a90d40cbf5bc5531abd2bd6d6bedc78fd0202231
MD5 2b093a59bf3c6eede402609f15d0be7d
SHA1 6f92fde9238e54cd8c0ad961de3648798f195d06
SHA512 e419eda4994c1e98f35fa4d65c7bf3be8d6995aa81bd39de6b6cc46e4b9c5cf238ed0ceacf521077237ef752bda444b433e484d21d0c97c47d2903099427f5f6
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqS:5wuoOWASnnrFb4PM4MYgLxEVyGLI
TLSH
T19065F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a4a472f2bbca7e8989086a009342aacde18d710f39e62dacd0f9f3f62c574602
MD5 7d1b2e7396a1b400eb983df0e1908181
SHA1 4cf6443c94cf6bcfbd655c72362cfe6186db315b
SHA512 5103b05b556a88e0b8468831ba1de48d752f3b69ab0e4bedb7aeeb39d7373b3b7242129ec9c48fddb36f68bb5c94bfd9a741c3c10a019f17bcc2097607df8515
SSDEEP 12288:yBZ1Iy734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:cZurSnnrFb4PM4MYgLxEVyGLQ
TLSH
T1585512AA37E820FACAA74274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d18417189736c5c54569d2db139113c013494844b174b4c8b8655a411a760e9f
MD5 8f6010d96275e792efa5d883e475d2b3
SHA1 c8280280ab4aa097972891296026cab2c1ba095f
SHA512 699e7d9ad6080065f400ec05815308f6d467d365a039ec7b7d75ff99be04477df91a54474cb8efcef59b14557928f11ca2708489d660a7a44942f1ad2e814005
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:8QRQyi36YOcPQLvw2gAf+PN3KVT
TLSH
T1EB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fc9292684b0cb1c1a61712722d5b5bfb0f811220010e7e61821f0865869ebf75
MD5 9ac620a32d9656279c09c68b21e87c85
SHA1 9841dc520f099b45aa5c2b85f1d1ed50a7ff44de
SHA512 32512bb04839391c279b472ab039498904841d7208736a4ebeb5e78c99e3891ab03259515816507ed56badb17fa4f4960600ceb2a5bedea8923d5b92eea0b0df
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:4QRQyi36YOcPQLvw2gAf+PN3KVf
TLSH
T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 282f13b9d68023a848573bbe9b5941c97fa854ff2f7bfae81713dcbeb2ccf02d
MD5 c9075c1a68ea87f62cd1817a564fb17a
SHA1 3c6236ef01a11e697ecba98058d9b40131f73fc9
SHA512 33d8ce287fef53bf3d1b60736f758deb11b9af290ca8175cec696aabbec40bce423e553a7fefca09b0003e896d1c0bb436ee38b9f3e0a347facc716cf05534e7
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0bSnnrFb4PM4MYgE:j68Qg55nhheWu7PNU3/Hj4MYPVyGLX
TLSH
T1DEB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1f3b2523eaf6a42f50dfa0741fe4fe06de1b39ecc910e6320d963e708d0137f8
MD5 f6a76ffd57e499c67d7e21a5208e00e4
SHA1 b1d03567cf5e95311f821da802b859728acb7013
SHA512 24684bfda55292b0b79eba4b2e132d50b73a908d56ed46956de6db34516c6fea6a4bf338468fac53c0914ee950b4659a397f716b1321968a97e404e918d35aab
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:Hy5112gYy5azzVvL69nLKnhZ9VK
TLSH
T14B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ea17332c113335af41b5fa714e83646801de369bb11aed114ae921cbadfc62f9
MD5 1a84341bcccc579907f2d6c145d7c1c1
SHA1 aa4b35e0ba1fbe2cdc49a44bb9c001bd5c9f3450
SHA512 6152e4cbbaf4e8acb011fa02e78f86ba8fbbb6fa938130496d758639de42008961fdbe25309d63882b9c47af49db9ee0498439ab8a9478af43ba1aaf666d9888
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZj4MYPVyGLe:pu6JmVxd2dCVi
TLSH
T1EAD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0e7ac07c12784c2a1e7a3eef5ab62d65320e345c50d394e1009de307e78560ef
MD5 dc64d1c8b95488c203a1906fb862fc16
SHA1 d56c140717afecbbf2cfe307e138e67b94bc7be1
SHA512 0f78d017e68787a9e1865c82680aa119e04b178a85ab2bdc3ae35b8450f2382127333736a84195c8b04b76d315afd0437a1fb36cc8f1a5b8f5bc0252505e8978
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4x1j4MYPVyGL1:dmifPbRzVJ
TLSH
T100B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 27b4e952ede697c88a8baeadf326fc9368c5d27b3132e44ed401cc15ef1d5193
MD5 153a20d95c27467fbb5dce40608cd73f
SHA1 e01d267a4fff58e32a393448b97cb0570bbcc7d0
SHA512 ee59e4252fca0819298f406d99897a8e46d6dd3de2144c84418ccd165454b983e7f51d82915874380dfc5b38fd5546b17c005b071252b7d4fe4afad2aa0d2c38
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHq0j4MYPVyGLz:95dKTi61RVH
TLSH
T1A2C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ca309f24311065165d375938d4126b63d4f47123648e7ba980890477d83df62c
MD5 0722e3f9259a5c69ac7fe436b6bc9c9f
SHA1 1d8f49fc259c41aef48687ad3a296717557fade6
SHA512 968dfd04d26fe16177ef58255e12d6ac6d0ec38c8f53382213e1109a928a1110302e0420aeb65976852189a3b80b5f8382e9d9f0f2381d839e0399fa40a4095d
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wpj4MYPVyGLv:TX2iyphPVj
TLSH
T1AF95BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 47a2c404ce53d1f75790e3bb1587b2b22cb623c8a902e3f101898ec90b4528a1
MD5 4f2f642d8dc55e355be31e988b882d86
SHA1 52023b3a99415098ff4230f08a0804de73ce76c4
SHA512 d01f8de21d6df47039b0bed394326eb019f9b9579f727f25dfff8f97abd5a505ddb7a5f14591aa543782f88e1fd0ba7f91c22a18e889099fae6f7d14c154d8b0
SSDEEP 12288:kE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:kPSnnrFb4PM4MYgLxEVyGL1
TLSH
T1DC4523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4574173B3B20D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b8f8daeb4458b4aa87249ab088c1eabbc3799a4cee6c288d7ecabd2d6b519858
MD5 41bfdc9adcf4940810d5a49ebb6a3cf5
SHA1 a86873118db8e7ffc3ab643a2b0dbf756fec47f0
SHA512 7f3aabb6edf296ac155bf6f3f0b80fb503704a466ced15fc76eaf4d42392858cca80dd9243f1699d704bc76efad58f73b6d7ee66f8b6112fc40ea506b35c6ff0
SSDEEP 12288:4X34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:4YSnnrFb4PM4MYgLxEVyGLa
TLSH
T1C14523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4474173B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4564cfa10760de34e9b595570d53bfb3fad699f96e89d3ad28f3ec017aed9637
MD5 203291adf2473389b6098206f818096f
SHA1 89a3a06224bc3512a2bd1b3bbe8da957d1b0b9d4
SHA512 f174a98a58d45a9da3338392dcedfd0d9b47d7d20ef2abe8c531d555b037e90a9b8f99c9f8e868f296a8055effac95b14a7fd00d3a2dcb990b91c871443f4948
SSDEEP 12288:Dl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:DiSnnrFb4PM4MYgLxEVyGLa
TLSH
T1F84523A62EDC10EECF5D16F0C1AA56C8E2057C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 91ac750fd797b23e5ab91468ccd0968e02bc097054f2bacf60d812b92664c4bc
MD5 be86db14e003ab897a09429133990335
SHA1 43cedf5105e1a50e20fceb165a77e39409e7ffd4
SHA512 434bdce853cd97c170579c0ead496c5ea2979d532df190fd03f211243199e25b27c65e7a4e08074c29ef2682dd6585568af337ce2582988ce3c2cf75019bea60
SSDEEP 12288:yVa34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:ASnnrFb4PM4MYgLxEVyGLl
TLSH
T1304523662BDD10EACE6A96B0C1B556C8E225BC62FA72B35F6740341B3F373486C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4a00685bce41f1f8f25692aa37746572278011ddb7861ed1b57d8252ba5aa4b4
MD5 ae83476b647195e84c06105c5e6190e6
SHA1 0b0ce25c995879e4fcfe6ef41249a7cdf43ff617
SHA512 c8e67782ad78f52b225aab3a433ace0f6d6093d5a0c86c3bdbbcaee4c08de3159006086f350574eb65eecef7ad30de079e9bce6d383b912ace1d55f5adb9d5fd
SSDEEP 12288:8S34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:8hSnnrFb4PM4MYgLxEVyGLn
TLSH
T1ED4523A62EDC10EECF5D16F0C1AA56C8E2097C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 32872e07493d97a29c76b6a9f6134fbc2a124cd3b740a8761dd5abef98838209
MD5 3dc62609f2a8275fcb70d9b5a05d5d26
SHA1 3e7117638e0c8dd966825723de64e37ba41fb42b
SHA512 2ee9c6bd75afe609b01e6cf139f430b57ce9f49c445e174b8c59cf50523d0e57b53b89b6f83683b3de88d26ec67cfe17532a18fd2ac48bb6b30e1a601d79afb1
SSDEEP 12288:fz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:fMSnnrFb4PM4MYgLxEVyGLn
TLSH
T1944523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1112295910440eab48d8cd97a508b2f815748276ece525dfdd7568b02c07ef86
MD5 785ebfbca836e3152fdefc286b298e73
SHA1 c7054362e3e3adb6d5eb38863b569ee74b40c4ba
SHA512 ad0c8938a535399298112a33a0020e4ae378cf4a3c4c7d88cecfd0f513cc144fa3a690416948dccd218b806495620990e45bdd4ecd2813986c75bb6a36cad6c9
SSDEEP 12288:av34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:awSnnrFb4PM4MYgLxEVyGLB
TLSH
T1574523A62EDD10EECF6D06F0C1A966C8E2097C63F976B20F7B457417373B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c56079efd26e72e6c42f5124364ca7501261bc15b2087862e566d1884b0673d9
MD5 93287461360923d871fe810951555995
SHA1 4c5bede816b12fd76f42a24088cc65eb3910ffeb
SHA512 a25e1ba33809dd4d20396933904877cfc4eb707d29653f88468ac125dfaa2dd5aaeacbfc79c0952a93477d1979b32725b5bd4e33c1541ebdd87d0b3d6be1b80f
SSDEEP 12288:giZwb6zzFEoS2cPvy334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2K:jZMSzFVSO4SnnrFb4PM4MYgLxEVyGLf
TLSH
T1A56502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d094374f270e33fa8179db70732c6e7d2a573396ed86a44953d1381d208c1a0d
MD5 fbba6c450fa37710cfe4f44b92121b71
SHA1 5c70b2b47e2045d426774e7ee80749b69cc7b171
SHA512 4c615a0f4677950a9dcf98071ee817d97b3aa438b7c91186ac1e5a213681ed1777b8b4da41de6ecf85ee0230544becb122747aefa188a5eb133fb84396afe434
SSDEEP 12288:Oo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:O7SnnrFb4PM4MYgLxEVyGLm
TLSH
T1D64523A63EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f9a15eb273b42db5c54888064ae2bbd9a68af1ffae296aa775424c6a4325af52
MD5 fd92e4c3e9be3bee15102907a8f732ea
SHA1 b5bf7b53146bf8b49dc5428a89dd2e6f0a336c73
SHA512 eaa612a0492523ef633b875ad32653e7db0964344eb0fb3f84837cde0e818d5d98d458c90ad17dbbc7b8ad15528283dbc84e43f492cd81cf6eb73c7cfdaae3b7
SSDEEP 12288:Fs34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:F3SnnrFb4PM4MYgLxEVyGLm
TLSH
T1AE4523A63EDC10EECF5D16B0C1A966C8E2097C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 81ea1a7d63b81a38b615084086a7898a3bda297b5144cbdf15261a40b9ce7083
MD5 79c510863e50fe6ded7c5611b17f01dd
SHA1 3ea397abe409d0547d1e62ce91f16a756cdf5835
SHA512 a8611d2c80de594541eda836f407495d75bfecfc9b5b82e746965de4e4eaa42ff79e06628d71bf2ee60e577b31647b003d4d82eb357b36ff5586222d29aec16d
SSDEEP 12288:4yPz5L8734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:Zzy0SnnrFb4PM4MYgLxEVyGLb
TLSH
T11455025737E530F9C67A8274C4A21A45F332B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c25a2002739bd3b307447ddfbc700075e4684c1a17364b759e71d8e1e82d332f
MD5 90ff70245fdcbd225a11565e547a9a95
SHA1 151237bd483423d335898e3e3aa21afdd62217b5
SHA512 4833a5b3c245c128b15425a12e84b143f3f7b3d341b29e4aafbb7296dd49875a28aa7d3f7bbc51668f6afab31549e6487ad8918876e08295190c93b844752260
SSDEEP 12288:4o34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:47SnnrFb4PM4MYgLxEVyGL5
TLSH
T1214523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c7967b119918f8472e72fb95d871b0d1a6f70dd94ae487d1aba5b59820e96a19
MD5 1dfebd0fd38a09d886d389f42df27ce9
SHA1 e660fdb01c6529999ae085afa29ecb10fc172949
SHA512 60906df2cea7bea80d46a3b1e16257df09883afec7a3b463f68dd56ba60f6a71e0743adcc30f580251705d06ecc7411a051ae2573c148c1cbe4d2f4d61c15091
SSDEEP 12288:zo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilw:z7SnnrFb4PM4MYgLxEVyGLq
TLSH
T1EF4523A63EDC10EECF6D06F0C1A956C8E2097C63F976B20F7B4574163B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e82941fd0236b1ada795915d188b3d632177135d26937b8c6984ffead70caa2c
MD5 5a2f0fd5a6e41be8938e33a8ff6ef0cc
SHA1 dba78c82e0978eba6e2fa4abb78dc56d9736cda3
SHA512 b29d970ceaa59ee42e0e12a2f203a61fef62e7d9daef6bac6dbb15cba2055dbc6c1436058174846034fcf3160e57a9c870e967e6ee22ac9fde1348ed58fc5a57
SSDEEP 12288:myPz5L8734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:bzy0SnnrFb4PM4MYgLxEVyGLg
TLSH
T19555025737E530F9C67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6dc71939dde74ed0370c2b6f91b668e9be6c51d57ec12c20bceda4c887d7c54c
MD5 ce91618d7c0a5d68c5136ad257588e0e
SHA1 9257b3ae97b4e5bc760f87239c86be75da9e2d28
SHA512 3b3222c2049f545ea3693620e71f64ed82ccc923c61c076e739efddaeeda1bc84f4e1869ae49d34be64e3151cab9209a295ba0a89c207369663a468bff495e9f
SSDEEP 24576:vTHaLl3z0zDSSnnrFb4PM4MYgLxEVyGL4:vT6LljGj4MYPVyGL4
TLSH
T1DD6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c7c3f5e00a17314848b896dc1d12d266680f15629fe41043fd66cc60322f5960
MD5 012fa7484564fbd838f72980f6868484
SHA1 320eb197dc3ec9549cbd179ba224fd85a1de2799
SHA512 bf679a996cdb978340f1c104b05a382eef78455e83f54ad37f14e9860753ae571cb426b7b95a2e0c2aea6463ae99d1a934ee5838136c0096127994fb990b8fb9
SSDEEP 24576:637d9CHKy7GZ2SnnrFb4PM4MYgLxEVyGLU:c7d9CHKyaPj4MYPVyGLU
TLSH
T18775DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0fbc5524b911d8d29bb4a91cc6f562e9eda0260e23d5302332a775359924e788
MD5 8c21676e764d472d09a1a38c96e4e31b
SHA1 5288e0067d566e4af72accb2bdf0c55a1c1f4c8d
SHA512 dc0a183322888aa7330145b8fdbad59cd4574d4fe8294bbd0fc17b4701d29cef0d44f7df22b1f6e7f9c7ba5d4a62a1f7135d5966e591962360aea59118dd9485
SSDEEP 12288:cF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:cCSnnrFb4PM4MYgLxEVyGL4
TLSH
T1954523A62EDC10EECF5D16F0C1A966C8E2057C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cf2b9448031b126a32097bc85fd0edecdc19400c05622db734b34d4040c98e5b
MD5 c3d5d0bd72eb4b05db0b034f47c22c3e
SHA1 62377b9bbd11cda39b216a9be9ccde6a7afb56cd
SHA512 8abb66d44c09eee18c570fa21b859afa60a8f3a17947c083d54677ecad5cdb0ac9db797cd7bae838f113940c159d19b999c0840c44699a1e48da9a7eec0d5317
SSDEEP 12288:vb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:vUSnnrFb4PM4MYgLxEVyGL2
TLSH
T13D4523A62EDC10EECF6D16F0C1A957C8E2097C62F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c9ee1e8fb77dccbe5cb42b2e7846be5985e960adf53eb833b3ed24c3f157f0f5
MD5 4986e96a960a370fed18e39fa170e5e8
SHA1 65cb6744876fb51e2aaa805982cc215d5511d54a
SHA512 9f68131ab222efa942c08276b1395d93d563d87daf2faaa05a5b5d566e7f79c957539d617115ada33707b07b6b6e10a3b5fb7458c70973aaf77b48b354e2195c
SSDEEP 12288:du34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:dlSnnrFb4PM4MYgLxEVyGL6
TLSH
T1964523A63EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 240c47ae29c0e2c8f919bce58993d3a7cd9f150378f0e10ceb9c93f1a3236635
MD5 d892849ad9ba58e099311d60a426039a
SHA1 242a243e57e3b5f27cf63de6355636fe89c21eee
SHA512 e21e330f6e6f029adfd0526ef232994cc4f8e6bd728234f7fb95fe3e1d49ad4cc64f5bf6ea53b981869c4bc70078a79435c85ac5a8992db6dbf4c21da97284e1
SSDEEP 12288:6o34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:67SnnrFb4PM4MYgLxEVyGLU
TLSH
T15A4523A63EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 718dae3a9a81114347fce6e8c458e4397b733bd78e359ee7dff9c1349cc91ed6
MD5 2e99b6a76d02d35a865ea925026e2571
SHA1 b7ad8c8c20916acfb6d999bf0f6d481a0619bbc6
SHA512 bd94b1749e4000d36dca25ada7fb7da8cdb7aeb16935107693fbe97532edf8c8033c4a54fadd81b5f63255fb1df8149c74acebc661e26477f302065d1d3084ae
SSDEEP 12288:zF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:zCSnnrFb4PM4MYgLxEVyGLY
TLSH
T1A24523A62EDC10EECF5D16F0C1A956C8E2097C63F976B20F7B4574173B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b3f9d88d6bd8dfd88a01ad28352903d61af4b0a47e641ab35ee4ea8fb56b4454
MD5 9959527d7259a29b74b685e99f09979c
SHA1 54b0df7734019f6b57d5ab595775737e51a764df
SHA512 c49e624ae83dab3ef2a6a94a819d6acd4d9a75c736a2787c0750a927dd117be354a3cdafc0286747848150f1c188ed275d5eb8fbe7daa1f6958eb3399e1d1e7e
SSDEEP 12288:vA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:vTSnnrFb4PM4MYgLxEVyGLU
TLSH
T11B4523A62EDC10EECF5D56F0C1A956C8E6097C63F976B20F7B4574073B3B20D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3f58a791b9f44757189d61a82a5194e3f8196120b6d89a0b1235360f1b6169f2
MD5 c56cd198af601c264b689469024c87bb
SHA1 eded8765c5553a26b88bc80f4e1bfa0b7642be87
SHA512 27af9a9f07e6fa2220edf86ff412029e660d4f9d2f6fe8fabdbf5aaa741f354eaeaa2cfdc91518d7d6ee25b780ef739330bfabaccafb3dec2ef8b57bb4aa737a
SSDEEP 12288:oS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/:ohSnnrFb4PM4MYgLxEVyGL9
TLSH
T1A64523A62EDC10EECF5D16F0C1AA56C8E2097C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 1063750e5c0e4710710bc934331202ef620994bd949fcebeb96169973ce1e59d
MD5 dfdad8978a497e7cd7b3b73d207b5eea
SHA1 df47659bd39c245f7d351df73a1feeb1cbbffe3d
SHA512 24851eefe4b70d3f8733d0fc4c40485f2d4a7e4564c618ac7744f517793fb9603d020c1c9b546bac5160fa6f22324a003a25ad5ca8e400e9f7adc91095a83f05
SSDEEP 12288:Gt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:GqSnnrFb4PM4MYgLxEVyGLB
TLSH
T1FD4523A63EDC10EECF5D56F0C1A956C8E6097C62F976B20F7B4574073B3B20D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 1a3a596c33688fc927be1a03091fc9d112b7e5942e8c6ebeabfc752cf35cfc38
MD5 9488d2510a7366c1ca2c5d41c0c39e22
SHA1 0e5cf3c82993b4d77a41d1cd6a475c6445e667e5
SHA512 7c10b19ca25a284fc5e8facdc0b7d33a14edfb3737fffc1bb9f743a1441c566c795d33a0bc44c08ccbb331053e4fe708a59189636e058abe67402b8c7ee3c510
SSDEEP 12288:oS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp1:ohSnnrFb4PM4MYgLxEVyGLh
TLSH
T1D44523A63EDC10EECF5D16F0C1AA56C8E2097C63F976B20F7B4574163B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 596d4b9b41e8fc92cb9a0ab4f49d5a2bdb378cc86c3eb3f011a27fadf1d40a2b
MD5 8a823f97f4c96a9ad4290309d0af255f
SHA1 63daf059c3f92cbfebde5048f2fa465323d82f6e
SHA512 cd093fe44c16d0294c71c062cef1c14fbfc33b077cef25a0417f3344273e4d8a0b69d2f2dfb47b4f0b53beb08ee0e73e950ca134eecf565ac4cdd4bbebeedf53
SSDEEP 24576:zfwvok9RX6wkyAIHSnnrFb4PM4MYgLxEVyGL+:VMnYIAj4MYPVyGL+
TLSH
T1E785D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1dc503f90413cec20ecafdc138f8f56f9532da918489e53dd1c03d75b7ed858b
MD5 8f98e95306c6c51446367ce57e3215ea
SHA1 c0c27afe8d35cbc81c1976e8737e2d1bea15e2d7
SHA512 9ee2d92e1a3e75396f4e0b80bd3bc9cdb402428de4483c409c13440b326a76c2f27fead9c9b03787d18a2984f9cccc5c293b33c02b59c7e9e0599a808c444e1d
SSDEEP 49152:WYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jj4MYPVyGLS:IySzPqVG
TLSH
T17F066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5252f5804e5ce034694d6a7299824eb43cda48c45fdbda38767637153e4a41b3
MD5 5b16038421ac65b96e68f722b626f3b1
SHA1 17a63f5d7640a162fec697ff9b8dfb61f367104d
SHA512 0887b6df61cd4a42a446cf2b297590f8302effdfb2c38614c24aab83cbd61f408c3787667602f33c406dd6a7288f2547c9de6e5e71c9b63ba73fafb6c4035934
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYISnnrFb4PM4MYgLxEVyGLs:B47JUQj1irIhCnDHUPfF/Zj4MYPVyGLs
TLSH
T1F265BE1EA3EC01E5E1BA827885154A5AEA71742E5F31DACF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0543c1f2c2917c677328867cda3fd0ec2cb995e613d6aa5d4a7d4cfeb0a1a8fd
MD5 41ef797b27830515b78e134edad66024
SHA1 a63a4015e44905e6f994c5350f19aaf2c920e410
SHA512 0337ccbfdcc6b6a5385b52daffdf49f01c6ab468366cbfd8b083f4ee0927b1ee0e3ec914b1ae0dc009ab1debe0a3f4f20fb119e32fe49ac153347f8baa5606b5
SSDEEP 12288:INsfY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:prSnnrFb4PM4MYgLxEVyGLH
TLSH
T1D455F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 eff66b069ae974215f676b5b94c3ef644fc4fa4d85faefb60f930f0e81279a0e
MD5 820c523f602c7c5bda64d81d3cd2ab9a
SHA1 19bedf31e441609d7844acc560aac41fb85f544b
SHA512 79fbde77f693b570a74525433f0c7e8c0412f93036de2630f232b2c9cc0fbeccdba80c5ff11c9f58244a0abdcd2d0ef8247ca225f178b56e0b635d231a813ac7
SSDEEP 12288:XGoactuvd9yEEOwVlM0+7LjlvRTTigvO5:XNul9hJ6e0+73xRT2oo
TLSH
T19D4538117266C75FC6AD40725E32D1CCA7707D51EE44AB0772C88B3FC576A6CBAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 60e18e512322359a26985832866a7a4dc207924ce2fe45a9b2c4f1cd6940247f
MD5 8d278a74dc5cbded5973d301a9d2b3da
SHA1 9ae1ed3ea7b5d4b35cf060c2e78e66fb87e36f11
SHA512 6ccd73201a5eaa8284eda7e97d96984062ad8aef0ca453597a4df13c9d5e4573786b513f1e7651b77d8bd7bfe7e4a65feefe627c05053c6ae3f26751a1781937
SSDEEP 6144:N+OxTX5GUVyhzw+RGfD13lZmqKgPMC9H8BmdXTSBJdap55bt9c1kitMxUKPtMxUv:R13lZrKgk+QmdJ5bt9c1kb29JG
TLSH
T11355D740A136A28FD5F720B2032A6B4D7764EC16B749AF1677CC493AD826B15A0FD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6184828cd1360fb1767cbb089c6e7a9ca5e26aa4cbae2dae64d66a99f5df5610
MD5 66c405ae98b7701d2b4e516feea3e3d6
SHA1 e637dc6bec6da56fce077d9304ee1feccf70f16c
SHA512 85789dbcdbda80d7eff95b1df2d9f98863dc5349d03eb021ce1a85c60825c402ba97999963cf4dafbf5dbbf027e7991d984b66c7e9186850978dffa424073114
SSDEEP 12288:JM7w34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:CDSnnrFb4PM4MYgLxEVyGLy
TLSH
T1624523722BDC14EADE7D16B081A95698B209BC31FF61F18BB740744A363B6C89CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fda92dcfd8b453e30bf41348ee221ada37a8fe3a3a4b86d46caa13574628d15d
MD5 fff9383355e535bad6372e0007de6014
SHA1 5606eddef685943bad84e11f2ddffe5fe3245524
SHA512 e8b4d4f76c0311ea637deaa36aa393866f89865ed22f4a1b6c1937fe1bbc7f195a82d50a8afde6624877e7923ccde5963a2aaa30b10b19ad76e5f3a6599bcb29
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYtSnnrFb4PM4MYgLxEVyGLX:Ngb4mBIBhGFbj4MYPVyGLX
TLSH
T1FB65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 872321ea254073fe2abcc80c5c4c73d95b513ea2c47d1f55c40b864fe59f9bff
MD5 81aab85d1ffc1f4c6e31c74270fb7405
SHA1 6ffa44d0f1a8da103a36e029578b67dc29dd73f1
SHA512 b7778af70969e4d27696ea6c3f4c9bafd6f8eba78c0ce235f63dfd75986bd6c9a54dd7092d2a91959b35bae8f421a1644194d77e717ae6457603ad4365f6cfda
SSDEEP 24576:xG88u8FpJqH1bzria7/m4SnnrFb4PM4MYgLxEVyGLT:U7ZFPqVea7/ej4MYPVyGLT
TLSH
T11585016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 42859022978bad3f76b0cab8fd77d38629e9a2a1e768f2fff1420fa608f368ef
MD5 3810c0d995c2db51bd9fc539aa6d8155
SHA1 354505b43a6af79a8ac941657bdfdda08afe9a03
SHA512 a0cc7c6e64dcc84ba649d5841987571e9e9775b9b285c5ca5d410da811c0b3d067ff2721fbbe99657c82d572826b9e1cd16406e26c3b88020894b8c5e5e86c85
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/j4MYPVyGLl:rG05lO43bFVJ
TLSH
T151D5CF6A62EC11F9D1BBD17CC9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 315297ff0b85ffbe577e34e6e770cbb82d69d8e9d384897022287328d97a5076
MD5 ec0abe4d119500880218b0e323a728f4
SHA1 b92b7838e8e65cfcf219cc52724e27e01c1e3c47
SHA512 0cb80927d77ce730ca82671a898e8b9f0b6cde421df1b064e1b051d4506a8c986b2e85477ab6ea1832d87391e00473b42f80d269ca83302abcce1861e02b7b94
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuSnnrFb4PM4MYgLxEVyGL3:Ca5POZ3+Jt2pasx2+mHj4MYPVyGL3
TLSH
T1BD65AF5EA6FC00D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d36f6461d1efcae20d3e32aee7b92e72bb68e0ce586e2e7af8745cbca88853fe
MD5 d90b51bf806382d36efe90cbb8a5dc1b
SHA1 d55a2594b84cb63acc7626b8562e39efdf880383
SHA512 7fd1e832f42e025b46bf06e75ea334f083f3657f6e8b24d6dadbe0c0ad7a13d27b2dfb4801299bea775ab560c948b4e142c1cf14de24404ce9b0501efb6ba98e
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkgSnnrFb4PM4MYgLxEVyGLH:dNc/zEOVHF+j4MYPVyGLH
TLSH
T1AC858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 03ba1cd3b635832af08f770f3d1d67ecfa0de45dad29710dda3d36e208ef173d
MD5 0a1e7a96e2904cdebed586d80fde73c9
SHA1 0c177018dbf5a6ad566f8d4e46ebcc3c6905e463
SHA512 ce0dc0bb37d70971b3595e0326391d97c708284ec8cc596454157d0a87907d822b8df9cca4f9a8e46b1190025b53de4431c0482b09c26c05ae52ffcb71493647
SSDEEP 24576:78kNvNnaFeYhJNtmZBmqSnnrFb4PM4MYgLxEVyGL0:78MwBtOmlj4MYPVyGL0
TLSH
T1FE559E6EBAF806E4D1FEC6B4CD238512E6727461173292CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1e1a9806078f047d5e9a51da528cba5dd8231c7611b33f875a21ce619a99bbbf
MD5 b377aa4495d53716a91e45be15b03754
SHA1 2ef505cc5e68def892e690b713468964f58c80f2
SHA512 ea5605dfe3e6f1c3e7097fa2d4b19f52f2b02c54063bb5ad6d31feb586d95c1e5444d91a1590b420bc2f772c3329f91ad25b12a8f3c0a2325adc4469293bc916
SSDEEP 12288:hHvUrBFrEjwaQD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:hPUr+NQcSnnrFb4PM4MYgLxEVyGLt
TLSH
T1F065E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5348b974e62efc12ea2ae4e634c32dc00362f1ae8efcd2b79efedf82bcf9c2c7
MD5 b89c3e83b97cec3c389bab834fce6840
SHA1 b47d481edd977eb749c3b28341a82dfb6605d4c0
SHA512 2bd41ff338cc69866931fef7c0dc48bd0f2df58a7ed7633d5af627075a14ab9a231818b0818bb4115848c1d0a73f6002aceb6257b95e6fcf426f4fce09b8d4cc
SSDEEP 24576:ID3FHshBIYQgAvSnnrFb4PM4MYgLxEVyGLu:IDVHeBIAAIj4MYPVyGLu
TLSH
T13B75E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-368-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/832-121-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/832-115-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/832-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1136-402-0x0000029B03A50000-0x0000029B03A70000-memory.dmp

Download

memory/1136-390-0x0000029B001E0000-0x0000029B002E0000-memory.dmp

Download

memory/1136-434-0x0000029B143D0000-0x0000029B143F0000-memory.dmp

Download

memory/1136-404-0x0000029B13E70000-0x0000029B13F70000-memory.dmp

Download

memory/1136-388-0x0000029B001E0000-0x0000029B002E0000-memory.dmp

Download

memory/1136-389-0x0000029B001E0000-0x0000029B002E0000-memory.dmp

Download

memory/1136-420-0x0000029B03C90000-0x0000029B03CB0000-memory.dmp

Download

memory/1532-364-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1532-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1532-101-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1532-107-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1532-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2000-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2000-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2000-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2000-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2376-9-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2376-87-0x0000000140000000-0x0000000140212000-memory.dmp

Download

memory/2376-7-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2376-0-0x0000000140000000-0x0000000140212000-memory.dmp

Download

memory/2376-309-0x0000000140000000-0x0000000140212000-memory.dmp

Download

memory/2376-310-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2376-1-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2872-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2872-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2872-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2872-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2872-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3572-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3572-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3572-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3572-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3956-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3956-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3956-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3956-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3956-15-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4564-578-0x000000000B240000-0x000000000B4CB000-memory.dmp

Download

memory/4732-280-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4732-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4732-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4732-52-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4768-40-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4768-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4768-46-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4768-58-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4768-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5012-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5012-67-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/5012-73-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/5012-305-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5180-599-0x000001C636170000-0x000001C6363FB000-memory.dmp

Download

memory/5180-383-0x000001C636170000-0x000001C6363FB000-memory.dmp

Download

memory/5776-363-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5776-78-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/5776-83-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/5776-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6084-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6084-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6084-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6084-381-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6084-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6084-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download