3338f609c641d501d76faf41afbb758866346e31e6114f5feee54fb32078cd0a

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.4MB
Sample260709-cryqbacy3t
SHA256 3338f609c641d501d76faf41afbb758866346e31e6114f5feee54fb32078cd0a
MD5 3b360913f7e720b518262351cba96875
SHA1 95884aa4565a01e06133c1a49a1f977260762fee
SHA512 66e6e73ffb887d865d778396125f67495d0ac62bdcb329e80739db4ed3ba60149130be4af9c501e2373b0290b1def078dc323537f782c19fad4b2ea1549c16fe
SSDEEP 12288:yRo4vrWDIvlN9lPlC5z634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9D:gWDIv3BCvSnnrFb4PM4MYgLxEVyGLV
TLSH
T1A965015973E808F9EDB79778C9B45606DB727C129B30E64F13A0455A2F33690CD3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3740	elevation_service.exe
3008	elevation_service.exe
4928	maintenanceservice.exe
5808	OSE.EXE
4860	PerceptionSimulationService.exe
4688	perfhost.exe
984	ReFsDedupSvc.exe
3936	SensorDataService.exe
844	ssh-agent.exe
3196	AgentService.exe
4832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\118700292468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d7902a3490fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c5336e5f490fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002854a85f490fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006807b2a2490fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000278b855f490fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047628b5f490fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3008	elevation_service.exe
3008	elevation_service.exe
3008	elevation_service.exe
3008	elevation_service.exe
3008	elevation_service.exe
3008	elevation_service.exe
3008	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1568	2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	984	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3196	AgentService.exe
Token: SeBackupPrivilege	984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	984	ReFsDedupSvc.exe
Token: 33	4832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4832	SearchIndexer.exe
Token: SeDebugPrivilege	3740	elevation_service.exe
Token: SeDebugPrivilege	3008	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 5708	4832	SearchIndexer.exe	100
PID 4832 wrote to memory of 1812	4832	SearchIndexer.exe	101
PID 4832 wrote to memory of 2984	4832	SearchIndexer.exe	102
PID 4832 wrote to memory of 4664	4832	SearchIndexer.exe	103
PID 4832 wrote to memory of 3780	4832	SearchIndexer.exe	105
PID 4832 wrote to memory of 5860	4832	SearchIndexer.exe	106
PID 4832 wrote to memory of 1796	4832	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4928

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5808

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4688

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2588 2584 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2588 2584 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f914b61d414c9de46a67ba6c025f7b5a3713c2f027cdeb14f9bcc13e4416cdfb
MD5 234379a8bdbd9346a6f104e733120a08
SHA1 db387cef8c93793eabed80f07b2616f41135cff6
SHA512 9a7b4a3a055a87b8b172cf93709a1f7fbe67e3a1d4e89c68dbbb5045ab63cd922777484a627c5ba0622c0d73d9180217ba576f5817b0eefbda45714e9f65dce5
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOj4MYPVyGLg:c3q6HjBcVk
TLSH
T14CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f0128e4fa6383c4f85320b52615ba212ed891285ae6db449f310433af4aa58bf
MD5 0e01d4285815707613859e026bc0b195
SHA1 9f7ac43db3169451fefba0b33a30cf2c4f3b8f0f
SHA512 18a475ae40d2e7c6fba291045d3f91755ed3553ac65959732fc518fbc6034f4eaa2c9522513eca709c8272cf18cd0c929976608acec583449609afd5c15ecbe0
SSDEEP 12288:+1XLsswWkxy2lRq2czAv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9:MXYfDtczAwSnnrFb4PM4MYgLxEVyGL2
TLSH
T15465F12977E408FDDD6B8278C8A28555E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 018f55e177599762b9dc924e2e433dbbffe4a81bedeb8cccf747f54a05aab938
MD5 78233f2c466d7d7c8d655862f22fa71e
SHA1 431904d30abddf2e74bd669cfcc9548c3ddd5b36
SHA512 11bdd407986f4ab10e05ee8871f71b860b150727d3105f32a311da4051ca5e2ea9061bf56cbb22753944b44f73bb0dd80f1f556b47be7ddf8aab9f7453d833af
SSDEEP 24576:w0Le5ji0hmxirMNSnnrFb4PM4MYgLxEVyGLW:wPji0AcVj4MYPVyGLW
TLSH
T136859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b65f44bf197baf3e4ba487de95ffeeeec0cbc6b9668474ea797dc95fbc0d8b0a
MD5 dda308638c9db3e6e648410253689b20
SHA1 cde438189a690369d0693d2e1e4d815249683508
SHA512 580369f3c9c0ea92a83ae5540667a65b93f6c7ba888ce24900444b1c8d66f8fc674c2e5d26717cffd62b882115e921d6a45f23ce561e910be4c190e26fc9c65f
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyurSnnrFb4PM4MYgLxEVyGLH:H/ezSC6vUzPvxHjyZj4MYPVyGLH
TLSH
T17A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 34e4993bf14184fe0ae9480cce1f4b9fad2d6b6cd708bca3927286a243ede395
MD5 017b8261555fad6113417107e79215de
SHA1 2e3ed5bfb1ed50f819ae5376b7322db6f4448ab5
SHA512 e6c3111ac76cb0d09a229a40243027d4ebbecedd4d7e68eaf00d50f1152b191c9db88a24af1ea6a1f279e522b7bacd6e581ce31052ce98c190f6f934cf7ab766
SSDEEP 24576:HVbqPb88hv/l+6cSnnrFb4PM4MYgLxEVyGLo:HVO88hXl+aj4MYPVyGLo
TLSH
T135559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 100aec7b4637c03936212dcceddaab9382b758a7306775fa8cf621bab256d126
MD5 0f92606b3ea75b1097649502a90a2298
SHA1 bd7bbeb86827e08ffab1b364488113f53ffe8ec3
SHA512 d02a91e4785bcb6625c688c23271f9dbff8b70e2deec9072b4940413ab938c7fd3457ba20d482ed3c228faf8e12489e277ac67356a8a2b7d04422aa2c332d678
SSDEEP 12288:FRa34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:FRJSnnrFb4PM4MYgLxEVyGLz
TLSH
T1DC4523A75BDC10EACFAE15B0D1B96AC8E605BC61F875B20B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a3ceaa94367d8db8de9d38da0ae821877209b8a39de9d376aee98d548b7f1e0e
MD5 b6878d66662c426010e81a3e6990c53e
SHA1 90b12bb8ca589b1a7c06518ba582e123a34f08a1
SHA512 040d7b936573389458a1ec39df5a3126a8a2f85d86da9ba97b8c7ce4f8ee3434608ec8908aa428676498522b8281b35d8cf8a0cc3b1663d729f0feaef3de2661
SSDEEP 12288:keBNUbTVO86Ub34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:kJIUUSnnrFb4PM4MYgLxEVyGLf
TLSH
T1AB65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 edd47133d5ff769afbe5d62fb792b0be2b6e3df1d18fe89db3e6d4cac11913e1
MD5 707e05cfe3b5146e3f2507ab24b31ace
SHA1 f460d88d41783d87dd4c739599a585f20d5d8ef6
SHA512 795894d03efa1b7f23e9ad8a5dd61417a9efdc5bb031bcf2a9ca76eb38968e0587eac9c1967fc0cb19f6fe0cf954fd5c44e4054b7429f30f39687e566496f170
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:LQvGAdlCEL8c/yRNw5CBV4
TLSH
T1C6267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ed0983b6a0ca65dc0ef918d28289275fcc346ca6313e9d0e947fdc9aa202d6a3
MD5 568c0ff7bc7ad93223b4842f80688fd3
SHA1 456f2257896ec5b70ff6d3b16514d79570a130f6
SHA512 ef024b56b17532f7e250afa64d00d4f830b2ef3ebd043ca4aed866e7caba25444d245aac78ece85af4afe3df3432a2e8465640fabb75602e202e7a8f252ba613
SSDEEP 12288:sAwSfxL/2Dc34DLLmt0LDQewsAjt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAW:RdewsAjqSnnrFb4PM4MYgLxEVyGLJ
TLSH
T1A175E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9d5efea5233bf55cec9e9349b6bbd878e2aa8c610d7c7116044fd2cce7be070b
MD5 2ba9c26a1a06d403fb4a3a154bc1d24d
SHA1 9900aa9d4775abccdd41c1965cebe4fd0e5864b1
SHA512 1f968c85ec863beb6ba425b8ae0cf37b479a483734cc0a3657ad137c5925fcdbf5c49cb2497b19afe2dafce0a617d8bf90f7a07e5dfcbfa6390b3f81ea6a40d4
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:ZUEtQevvqc2W1cpV2EI32
TLSH
T16D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7b0b65f4f08961d26f31f4b84ea422ce3a232095faef9636e16908d3fe9b0310
MD5 b4a5919e4339962572c6582c36469173
SHA1 4ac9ef1b44e30af7820024e2d2ded65201c78062
SHA512 04d38a95d29167a4586417cbdfd9884c1765d5a9632a453580eb7b8249e580631423bd909bcff3a490ed19ce17396821d731d2fcc55996ba1301e6dd053b2870
SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/zFj4MYPVyGLU:zoqtVjnmVVo
TLSH
T13CD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0494a680e161f082edaa0b336efee1aed63b0ff6aa49c697e3967087487d6ee
MD5 676ce240c22d13dc971ff97a1ab9b2c3
SHA1 560ab7cdf9a105dbaa0b03e480713e461baa12ed
SHA512 d5f13962adb12a8aa05339908edd52c8a797a587342fc822b7677d6bd22c3ed8e19089cf3ec05fe02f5a9afd53b9409e638aed02901d5b2c287246aacb7b94d7
SSDEEP 24576:8AhGLJIFoiwtA5l7S53vSnnrFb4PM4MYgLxEVyGLz:8AMyFoiq54j4MYPVyGLz
TLSH
T16F35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 197ae1ca8dfa15bb8ccf4f58a26b4d6140b584001012dbfe84c200b83f6998f8
MD5 73eac25713d276ccebc8a21b5cca343d
SHA1 cc44bef4e685337da0708e115d8af8946035250e
SHA512 1335ee471f1e351fb179b42c0c31242ba887eded24c02a592ca8b2375bb8193ab891e397a28f3954207ff143adb36d4e406615c835253b2c6c058405135f6f34
SSDEEP 12288:Mmw5HEjsChNVBFgl0WDm+C434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq5:pwuoOWeSnnrFb4PM4MYgLxEVyGLz
TLSH
T1B365F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 44eb55c16daf7527e7bb7ffcc9b2200f65888c752aca9572657d82c37bbce47a
MD5 06a9969f60da1d91441be89d3eb1e721
SHA1 6a1fb7a0800c260bb1fd9465335b0cbddacb383d
SHA512 3a8766136a011a7452ca708b20f568ffe415f6b4f6b383bd9b4fe59669dca7ab04b7b031d67bc0090cd4098a6b174952ce510e633d5b4b13d66f04c475b97a4c
SSDEEP 12288:CBZ1Iy934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:sZuFSnnrFb4PM4MYgLxEVyGLq
TLSH
T1695512AA37E820FAC6AB4274C4F55688E3227862B73293CF1650655A3F37AC55D35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 933e4e3b8a832e853392c908f53f2eb117aa542d0f85e18c02835ac07bece2b2
MD5 d4b13d42f1dfc7f05018846cd1b2d95c
SHA1 e905bf7d7f343d5ebbda527f8c3e8bfcd9ca4e69
SHA512 4ee4c0ce2bc37c7ea552d913a6925d8077f5de37cd0a64c94e9c0095665b42393e3ba9a1143daecb0cdb8ed2bfb0e3f90654ca687daf5deafb4d68cabbdcf394
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:TQRQyi36YOcPQLvw2gAf+PN34VB
TLSH
T185667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cfe86b1836eac0ef8c574f72d4519a61461d18bbf8837e81975da2c18cf1a8dd
MD5 c271d5ab96b94df808870d1bd15f965a
SHA1 2d5e61456ce41ae75b4c28fb21980b9277174cbd
SHA512 d33451f2f595edb1120a6c1fa0e56eb2241567915723b03e7990a3e6ce980000ebcd7f6e08acfc0131d88b6aa00bd5268148bf96804290c01078bdd0961638f9
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:SQRQyi36YOcPQLvw2gAf+PN34VN
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6e12d69b8b146a04ecf2213eb07217a33c3cf57d1cccd4a18fd39dc709592a7a
MD5 dc9c01db0a2d575fa687af9444d4000d
SHA1 944ed83207d67b1127632962da0208920747b722
SHA512 111cf006bb26642d441db25f6dcc69cb4093a58bafff4fc34c4da49dc3c5824dd3c57beb49231382c2a7ad66369b497362ae0c418e0414861b70aed6c8689ac2
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01SnnrFb4PM4MYgM:z68Qg55nhheWu7PNU3/Vj4MYPVyGLP
TLSH
T171B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3aadde6fa033a80fd6feaf8d89c76757b3e2d27cceea35d23aa11935a944a93f
MD5 f6a8889fbfd130055429af4e819ccae8
SHA1 5543539ab1da978c5846ca926466ea09183dffa1
SHA512 6b06b86ccd3a5d9cc16f69ee439452adf2b9e5312eafc28dcc2b39a5752a1cf34cca288ff210921f78deab782fd598dbc22931344cd3aac094b6213305df17a3
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:Xy5112gYy5azzVvL69nLKnhZzVd
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 43295a550a51f3abc4b3c6f81ffcdcd542b3b7e53b7cf1713fa6e5bc852604e5
MD5 4ad545580d4c9bd22165f28575a3142c
SHA1 b58a6ffb104d40e9b8951f9a2c345df71de8ac30
SHA512 9929367729d7b07caf2c5f957c312bceeaf52d51b61d4c7e9cef58ac04c9d83f5e52dcc4290edb6fbff5a683f9d8ff8d460a35893aea1f12b1edb3a9667a635b
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzj4MYPVyGLu:Xu6JmVxd2dgVy
TLSH
T197D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6634bc86dc7ff42f864a2d833a036407e9fc6a4f2aa01607ea6d7bc73f0282e3
MD5 0f55ff23a2c2f0d45e14be512ce7d3cd
SHA1 89b1b9867626592e10e0c6c9a8742498f7bdf769
SHA512 f6e08b4f979f3dc5fddb347576f1ecf0aa297a7115a3000bf694fd02fe6e1786f96454a8ef33f428a3aa5fb7e919e0f5ad89d75701fa3435250e470b7ffba084
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xnj4MYPVyGL2:AmifPbRVVK
TLSH
T18CB5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c84431a00a6aad868e93c7a3255a56492a566613334b4d73f9c1f2b700eba0b4
MD5 59ac0fd8ab7a9ae046c4b11e3db95221
SHA1 21858e2467b51b44a64f4b9dcca0a7125e248df9
SHA512 e7d24380dfc317302219d5eec785ab2f1d2465f709594b2429004f21a0d7e0e110d752dedeeb54b1e490fbba7116346f0065756d48a5b36b06601deef38f9d71
SSDEEP 49152:gSuZQIY0Be2KRRVtOnks6NMHqej4MYPVyGLA:65dKTi61fVk
TLSH
T1B6C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 69aa1f9bfdb9f7b9002b134870e4f0116d181aa60364bb1048638bbdad5f4b35
MD5 6d5aa0515123e0985d3c6f98d42b8c1f
SHA1 ebf7cd281bd2ddb94c090f4d8e3016cd4edf1cce
SHA512 6a719f7f506f57bcc8a84f5a6d3d206a77d2dcf1c2f5193e0faa4694ab8d25e92e648ca66cd4544dc2822faa665ea62c9eff3b8acef93f289867e01ec431acb1
SSDEEP 49152:ghtSn8EApI0figngiDn0AP5wDj4MYPVyGL2:xX2iyph5VK
TLSH
T15F95BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ae9a5e86ebdb6d20c9e803a32baedb25b5e85dc1df1a65af05303c0bfdd5aeab
MD5 a1c19d300ca78707ae2ba5e0cfe473fc
SHA1 7a2c8738a995f8719d511fe89641d1926a02f355
SHA512 a4ebe9e257163820babf9af612c3af9c12ee94446251c4f11e6e7a41ea84249965de3bdb9915f7893145573a0096182ceab27004d2a419374e7f081dbc2aad16
SSDEEP 12288:jS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:jhSnnrFb4PM4MYgLxEVyGLT
TLSH
T1F74523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F778574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c1249aceb5defa2683819fe64d5839fc62359b2eed8c4e53247ebbde4a9fe907
MD5 617260d02e76120713199991bd7ff126
SHA1 1637f834c51c9bea16c2d83e6f5ba08848c49a7a
SHA512 479518278680c0eeb2700dd19b8043dfa5bef54be11c3e1427bbbde2f986e1108658860b77875e0e28ff4f1ec46e827bb182da082319917c54987ef57d8409fe
SSDEEP 12288:lB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:lGSnnrFb4PM4MYgLxEVyGLT
TLSH
T1224523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20F7B8574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7aadefa7548a661528f6061c14ed33542b56073256d21cf1d9a4dc22fa80a7c3
MD5 32c1c55f87f6d3a255736d51da928ba1
SHA1 ddbb6bc7ee152ae7c757a937b4cdcd247fa66ac0
SHA512 3aac9220c0f6ff23337c17e93776ec019306685ac3fbf3f3fd8b90c6782fa3405e3bb50aaa9d006cbe3f07a3d1b4e4e4f89b82188232870f67942408df18ed3e
SSDEEP 12288:Sz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:SMSnnrFb4PM4MYgLxEVyGLE
TLSH
T1D04523A62EDD10EFCF5D16F0C1A966C8E2097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3451613869523e37473c12cd22da7c1ee7e37ded62c75127547e6824eb245f45
MD5 3d153466ec37d7ef0aa8c9b3f542d7fd
SHA1 6f2e74adbb0165587354cecba0c6ac611cf16462
SHA512 1af65f3dd9e03bb59ec422b581fd6f4dddbabbaf9109e1a26d75a5eb41bbeaa801e65c53adfd1ff0c400488f4860075b3ce3ca5b92401c1af719dfb63412fb57
SSDEEP 12288:2VE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:SSnnrFb4PM4MYgLxEVyGLv
TLSH
T1084523662BDD10DACE6A96B0C1B556C8E2257C61FA72B35F6740381B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9261806d45caea87fdbc75410307098487f748da6a76a756225c849f0c85d35b
MD5 60f0939901ea47f355505c54a2cd336b
SHA1 29f71cd55e7bb5866168b2b16cbd4b269ed2004d
SHA512 0ace866ccbaab79646349ab979a68aa900ca3a8cddf17178d6739030016b5c295f07e49d11bb20ef3dd514a07cc2bbcca2a866bd8ff58a2f727289b9afadaec3
SSDEEP 12288:Js34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:J3SnnrFb4PM4MYgLxEVyGLE
TLSH
T1A84523A62EDD10EFCF5D16F0C1AA56C8E2097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5861c4f32d21c943b66c8d23d023042d02cbb9b5c878003967f7c0124b0fee97
MD5 bacfc756a3578f4cbf5d4fd48450f2e6
SHA1 fb61c0208dcc9dd444e3b41021297c337fe8b6f5
SHA512 f6259710b3323ff5d5e6375cfdb74ab08422cb2c8daa9a041454e2bd5a762a2555aab866fddad3a5f209db0b95e6f0f4fe2005e4c462a0fc68bf576126d3858e
SSDEEP 12288:MF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:MCSnnrFb4PM4MYgLxEVyGLI
TLSH
T19E4523A62EDC10EFCF6D16F0C1A566C8E2097C62F976B20F7B8574073B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a1c271ae6c6f52c7e0494e3f4bf29d763797eeef4c8e50bc96da0e99253a1c17
MD5 c20d80e95ac694ccd084359b1e0f6705
SHA1 715c6c51eb571ba6287e3511583b503e4d29ce91
SHA512 198fdabe25a53f14eb2b99d8d1bc95db50ae16a385c53fbb37b64160b7a484ec6fe7a16f35156799e4e5549c8f54e0577f520dc5cf69200457e81863f88db638
SSDEEP 12288:tJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:tOSnnrFb4PM4MYgLxEVyGLw
TLSH
T11C4523A62EDD10EFCF6D16F0C1A966C8E2097C62F976B20F7B4574073B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 45df69d9993ad6440c96cf2145e1ea52db689537800fc5c90de6ea51caeef32e
MD5 cc48a9355067caaf43e7efd446cd3a30
SHA1 d620ad4cfb67ba33e483df5499254b143323ae4f
SHA512 8b3a7129d25c167b6481934d290ca377016c16e824e4cea84368deb107f4fa98fc5c54e09d4b5a6c1f8206ce709a3db142f1776027662fc134268609df4fc00a
SSDEEP 12288:XiZwb6zzFEoS2cPvyh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2M:SZMSzFVSOmSnnrFb4PM4MYgLxEVyGLV
TLSH
T1DE6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 46d4e13128e5e514cccb1ec2ee1a177979e2ca9f15c06ab738ef2f42dff09d33
MD5 a0a0a9a3ff851e73c799aec1dd7254ba
SHA1 7597bed87c65bc9978d4f86667401edb583e61ae
SHA512 3fda6227f0a959ca324527ded27293a5cd1c984e1c04d833074039a630ee3a89f6027f2d701ee41ff0aad097da5927ce3ca740992533f71f2c9fb8fbe955c7d1
SSDEEP 12288:Ue34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:UVSnnrFb4PM4MYgLxEVyGLs
TLSH
T1EB4523A62EDC10EECF5D16F0C1A966C8E6097C63F976B20F7B8574063B3B20D5C91662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 841456ccaed5d54fb2d9e9e700bd230d2e3abaaed0a8d9dde8df614c8f6c9714
MD5 2082a304f840d82f5c25097aa778d38b
SHA1 1376f56f4b7d3081be93ab0eb85a47cc1f2cce16
SHA512 4ed037649bdc79b7f82f74853ae94066ec2c62af4a8ec748a84f3bf2eab8165b6fd363a8bdec25a1503ded4528c34e41d350d851f8f2d63f47cc036ca56e3d8b
SSDEEP 12288:Gq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:GZSnnrFb4PM4MYgLxEVyGLs
TLSH
T1F04523A62EDC10EECF6D16F0C1A966C8E6097C63F976B20F7B4574173B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b326ef7b49922344ea10d688d22e7f256d54dd2e5eb0e95f40f1bbff174f5358
MD5 5ebaa57f38efeba8cc26df709f8555ea
SHA1 fe47cdda5c8a87251c713c3ac39df4a13ac990e8
SHA512 ca640aab40d6a1df48efae6ed7ce77224f24f825fae3205e37dfc49ce939d8103136061ea10390ec5bd4a154407f39cecf0100786d5913eb3379de48f4239afa
SSDEEP 12288:CyPz5L8934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:fzy6SnnrFb4PM4MYgLxEVyGLQ
TLSH
T15E55025737A530FDC67A9274C4A21A45F336B8329B309A5F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 feaa8b9ff80cdfdd398ecd57cad6d772e5cdcaf577b7600395b9872b571ffcc5
MD5 a6285b741b91c523db0fe26d8d68f604
SHA1 20110806ad14e2172fe01480f5d675ad051ddad6
SHA512 def28042db8062ada6bd0df9fe985c4d4cf746fe625ce66d5164a6756dc9157a01340f565e974f50de378f91f51b6870b6a518e591065cd4b42eb0bfcc7e6703
SSDEEP 12288:we34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:wVSnnrFb4PM4MYgLxEVyGLK
TLSH
T13D4523A62EDC10EFCF5D16F0C1A966C8E6097C63F976B20F7B8574163B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1fbf202c36bd016af78466b4394ed437a96af1bb0a86869b2166648719163bee
MD5 88bec857d7b5f1ac0fb7e5c37e2c7392
SHA1 3b7cb53ffc6cec029ccff7e1cbcecc691d6d9921
SHA512 c17f9e24c2d13b87441bacf32f1b72d6afcd61ad6fcad13f33e372388e8b2854c63cebe439ccd2966af14f389a47173dc4337984ba69ba33201b934eb0371e0b
SSDEEP 12288:ae34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:aVSnnrFb4PM4MYgLxEVyGLZ
TLSH
T1774523A62EDC10EECF5D16F0C1A966C8E6097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e317559589929d5d0ee44a218a4ec9e583664c3dd925f04b0bd1902390ed172b
MD5 ea1698f3780aab37cf11129ba45cd99f
SHA1 89b7fbf6f5d52a683d26652198d18395afea84f2
SHA512 1df944fa16ed62bbc5b581a68e7f0d2182b89d583027d616f6a6dd70aeb8a3fefdb8c283bdc1fa50bfb6eb9119fc27856477efe7332129f34b1eb131c82c6ec0
SSDEEP 12288:2yPz5L8934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:Lzy6SnnrFb4PM4MYgLxEVyGLj
TLSH
T17F55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a40e7f573b3d7c2c48d6d0e9e986e3369e24179985fc2b097256b2030f7a9fbb
MD5 c27c9fbd70252804d12bc6d6fa79cc36
SHA1 767b33a622998c018dc8d1d425db2584759e6397
SHA512 8870086f0e2e5bb935e0bd8ea195232c27ad345b97cfa188601c5742fe31fb49f6062c8051c8bfa8fd0b6b73dbfa4cfcb82e39638fea9ebb654cc8d6f9d846ef
SSDEEP 24576:4THaLl3z0zD8SnnrFb4PM4MYgLxEVyGLW:4T6Llj0j4MYPVyGLW
TLSH
T1686502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8dcac3a54e3b0f920a2cdc099cccc1002598e11e8271cbcd4f87d2bff2bb28d0
MD5 90796d7bdf147a4f5d633b80f24b6850
SHA1 d585c10b0353259b85819f89fc38e3ebbda36bf5
SHA512 85cdfadb057a345efea123c1ab225f2efcf4947eda356464118c821c7567cf7d90fabf178ac13d5ea6702a283bd9be630233886873745544ff06bbf441c0b2ff
SSDEEP 24576:W37d9CHKy7GZoSnnrFb4PM4MYgLxEVyGLp:47d9CHKyaNj4MYPVyGLp
TLSH
T11F75DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 db9d3ca0c0253e4e322fc3a9501754630999370dbc29b26512bc6b0151aa2b03
MD5 3a969220ca4f92d664f52b0e93b0eb33
SHA1 65123cdfe2a2fc7ea05b92394828d4ff1b71197d
SHA512 78917e256ceba0f1df1ae20b55e4f00f63a2ee2b4f37c8194300ec12b7c5ad9e477218e8f90a0541befc724478a2168ff5f22d42e2d32a2b545054780c54e36b
SSDEEP 12288:5T34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/:5sSnnrFb4PM4MYgLxEVyGLp
TLSH
T1654523A62EDD10EFCF5D16F0C1A966C8E2097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7334c18ac39bf113b97f01f19b3ebadb0568d47fefe74d3c59e32b00f35ce258
MD5 72506e71aef389fc6a7b184859cb4856
SHA1 230c70d8db523bceaa5429fc8d5a6896672b1c83
SHA512 0036954c78583f8ed7a1f6fe5f9a0635007cfccf23734a3e3d4b6c275a73e0cf204daf1216848deeeb63662fee79ac54f749ef8cbd4803518cdc66ed51f4b86d
SSDEEP 12288:Yd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:YaSnnrFb4PM4MYgLxEVyGLj
TLSH
T10D4523A62EDC10EFCF6D16F0C1A956C8E2097C62F976B20F778574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9f0eefd6716b3ec82fb1ac0471b4bbe5e89b77a23f787af1b34eda92323db025
MD5 3d79731df6b80659196c5c758583736d
SHA1 d44482ba6169624b38d2e14c9e0ff4bb06309fe6
SHA512 5777781162e63b47d72a205e782e417352e7f3227d43bea44fbdca5bd0bad95a8865db916ec65ce68a4b219bd21e9b306dd3004141becd64480d89a02a4dda29
SSDEEP 12288:Vg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:VzSnnrFb4PM4MYgLxEVyGLJ
TLSH
T11A4523A62EDD10EFCF5D16F0C1A966C8E6097C63F976B20F7B8574063B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2be60862dbc602bc8b651d6fb1aec60978366f8cc195c6cea9fa46b4095797b6
MD5 92d8a79046669ddb177cd9a5f1516cf4
SHA1 b7cd1f445630975f70316ba38fcea53db6e96d51
SHA512 24e20c5d9544cd57e2f1f055514b6a05250856a10b4ae98c51901c5ed5fb7d3f86c263afbc19f9fe004b9d885d5f1fbef34daeb944c8bd4f1e2985b9ff6af212
SSDEEP 12288:/e34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:/VSnnrFb4PM4MYgLxEVyGLJ
TLSH
T1754523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B8574063B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f364052d44174417cb8551770f5d879860b1bddc8684940ac02b1ba95f143c2c
MD5 21fba8dc3fe7146652bb6b28aaf0094b
SHA1 39a2983f55e9660e2e754d42f610218c556ab5e3
SHA512 2b3da970fc5bb10c7b60a611f55040c31ed3b43a55c6015c5ad338744c0496cddeaae23fc1bc4844741461175694c5845c8935b85c30ddf749cbfb7b94de4d20
SSDEEP 12288:sT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:ssSnnrFb4PM4MYgLxEVyGLx
TLSH
T1174523A62EDD10EFCF5D16F0C1A956C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c240fe604e5fe9c113bdcfc5bc355dcb5897e9d4306673d654e7ac9cc1478659
MD5 0a5dcf5f991b00ae15bc5d140e713941
SHA1 500059075d712476473856d392eb1f24fb072f4f
SHA512 43810d07a18f6c3acda8113d3881c90d9993d7c748d1d42d4ab783d619c0ec5d0401c291bf93bc845a5de783af727f587085570ff95373909039c6d94462bbee
SSDEEP 12288:lG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:l9SnnrFb4PM4MYgLxEVyGLl
TLSH
T16F4523A62EDD10EFCF6D16F0C1A956C8E6097C62F976B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 fa34fc13941b6cf5ad2c4bde51e6fb0fe56c58ff81165122a4ef98e8f119fcf1
MD5 38d6e606715bac4ff92a9d8012bc490b
SHA1 7c40d60354518bf8b7910206a1423c3532c1127e
SHA512 b733dd673def79d18e936096db5100b0cbfd4357c2982970d3ac48badb2c7387e9e42a17c12fb992447db9e38ea75725175c744eb61c5a3c2aea1cab169c6ad9
SSDEEP 12288:Ls34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:L3SnnrFb4PM4MYgLxEVyGLx
TLSH
T10F4523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 22e2e19e16c0e7a5fd9a1ae77a7d13cd2c85830a865e3848c02cedc803e93037
MD5 c43d10bb8156ab411d2583902e9ef8ef
SHA1 4194a8be13ab88c1c6c72f5f2f4015eb8d413ea7
SHA512 d4de8ec5c0a5c5368b1c466ff8c0cdf086bb06e22a84353bf4a8b0e59802c002dffd278c9318580c13e86c12332d34e3e9a72b916d39f23fc13e1e86fc688776
SSDEEP 12288:Br34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:BkSnnrFb4PM4MYgLxEVyGLP
TLSH
T1E04523A62EDD10EFCF5D16F0C1A956C8E6097C62F976B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 aad10ac6e5e68ab5fe453f394836ab234adea235e046885db83c35ad4d983878
MD5 4808853a04fc67281920fc9779f8fa7e
SHA1 1faee84a9d2f743c457890111558f330c9ff20f1
SHA512 73b2ea0a889d9e1580f13992c4ec51468d0ec274fa93d6f4e9112443f1133fc1350c35745f042377c1f5440876809bda020f07985dddd1d061fecacbe3810e3e
SSDEEP 12288:6s34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:63SnnrFb4PM4MYgLxEVyGLD
TLSH
T1CB4523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4845898c17581a3c2cdcf4bfdecaf2e70e5be61b8bf8807304033895281b0e43
MD5 bdafbbffc85627cf69bebd54004644a6
SHA1 1e89ac149fd120065d0bb8acacb3a131e7dd50af
SHA512 569621bf8d9ce343103ad19da50a0dfc3eb7e80a44fde135aeb484b7d8fa222ac43384b3b5511aa1b52af9167b749997e28505e62316a507b1695c1322c93b52
SSDEEP 24576:ifwvok9RX6wkyAIpSnnrFb4PM4MYgLxEVyGLU:OMnYIij4MYPVyGLU
TLSH
T1B885D029EBDC04E5E1B7923C89B7460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2915509d2383384347133743dc4845756393bb3833611f3b8dd69b9fdc7c6d23
MD5 2433a871bf54771b639e07366271c8fa
SHA1 61dd493151b495f26eee557df96465324486a579
SHA512 f6c60a59dbf552a604cebb44c0ca6b0898f604fb11b3debf5f3ca41d6539823c352cd8dcdb728276eb3f262578cda07670d5dbab3f7515fdf75f2381c06a3aea
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jj4MYPVyGL/:/ySzPYVr
TLSH
T186066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 118b1bbb16c385cbae549a4a49a76bc11116b4be09ae39274472cef925ab60e1
MD5 feafcc0fb92a4aed5a6b57f6be74ce75
SHA1 fbb220766319568e191ddb318b86a38684c3da55
SHA512 ef09622b6d9c6c8cb2ea82cdba58d3b219c506c2b5b2ca5d07bb5071e5b0d721a56d18559b6d242af88aac301ae1464def5f122cf2d5f11e7965e1e951a41101
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2SnnrFb4PM4MYgLxEVyGL6:i47JUQj1irIhCnDHUPfF/zj4MYPVyGL6
TLSH
T1C465BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a8e01a1ff02236f3ed6f2123c95b5dc990e37bc5dc9fa79f087e57fbf10e9b78
MD5 052247e63d32716196f29fe3c370be21
SHA1 67a89026e2ac4e4008fd6cd50bee1b90c6af908d
SHA512 1910e0f4e6bd37003ac40c1232aaf47c2edc9df448042d48a7c027aa9bb5ca97dbce7f19aeffb997f51faa30b1b45d66db3fccb3e8c0d8238b457185de8fcf2c
SSDEEP 12288:ANsfO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:hFSnnrFb4PM4MYgLxEVyGLA
TLSH
T1AD55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 15467f8a252425d5fafe0506d761ae9c4d41ad1ca4dd9386dc8a98e0db06f034
MD5 14d123d7a3198da2abbc1f9e7ed64861
SHA1 426d6fa940e302e7b8ee906ea4875f0dfb77a684
SHA512 4ec005e2cce6f7f8aff794e30690b913dc6d780082ecde03829914a90d323144961eb712d0f8e043cedf93281693e980bf459cee22aeaac85cdc30c3091870f6
SSDEEP 6144:dsBC2naWDsvY48X5lKhotMxRMQPkv6KnTEuiI1Pox/uv8zhlCtOLU6hcHbHyWwVE:KR/TZO5h6R7SWwIC1+e
TLSH
T1B43527107626C75FC6AD40721E37D5CCAB707D82EE059B0772C94B2FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 988dd08819b959df09a987f01ab499802359cf196a0801f18cd50bde87ed3069
MD5 476ff0aef20ab972a163426c52fed925
SHA1 33df3db3592c07652afb64fb5cb2518493bf7fce
SHA512 aa8c994619b431303f60bbee6ffc585e9f97b05660acf280e54f6992174d213c52b7c1c5d40a489ea79b0f8add26bc87bad234cecefe45e2f6b5138756b12116
SSDEEP 6144:u8w1KBDIesSwsDwKEvH38x1wKXC3zhUn3TfwEiqwkhKJtMxfKb4RZrLgvlTMvCns:u8wBe1dG3enzgv6vCnYze2
TLSH
T15355D8405536E38BD1BB6172032A5F4CA7B4EC47B709AF267388453ED86BB2560F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ee2f44c5e7fcf0e075837388d88d68d8b2216b421f77977475067b62f09c8626
MD5 97066c27eccaad2b17a41deae2033fa0
SHA1 cb2d7a8ced0c96ada436cc8871eb924a287130d4
SHA512 01d8d61624d2571115cb39f11e212d7bac0c0c79f14977815f4a5d31f8c60b5400d657005a9308324f1d1898d342fdda050487f1f460113945b4e94e1645a5b4
SSDEEP 12288:yM7234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:PtSnnrFb4PM4MYgLxEVyGLN
TLSH
T1464523726BDC14DADE7D16B080A99698B209BC21FF61F18BB74074463A3B6CC9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0d93b694b341f469a10734bd176e334a67102f9585b11c79e0e1b9b1f2323c62
MD5 f499b7bcd9239f90e2a7fc455f8af8d0
SHA1 e8998b0f506f335355279778577abd9588c95a2a
SHA512 2d2d58296b172f6e34ad36a0b6103c7665c59a7caedfba34616bd0498dd05448ba81694fac9388cc82814cd14be5660964166b77b11c0629d611ec891776f339
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYrSnnrFb4PM4MYgLxEVyGLR:vgb4mBIBhGFRj4MYPVyGLR
TLSH
T1CB65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 59dd9c2dab95624fb2a94a7f83b8859e078efef86c3466faa0d9a3245179a6e8
MD5 95d6dd9751b1c7268081118bb90f1c7d
SHA1 4f40b2812c68f8f455bc02cf45b83ff02627362a
SHA512 a991bae40402007795da4ac75aa0fdad257418322a6848d15b35fc6512654774834851c5af3555746f4fd06b9b9fdc136646bda50e33790e336db679b622e9a2
SSDEEP 24576:wG88u8FpJqH1bzria7/mmSnnrFb4PM4MYgLxEVyGLx:j7ZFPqVea7/cj4MYPVyGLx
TLSH
T16E85016577E001F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cdad482468406e3662c65ea98277f3362e0bc068dc1a91e9aa8efd7794bdf445
MD5 efeb1dabf575bbb0a06e3ccbc2673ce8
SHA1 b13297c6ec968cf4e03550b149808af9a87aff8a
SHA512 eefb1160c23c32932e4386406934755e3bbbade7782f743ee57aba2295263c256daca440ee483fc7a55630fd97e6a92b12a6bc2d4b2ecd9263c52d8a342ed871
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9j4MYPVyGL+:uG05lO43bLVi
TLSH
T15DD5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8e9726c095e75f687ccca4d9f037fb412591b88b5e0d75c1a153b0e735ab7da2
MD5 31da5a6429e55ef8d121fd778d8015f8
SHA1 a131bd05d38b9983069d6bf8bf061ed218ebdd9a
SHA512 0a4eb9595b5fd4367ca518efd841889002c4733c60cadb3b20aaf1afdd34a08a02d5365c3ef6e1d4b80a6e0b757aeb6c1b8cdbae89e464780a19769c9cc46ade
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQSnnrFb4PM4MYgLxEVyGLA:Ga5POZ3+Jt2pasx2+mVj4MYPVyGLA
TLSH
T19C65AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bacf04a7c1bc590edf52ab1ad185129384afb9b3c29cc2d997f83ebe7be444bd
MD5 99388859c4694b7a5b864a68418e5295
SHA1 543bd1d2ce339be12825acb67cd9c450ada29ba4
SHA512 62076c28d711df9adea46084405d0d1b43c150fef272a708f22806f9055a52c7b21a26143765101bdd26c9c30534acf8499dc1e550a5a624147b820034f640e4
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fk+SnnrFb4PM4MYgLxEVyGLV:tNc/zEOVHF8j4MYPVyGLV
TLSH
T107858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b226343eb53cf1fa54455f2d3fe919470edf17b161240659d472013918880e5f
MD5 b512c933b9567f06277be7be529254c5
SHA1 09a313e109150660b43f709550e9a611cd724067
SHA512 6a39896e1cd05b0b809d8397268b0e2500756b7dac622988395eed480714a2b7519284a253d6aecd73b3f1f01c0352c02436ba3d0dc92f66927aa6e1b57be693
SSDEEP 24576:R8kNvNnaFeYhJNtmZBmkSnnrFb4PM4MYgLxEVyGLd:R8MwBtOmXj4MYPVyGLd
TLSH
T102559E6EBAF806E4D1FEC6B4CD238512E6727461173293CB5290C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 304c8b01a0dec2adb3226040058fc30561dfb1dbdbad9486fd27bb2229a329fe
MD5 7fd814263646132d1bb78c85d02ccdf8
SHA1 f39bfb67920dc623fcd54702940e7ea5ea785ceb
SHA512 fb255380b5c3a23539574e8b88a84a4cf4e2db2e84c68803511b56842a856bf39014c68ee7adbbe21864cbf082e2d82d31f8e915513908f043edb6062c3b3812
SSDEEP 12288:hHvUrBFrEjwaQV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:hPUr+NQSSnnrFb4PM4MYgLxEVyGLY
TLSH
T10465E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 30b0e12f4b497f6aaf0a8bcd99dd0e42aaf402cbc1edc2f2d7ea38ab74fc3835
MD5 f59ae2b97f80ab33a63598702ac20250
SHA1 bc8f0598aaefc8915a97e4d5ae450e2710634fdb
SHA512 5a929fa207f9237a0a06b9c7b17ad79505e86a5b5e7ef6bf9ee14910f740758edfc345c2ffbb85a72b4f78ff97ea2415af0d2d731098acb50450aab3fef832ac
SSDEEP 24576:yD3FHshBIYQgABSnnrFb4PM4MYgLxEVyGL0:yDVHeBIAA6j4MYPVyGL0
TLSH
T1CA75E17EEA9C04E4D57BD1BCC6638A06E77138A9033266CB12D491B61F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/844-373-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/844-114-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/844-120-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/984-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/984-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/984-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/984-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/984-386-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/984-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1568-314-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/1568-1-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/1568-9-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/1568-7-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/1568-86-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1568-0-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1568-318-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3008-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3008-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3008-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3008-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3008-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3196-126-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3196-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3196-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3196-132-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3196-137-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3740-21-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3740-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3740-15-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3740-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3936-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3936-372-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3936-370-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3936-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3936-106-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3936-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4688-82-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/4688-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4688-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4688-77-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/4832-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4832-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4832-382-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4832-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4860-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4860-72-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4860-294-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4860-66-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4928-45-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4928-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4928-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4928-39-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4928-49-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5808-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5808-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5808-274-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5808-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download