e1b3a9e8ea5aa3a0d55124838e5b39cebc89c86d2f5a797acca631dcd5e8bff7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260712-j31sdaev9j
SHA256 e1b3a9e8ea5aa3a0d55124838e5b39cebc89c86d2f5a797acca631dcd5e8bff7
MD5 e530bc90e55af075020ac2c1e66f60a0
SHA1 6ed2ec7f88ec14c996ddad4288523a7f73c9c2dd
SHA512 bd750272c3507e434b122fb57a39aa0c1585d432eca3fb6991a79aaec6c3b87b7588ffe2b35d597c48baba6d4159f32fd5473763b85d881e526cc067714efc94
SSDEEP 24576:E0/C6C+H79Us2PtOsyGpYsqjnhMgeiCl7G0nehbGZpbD:E0/LsbiDmg27RnWGj
TLSH
T14C45D016B7E401F9D077D179CA55CA65FAB3BC0A072097CB03E496962F276A14F3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5856	elevation_service.exe
5012	elevation_service.exe
3364	maintenanceservice.exe
1156	OSE.EXE
4556	PerceptionSimulationService.exe
6004	perfhost.exe
4808	ReFsDedupSvc.exe
1988	SensorDataService.exe
3708	ssh-agent.exe
3516	AgentService.exe
1600	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\323265d23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9ad6838d611dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7b18a78d611dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe
5856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4808	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3516	AgentService.exe
Token: 33	1600	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1600	SearchIndexer.exe
Token: SeDebugPrivilege	1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1916	2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5856	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 5852	1600	SearchIndexer.exe	99
PID 1600 wrote to memory of 2576	1600	SearchIndexer.exe	100
PID 1600 wrote to memory of 5844	1600	SearchIndexer.exe	101
PID 1600 wrote to memory of 1424	1600	SearchIndexer.exe	102
PID 1600 wrote to memory of 3592	1600	SearchIndexer.exe	104
PID 1600 wrote to memory of 4124	1600	SearchIndexer.exe	105
PID 1600 wrote to memory of 2904	1600	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_e530bc90e55af075020ac2c1e66f60a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5012

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3364

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1988

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bf4edf16993fd4d45a961a0c91ea050f1b3dd6f4e1572ffe02ce0a076a9afffe
MD5 091c1c74e9b77b4a03d6d090e2233326
SHA1 d746422695e55602d8d2171d6e46de0f07c04fa9
SHA512 81d06b6a081eb088cc3b8f89f68c0a18b71a1ed4c146f1883ef618dbe283bd553efbe452a2508ca088cdab9642c62836654feec4cff6818d75d833357eb0ae68
SSDEEP 49152:7b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnMDmg27RnWGj:J3q60jBnD527BWG
TLSH
T14AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9d4c72882c64fbf44bfc101f9d151f39ccfaac3d3aaa1317043b2b840ed97f19
MD5 133c2ba1823ec9a3b3391096e2c4ac8d
SHA1 fb696f7c7b11b4814f4c1385429738719f3d1660
SHA512 f41baac5ad47063b5907e8f089c0630d0eff96f2461b7985757e874645d14f1a4b1fdf9969b6b78ce26b8da6a19884ac51fbe12e01fde937f796252018b300e5
SSDEEP 24576:iXYfDtczAnsqjnhMgeiCl7G0nehbGZpbD:ptcKDmg27RnWGj
TLSH
T15165F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 42a16527d82cbba7447396aa2c476c5f311f4a78f3dcdea68a60099eb44f865b
MD5 5bc699d190b239d6f6bafc37dfd8f309
SHA1 5cf370676e7963aea6b0830f393751d9750a4cff
SHA512 db70084b97b7778d58ad2ca45574b551fba08c870267a5fe2244c9c7fdf4e38e21642358d5e641b2bbda52d4f32beb96369e705e571e2d321f2009d9995e4b4a
SSDEEP 24576:90Le5ji0hmxNrMosqjnhMgeiCl7G0nehbGZpbD:9Pji0A79Dmg27RnWGj
TLSH
T1ED859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 996872fb275b60458b989cbbeaa25f44af167e563f81657eaca61cd43ee533c6
MD5 28164c1b2216b18234b45b20c4e3d4bf
SHA1 fad1a083555eda6113d6926ff70bf0528111a40e
SHA512 be4c891b133b5f074ff88d8bdf273b20fab5aeeb7b05957e4017f39317b2dd1ae68db52233f44283e1dfbd4e781dbd0426d13e2fc2ba6b232803d7b195e47732
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWr6q8wyuWsqjnhMgeiCl7G0nehbGZpbD:z/ezSC6vUzPviHjyxDmg27RnWGj
TLSH
T18F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1d6e187847284455ee1688364f5d9d30776d05f505e6cbe9ea16acd4cbe3c263
MD5 2302c2eaef076b2cecad3d54584bef12
SHA1 83c78a347cb4ac7626338327958ea2608f98352c
SHA512 f57cdf58d169999c111eb88ff73ef6732a7b31a6c8d4781d9b4cc4b09bbdde4d91b84c9ec14ed90598ddb1c59f1810c9b5c2f75ceb7a63cd26d785195d18e740
SSDEEP 24576:QVbqPb88hv/l+bzsqjnhMgeiCl7G0nehbGZpbD:QVO88hXl+zDmg27RnWGj
TLSH
T139559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 326aa1735c71a0720598474ca09cb3549e3392e15d6e00743eccf764c27b16c1
MD5 c8561bbb934fa7054c603d75f84dfe62
SHA1 57f7ecd881cf3cad7bf5f84afb50816eb0c503c6
SHA512 f5d637e1df2234d9f798609e24c4549c6178ee6b3c87919e52d8e61c1a7eb54f7ee167aed5fb8070a1738c08db31d54671331a2d1c60aa3dc202da23707c156b
SSDEEP 12288:uj0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uj0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BF964C50DAEB7608B5C3E9F11EAC137E56982008436A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ebb23b5ed24521c534a9c06ba2ca2ac85a9c86213c2ae23797b68d9b0e78c8d2
MD5 ca758b6ba7da751c845d3534f9eda658
SHA1 f691fe5f4a3aa7364eeb2a42b152633a94fec6b6
SHA512 38c68070e1d486121f30211c28c14b019f2fe37c2fd480fb2582db7b3a5c7e223fc1897563daa5dbac16f1376d4fb5b2332648ec1ee711432ea84a697c39cd78
SSDEEP 12288:oeBNUbTVO86UrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:oJIUrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3215105ed0213504202b155a8db5c4798a4f4d20610900303a7a46131a2e7182
MD5 7994eb7883d7fbef6e6315f26e9e69f0
SHA1 567734e2feee342f96642634b94834887101a52c
SHA512 46f886fe71daf40c278279fe8a98998ff51e178c047d9a3e85daea955bf280261469e7ffcdddc92f9c33f4d2715d6e199134a785f8d3ec44c42eebde1a46ba4b
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THW:BQvGAdlCEL8c/RRNw5CqD527BWG
TLSH
T1FA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6f7b382aac5705ead8433ad406daeffdcb066a761d88606500bf14ac6fd6c438
MD5 20e8a0b4c245ef85aed897259e897e9d
SHA1 593db5563cfc676cd1608e80509b54d37bd23134
SHA512 cd86de679915838b2fc0b73b773fc4e10de060b7069214cca74e63dfe2b1c9906fadce06ccba472f2d09b862b8c39b9f6c88737db85cb42d60eaa89285121bce
SSDEEP 12288:dAwSfxL/2Dc3DDLLmt0LDQewsAjJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:OSewsAjJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 44401f68ca0def3bc5e40b44aa946a47377cc98fff3481f94417de37349e590c
MD5 74834382b17d708d18ff88763f14800f
SHA1 b19f71ca149b43935883e38c0bb52111da2e0ad3
SHA512 cb6b22191b7678d24d5ad107586e90d7528b1a1045a1f06ac560a2a7144090a9fb178b16e5d00f768e37a8fc1ab86fc0f0b9f4bb2bf11c3cd463bf0a5ce9b74d
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHFVQBWG:mUEtQevvqc2W1cpV2RI32QB
TLSH
T1FE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 28394decb60647ae9092c2ec142ed4c07807e324899dad37a3aa730c7e6830c3
MD5 c530e7c191ef0c2ef660ba450d67a370
SHA1 b0f1c31eaf7e940a00101c1a51484970c062c677
SHA512 9166259cd90fd5a33d5a290ea0dfe4a00dc7b233af5df5d7d1efae1794611718e62cc2a2d562a8fc29724c31b7452d7dff7c235e47d4796e183596db34d6f8d8
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/ztDmg27RnWGj:QoqtVjnm+D527BWG
TLSH
T112D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9cd64ba1782ff0420ebb97dbda0802435700e6aee7d327788a791e94556d809d
MD5 833155c3ae8c8ad5afdc4a6fcfd61e6f
SHA1 6c23787bedad824add5443bcba8f4eefa6c3aa72
SHA512 13ede719e5cbe7c48bdd11dec45580d40d742d6a190e63a187264c5eae7fc3a025cef85f9e198eccb09d53ee8d7da0f55b69761e61b58b9854c900039b6c8ac3
SSDEEP 24576:7AhGL2IFoiwtA5l7S53KsqjnhMgeiCl7G0nehbGZpbD:7AM1Foiq5ODmg27RnWGj
TLSH
T150359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b971c2753774697b9515a44cbe947a3b336f9f2e9df52d67d1916da6d5707268
MD5 08ab3fcda785677ef14fe9b17dec3f4f
SHA1 f5c9ae39a35229fdc48411f75b10b10f5bb284f5
SHA512 d0a32322f37e5d27c3ac5031c920b090268064485a8720ddf130f631cf2050f7a2e1ca944693ebdbdba3a9f7e6a0b746f4ac8b8ac9e2cb0e672814fe4d5a473d
SSDEEP 12288:Mmw5HEjsChNSBFgl0WDm+C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:pwuXOWtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A665F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9fa945858bf7efac519ba40a86d326450b1631fcf75e11d47a628b3b5288336e
MD5 cab1b4235a1867ab72a47f18b5d7d6bc
SHA1 f0c81dafc67e24ee63f1c0ce4b9abb29069a05c7
SHA512 8ae90276cdc5811723f08353c6839fca9a8ea19b7f446e639fb50b4fc0030e987cc3990e357130403df1a5ae3b94371ee896e60a9a008bb69a781f675ff78d09
SSDEEP 12288:D/Z1IyZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LZugsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1625512AE239820FAE163417CC5E5D609E7333C62673043CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cb66f3a2da97aa629d8f8f1297882c61ad1b17397c0d7622394a5a790c6688e3
MD5 891982e70e9f6e8f37e6f51d95995833
SHA1 d778c16b197fa705788773e425a67048b4ea6ca6
SHA512 e121922c87ccb4c1ec909ee3fd7ea9ffbbafbe21a9b9a6719efd50348b089fcfd273988f9131d792fc8736eab9d057cd69634ef425cd07000458f3715079d5db
SSDEEP 98304:MQRQyi36YOcPhLvw2gAf+PN3DD527BWG:TQyiKahX+PNzVQBWG
TLSH
T191667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8170af5e7ea7e3fa6a535a36efa561e8c2e227073c6c491f7fedc362811f62af
MD5 11b86030ae9731aff94ce2da750ec317
SHA1 ca0988005cd6211c71b18805a296d583059986aa
SHA512 1a19f4117373b28b071b97425a6ac890a587abfcc21b67c67eabde50e32f8e5d7bd35ac98574e6f75a7e362ad60e242d869c24aedbd0b688942dca472c17115a
SSDEEP 98304:JQRQyi36YOcPhLvw2gAf+PN3DD527BWG:gQyiKahX+PNzVQBWG
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3f1e6948846966e40a63445c9a257b5db25a1c3ef79b839ceeb0221ea516cb53
MD5 afbcd58294ab3ab18416a686aa0e5e4b
SHA1 710ff90cf4b25cc8a8788c7a69fedb56fe9ae13c
SHA512 30fa9218366cc51f4bdf9460d49bea043587448ebc1c3d62a8c78bd96f96f11eec4ea97ce8209f8d008943f90d9f07419f15d16f9e62f512092316d1c5b543a6
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0QsqjnhMgeiCl7Ge:F68Qg55nhceWu7PNU3/9Dmg27RnWGj
TLSH
T116B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 008b11cc97092ff342314284c7c464061514d5d5c948b624b5c84d7e8215120d
MD5 c0bfa2728f0bb7a5500ccacd4b6cb605
SHA1 292c7dfe56152f79e06b1186bd6a56eaaa34f511
SHA512 56aed1829e7b91a516ea40ddfc0d14e383947acb479d7fc41af610249608569f33c39c1c9161113973988ce47faf26c33cc337240e4fb54f7d6ac01dcb7ef5b7
SSDEEP 98304:fy5112gYy5azzVva69nLKnhZQD527BWG:SLIHjWhWVQBWG
TLSH
T1D7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2ef4f5c4e30a37788bed77083c7db2de762c0ae5116fc6a8fc42d8a7161b2042
MD5 a8eacf8627d029a4eb29ac26144b7b80
SHA1 eadee61b45f62c9f121fd768fcb40de01d992ede
SHA512 7133480fafeea61b92449bb944c888667e5688214b9ad82d48756dc8c39c3d9da06437bc7b2f6618cc71bf4bdeac10955ea8cf74b4e42f9b15572d56b069982a
SSDEEP 49152:KB+taZ3usBWOBr4tEG20bqx0z+n217aau1glrDmg27RnWGj:Yu6JmUxd2drD527BWG
TLSH
T120D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1ca726daa3026e6e59389f510effe641177ef4c68b59e66e70cedbd6d4b98ec7
MD5 1140ae71adea03ba4c693c57178e7903
SHA1 3b565a8059e7121f59425c52840fe9262ef1819b
SHA512 5a20be57c203aa2f75463510a2d48343ebb7894ebf5645a3b95dac717cb0af8779a0176bed5a1531cc000cc7a359c319bc7aa5a3bd67d2716f52dee7ea9e29c1
SSDEEP 49152:W1hpsNoJpF1A6BU44CwH7R4x/Dmg27RnWGj:WmifPkR+D527BWG
TLSH
T15DB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 85b281519de3205d3c0576e9153f24def86630af32762e3276837898d4f4942d
MD5 0e52c03f8d9becba6081172b1e4f0b82
SHA1 3343f4debd142aa6d52c8f37877280f38c4b1be4
SHA512 8b2f512fb0ccb539d07e9d3f9d9cffedff4bf631cb1443d2b4eb8c1bb54d27479f9af883bfcb7055130e945cf1f58556cefb7d43fdd2814be99f96345c4b4112
SSDEEP 49152:iSuZQIY0Be2KNRVtOnks6NMHqcDmg27RnWGj:85dKvi61cD527BWG
TLSH
T1D9C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a165f01b7bbc5f019b8756ba7704610f5f80af5d875d4f6c9b4d233837ef826e
MD5 7b9b25e142a694d93a7b85800c440898
SHA1 0463c3c1e78dea3e3b9a3b520cce2f49d2793391
SHA512 da6886cdd525f7f487a8c73f953488ec0128de8c1787d3ad3c91cf24b672bb06a489e4bfe597ea7b5a3aa8a37ab9788e3df3b88e7d0f069c86b3b63556b64ce3
SSDEEP 49152:AhtSn8EApI0figXgiDn0AP5w7Dmg27RnWGj:RX2iyphiD527BWG
TLSH
T12A95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 90ef23d268e463dfb340329792169de786e1a9dcaf05f71fa82eafd85a78d058
MD5 d3346d57f54dfe3fb7f78d4b1b6753c6
SHA1 7b3b7781b8d5fb6aa2567aecafb8fa353ffb3cdc
SHA512 7cd1f1b795ef8e153997bad1f043bde8653028b7bebcaf908d07be385e6ad2b2e2e6114750f225bfcc362d2a7c3e9f73420de073e309b7a21be7a6d64fd5c942
SSDEEP 12288:nMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BF965C41CAE52648B5C3E5F10DAC073E57E92004937A5B7CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c2763f53d558f38e0861908f4c333aaa5354d8ad01265693d25b02cfcc661b31
MD5 ea5b46d06a18204a431238a662826033
SHA1 65ebb17b22f8860cdf6aa27ed947401d4ac9f18a
SHA512 9b9fa50981feff968abed31017b478ff3fc62970d4f141886ded969301bc33bc7bcf2d1a60284e60bfb289d54ac708ac02509dd23a138c992943a8723c27540f
SSDEEP 12288:f1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BF965C41CAE52648B5C3E5F14DA8073E5BA92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d46e79dc3d9bf6274b200d9d4a8148f4a77d294aa46f895681321f029c7425b8
MD5 4f3b366f642eee5bb6b963e4b5ff03dc
SHA1 ca7813e6a04744681b8265a7fe0087323621a7b4
SHA512 cd9b9ae63dd29695ce4d394f4497605ebd0f3ac177f983df48447875cea03fd9c729f5ab801ea3c4a9933edc1ee964c109cb0ebe6a516c11ada188d6b62ced53
SSDEEP 12288:5jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ddc948dba3e5b5708c45e3e130460c3bf128386c06f43674ab1b86cda092abb5
MD5 eaf769d9e12b3bbea7ddaeb19f750673
SHA1 4cca83cc4d91d0a9f33d5de2136d2782543368fe
SHA512 751e266e397394bd7e3ef982cd5330011e690704b1874dc9bdebc8d44ea0db8e33b3f346f64dde57c69668d096b994a15400988eb1a82211a8c8f57c552f9f95
SSDEEP 12288:HVqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:csqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F45236F675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5fda99872932957e55c365a2c23127c26dcd92b872037a43c4a3e971bbc850db
MD5 1d67a02745481f3edf9ceddb68113330
SHA1 6f0b4bc5497b90a711b08792dfe9df9dd48db067
SHA512 6e520bffeb05746d2a8d07b02c548e76d62e66fdd8f7981a805485a1b04c3f7515567ddf741c3f1cb1e7da5a8f8176df8b85e4f1c1893430c4fe6bcb0fc8253e
SSDEEP 12288:2yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A74523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9b6959e15137fd47d8a50e02efbcb047610a7381956b37bce483532524dbf7c8
MD5 4fbda82b79cae4f656689347abac868b
SHA1 596dbae7aa373df6e4bee5a61f535967f8bcefc7
SHA512 9243072e34a1137efb55fb0c0cea7d9524497b6a34122d275004bd1a48aa2dbc694e5000e75736ba396101b063610c4645b091e9e8482fb9cbf61670774d3593
SSDEEP 12288:wBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BE965C41CBE52648B5C3E5F14DAC073E6BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4cc160a131f5f8e793b33dc1b61e50750c4fb5d20ab9008bc72b08bc001e9a44
MD5 62ba8adae7f9fa34f344ca2718208fa5
SHA1 f4c1ae8dd9a2fcded8edb18d8404613222d6aa5b
SHA512 e087aed235219129ffb0f9dd375f5d7a5089199d9a10e68084ae1aabc1e4483c537c1428d73b61c262e44b78c8ecbaddedf91e3cc8b43947c8dadc8b7b2ff87a
SSDEEP 12288:5dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BE965C41CBE52644B5C3E5F11DAC073E5BE92004837A6BBCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 fedfd1f0b87583f6ed43945260105b5f616dd639573fa88ad2a1d66957bf71d5
MD5 0666e5ba5c58c244b152c29ab10c2897
SHA1 f5db5fdee60327db5c5044ad5c2e625e2fc40a4c
SHA512 462cb616c0812eda2995469e02b4a3c1783484e380e364cef8b6efc9b9f4fec68fec26da75aaf200e6cd45eb41bb34135d4e2743585b7276bc0a04c5491b6f49
SSDEEP 24576:jZMMzFVSOVsqjnhMgeiCl7G0nehbGZpbD:jZMMzflDmg27RnWGj
TLSH
T1FB6501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 08f07c9f5f7906c9bdb9b4f44997656c41d300e9a5834a90d954ff0964d85292
MD5 ab3598123f97647872a2c609146116ea
SHA1 81a89fba65b9f061b6b7742517498fcc74a29948
SHA512 b086a73c80fe81edb84ff217c28d5f236058c41400f553b5de7867f84fa9eca3f87cbf7dc8b3fbb64e0c825b3a976fb792891c5dcc70c26d4b93e329d9b21d75
SSDEEP 12288:UwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1894523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2365fe4ee979ad29ac82a6a7762637ba5167f8ec588c4b2dd14cd1725d65138f
MD5 6964f523f623c667752597501c642977
SHA1 079f1c1c30f24d4266f523eaba4fcbc5bc353272
SHA512 9273c3a8eeb019676f960d3bf2cf0ecd99399cbf5595757302eac5dc2403e4aeee500dcb1631ae05a59b56ac98cee0facd9293a1e332ecacd0bb3398e84872f8
SSDEEP 12288:hEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BF965C41CAE52648B5C3E5F11DAC073E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e0aeb8e3fbe98e86e0b4b5ca2f22eab8c336e3caa6881dbe9b3a63d5374583a4
MD5 1a6b52a5635fc248496d42f29ad0559e
SHA1 9771f093815ba1523985b506b60bef2ff0a154cc
SHA512 9c2fc06111402fa7bdf2184807c7e9f426c601d07bde731a5f319ade77083789155da141b46071047997e685701f3d7c087b2bcb938cde88c6b4dca817ccd9b4
SSDEEP 12288:4yPz5L8ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZzyZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16155125B73A530F9D1378138C5A29A06F7337C3647204A9F17A506BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 29258ea94dd45a933ba522786714e8ef8b0379dac13209ac49389c01b0973a05
MD5 edcdbfa6808e1f52548e8f3c9b968539
SHA1 76d6b04e54baf3bc76f57b1d25e4fd43af574128
SHA512 59f53338abe49e4331b3cd44cd7263b8c1b924e7bad0ddeae06bd8cd61bc18aec363c5f5f14f1affeaf070edb9927f5c1b9d432f20ca69d8c808d4e4b4be3c5d
SSDEEP 12288:IwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cbe5a3da18a5065634427d303fd74c7d2f0d3710eb42fb1284af6bad036b8024
MD5 9aea1635296e962aff46684e96a726b3
SHA1 9d555d68b99a9bf153de89b076b90702708013e4
SHA512 eebf4130844dd17564cc63aafe334472cd7714f120f4828b5ad06405dc05c7dc13b505659b7efabfcec1cbe8b6d383c608be88cb6f67fc6856a2f6cdd18973d0
SSDEEP 12288:NwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 342dcd2d659672574e4e66f22de0942e7a7c9659b4d6ca2b8931b974d7a6e621
MD5 8211ddfe0488e4bdc00b2f3b60f61cd7
SHA1 551c660cb07d73c6287ee4d843a1622a93adb4b8
SHA512 583c507bfdb0befa258d0fd2310c765f4b1c07fa95af5c6067d473fe67f28ed0bf62cdce1541bedf9e693b99acd7ca6767d993e97cba9c27cd30875cff5f22f4
SSDEEP 12288:LyPz5L8ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzyZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B655125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 09a76dfd2db4babe5032b62feea09e609e09cba00b3f2b5418171afaa4702f79
MD5 0d16719ca8168d1cf0b61e919dd85f37
SHA1 99a72ea1d154e5a3ab11ad70bd4e3160688158c9
SHA512 e09ef3b177e044e5394440d5cf58b81fb36995978169f9c3ebcb8840bf8fc232efae49b080428693b2bb5287ea99b3c99613805a047201ef38f5402d71a23cf6
SSDEEP 24576:IT9aLl3z0zDTsqjnhMgeiCl7G0nehbGZpbD:ITQLljaDmg27RnWGj
TLSH
T1046501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 19bf59ee77bb1f726eb0868541172f9b045d9af1c25871f99f6226de56786021
MD5 ee500fbd5149aecbbcc3ae45e6105a93
SHA1 8708c727fe674d374cdc5e5f40502fc30ff06d83
SHA512 56c1d46b90269b0ce0505a9a7d6b1eab380ccc0fed62405b870ab32292e55bb685c5d9bcfc16320cfaf7bf59f76711fe1c5ca7ef2ecb14098c2ea98c2aaa188c
SSDEEP 24576:J3td9CHKy7GZ/sqjnhMgeiCl7G0nehbGZpbD:Ztd9CHKyalDmg27RnWGj
TLSH
T14975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3cc74261fd49e60e043754a1509eec2920a6d2f3bf417dde8c1f50a8dd867772
MD5 049eda1fc7cb397ea7fd619586383905
SHA1 c7a18672842f56d360e8b75869a37a625aee2c6f
SHA512 49ce31ab89f97bcd532894907327fc12d2ebb6bb4979f08f5c4aeb7fec3a9d9d5a1bfdccaa682ebbcb02656d7937c49a717a7b18d96f7c12d7f86e725a66c062
SSDEEP 12288:1DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 99cacf40d688fe991fc1b144da87b8caf9ca3bc73c5544e8863c61dfb8acc5a0
MD5 2d6cf01147baf2f4d190a35f57297593
SHA1 d4d7ba1777abb72b7153ded8a5fdd9d18f74e999
SHA512 5c7a16eb5271126a5bc11dea64232e04d13b94a3f1400ba70382e1464c62e557916a6062bab1b24883406c159f2b17cc2a98876f118d8781e00fdbe376c5f76a
SSDEEP 12288:v5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BE965C41DAE52644F5C3E5E10DAC073E6BE92004837AA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 52a01f269dc2fa81d09545a8f6bf924b9aa716cbce6189ba6e4e2ea1df81c6f1
MD5 5b1469fbc20759de5019d5f9e05828bb
SHA1 d1726e584d4908d4bbf17aadf1feebf82da27553
SHA512 0d270c4606e028a7f35eaa919928518111efa1de4c970297a5ad0b7692b438943157519762ac6cef37ad240625b010f38f83a6d4455f66516496c2a1c2f12a89
SSDEEP 12288:NeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1454523BF965C41CAE52648B5C3E5F11DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 07125795339228d4bee95d54af86c2925eaa241debbc921928d96ea3860ae1ea
MD5 6858d459fb2b4b4dcba52a369e43f3df
SHA1 69b1dc179ffe7a6981f36de1c75b3c2bec60da91
SHA512 74a04440c0fc53bc48bb3f101646349ee53302ef92ac2ea50204c2f5b0643ce722dfc8f152c1ad0ea4e1ff4a5c83126466bc2e9299bbe3124aa48735c11dd33b
SSDEEP 12288:ywXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 35a77707381455f2bf14b425d8d96bc55ba0130c766f849e1dc16b9a5361acea
MD5 102f83a9e662ec73c6965f321841e70e
SHA1 d8102d321e7d8cd7e6322314d50fafeecaa2da84
SHA512 77a1cd8b07ac9b55e80018b99b87519065396e1c9b94bd87ea8d5a2f9f87dd21cc916301e448faf1c48a5ddfce6936493cf27238a15492980d20c2a5ae4dcdd4
SSDEEP 12288:fDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BE965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 39bc4f0b187187b03b1844eb945875fb7bceaaa30d23898f13db35598f6cfba3
MD5 f78cc128d4de0f93710b8c85ae7007a4
SHA1 d0ebfbee0952c88c830c84365dc90f9747339cc4
SHA512 c6948b2348ba3ef30be19ee41bd04130456dc42a220ea5feafeaa5caddc293bdbd7143e3b176ef02cb841e42252e2bf84c365ef1f1c56e022f55c7753dd13c98
SSDEEP 12288:VYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BE965C41CAE92648F5C3E5F11DAC073E5BE92004837A677CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 976d5d0d02e2a508014cb76880f62fd34811f97e268d1034793ebc5ef0f41559
MD5 ced1c24169e1ce5f260e8d07d55a5a42
SHA1 1f11baf415dfd2496fe962c244c4ec951637022a
SHA512 61298a1ff41b0a6ba088781a7d42d8712e095da7419a69ddc9ff01d2513de75b9a81542434a9f3eca35fa23ee30ae104e4eabc16587b230f5f82595a506022a2
SSDEEP 12288:+yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 01572f9a53766763b4783a249cd8fa04f13f2f20f71ab18b61d45365fdf6220a
MD5 5da62403902998a77542902886365851
SHA1 c08e980906dc28fd6a07c8415cb9ce68200dcde5
SHA512 421a3652c21f94a9f75cea724b6f1981220f29dc775069708cad6c7f53c9494131d0bfa1a695803790658fc0d2fa2333d9c1812a2bf3cd6cc5eabf01399696fb
SSDEEP 24576:5fwvok9RX6wkyAIUsqjnhMgeiCl7G0nehbGZpbD:XMnYIwDmg27RnWGj
TLSH
T1E585D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 00dc17e95168202d05a9fe03cb808a5d72fab312ea197d9066d6b697cc4949ff
MD5 c72504484ecf5e13fa3084f0b4cf885d
SHA1 37625569330e1ea2d0c11c971bf95faa2e99163c
SHA512 caf81f117057b58acf682a829074cc297ac124e734c2846be38b610dddd0b7541cf944821f4d7b07ef4a21f7db6794018946f45def8f3d850f7e792ef8ff6359
SSDEEP 49152:3YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bDmg27RnWGj:hySzPjD527BWG
TLSH
T199066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2b0e3e44baabbedb04f67cd1112f1b1df35e509fbdf10b74cee4ff7ca65b8092
MD5 430dee90e91a95a83d0714c9a10c2aa1
SHA1 66f0048aee0b194d9c32d6bd96b38b54956c29c0
SHA512 31150a718891b3060f24fc6e294a7edd6904c1f8bfa2ce3b4dd7a7b87a65bb3946809edd31cf9c8dc086e3a9b50d65c4409fbf9a4ab8acf13c545f3947837a04
SSDEEP 24576:e47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYlsqjnhMgeiCl7G0nehbGZpbD:e47JUQj4irIhCnDHUPfF/rDmg27RnWGj
TLSH
T12465AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0753011816a6ceaddaf22178782e46989ba9b0ca7eedf1cb31266ed1c34370c2
MD5 231c244a200561f1fff695531fd03827
SHA1 d255d5b850534c9ec62a8251353971e14e89189e
SHA512 426d8c1b2b3084ca752be228ca6c2cf41be24a3f050502a52ad0458808e15f45de3dd2a6cc809f7a05529552bfe7eb9a988e3e2533caba1a3e5cbf97c79818c4
SSDEEP 12288:SGsfgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f3888d1881506d752a2a798f415006b40fe2fc1d9f3a97fc0a9e6ca0b7d78c55
MD5 fbdfefd93ab567052c36855127ef175c
SHA1 dfa0940ce159fa847ee2c9d64a20f8f1e9da2a9a
SHA512 072317aacb294c60b6ca334679e36995f663e29954468a2de7ad1075790c7d3adcb9f2d8755b2462afb8f70116030696b7c661842bd8abc83efbf7d01d921b4d
SSDEEP 12288:kVkKU3fDcq3h+fsX05Tv/YXV4pO+Ub8RWWEG5d4zxM:kVrUPwKhS8SpQb8NEGDSxM
TLSH
T1DB451800766AC74FC66D80321E32D1CCAB707D41EE04AF0773C99B3F9576558BAE2696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 e80ff7c0aac23a351ab5227fe02344577d748b5fcb61b92df821e67c09bdd8b3
MD5 cd525f4a2e5b97697e272529b89d6745
SHA1 03175ab11d90c8f07ee8a5cdfdb74bf5047fc1b8
SHA512 77b1a724c10c6aa54cfdc148cf83fec9bcc118f52ffc7bee93e45b51be956a6ffc6d2b55cfab7f47cb35f55d2c790c9baea2a8639ed8ce9f2c4551291441674b
SSDEEP 6144:UwR6IA0naVHK/X8YTNvuNACRolovuNACRoQvuNACRofMvuNAF4oTGbCm/OIMZ0DP:vnaNK/MiBMZ0Dwh2z6dQ2C55
TLSH
T1F3750B405137E28FC1B76032032AAB4D7BB8EC13B7486F16B7C8453AD86AB5591F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 755a3579dc22292262b16f00c853ca133fc59e4bcb5d193f5efafd7d454350f2
MD5 b8b9803ba8b9d00ab936c3f8df5cb1d4
SHA1 e2c76d3c449685612c6f0afde7967266c441e4e6
SHA512 147ff4d7c43cd3850bd96e9eac8bfad682e17a70e1397c82c95ab32871b9f1bb351ad49d420c1a673f169f17bd80d65666b5d39c4eed70f91baa4e68b2bb16e4
SSDEEP 12288:xM7IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE45237B934C518AF83605B482EAE12D681B7E669F1044C3BA1778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cb2cd0a031853bf53dd9dc3885a186969d2e42cd57ce796ea1a83b392fa09b6c
MD5 6999ce31eeb17409c4452626da1de729
SHA1 059151c3172a1e2641979c69be56bb3043e5883a
SHA512 d97f2b8dc25b66a064c9012ec23b77524336a95fd14ed5b8e5aabe92ceef01572649b3a274ca2b0a31186d7e7e7290f0ed3c54d7016f4d398e353e6c4ae6b68b
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYWsqjnhMgeiCl7G0nehbGZpbD:Hgb4mBIBhGFZDmg27RnWGj
TLSH
T1FC659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3b089168a75b82641b33484ae531650e3fe938bec33791bd97b38b62d2bac568
MD5 1fbe9365186962d2547f79483a6cbf42
SHA1 83664d8b7d577edcabc96cf50485ca90ff8171ea
SHA512 1c6fb3c112c10471ec51d986241eeefff389c04b4bf53579751fa535fe9d778001b271483c3cb2a8ae289fa046179d10391d076b5a344772a7cc96fe4f3b24e6
SSDEEP 24576:1G88u8FpJqH1Wzria7/mVsqjnhMgeiCl7G0nehbGZpbD:47ZFPqVha7/SDmg27RnWGj
TLSH
T11885016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f755a14d619e45ffdf34119e29426d283a0a614f7ea809ba6f507304e86a009e
MD5 8c5ec3ae9e0930a571556f0d469a88d3
SHA1 0b8fcd8da9a1cdd3be2824a487c27f7410093dc0
SHA512 33cb5573c3f3cfbc5a66c1cb5031b5b7583ff4ef8a825c887229c6059457318c1ec056c622caf61b418a5198fe12da1133c699504843f3ab760b60ebc3b14995
SSDEEP 12288:tHvUrBFrEjwaQRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:tPUr+NQRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9a8ffd5f3d4ae99d647eb45ba555d1a94b20c3cdb83b08df020916b9e0be14b3
MD5 2f5375663c8aeca12ec57f4bdf7637de
SHA1 32bae0d3658df1fee7fcb03bd2a65f6889804464
SHA512 07a02610425f614e953b222aac309ea98f8163e4094209c2ab7f310d5fa922d9d784335c5c452af8ad1609dfffef6863230dc910d73fed529844519855c916da
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVDmg27RnWGj:NG05lO43bID527BWG
TLSH
T109D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 509a687de92d7074d171149d2c691395da3f24584508deb6fa617f94bb2499d3
MD5 9c48cc646118fdf535195142cc1a5dc8
SHA1 57509818334798d5dbc077535a363c53171ea220
SHA512 d3da55d2987872f5fdf61f79ba727ddf3ff6479559ef3b5495cc45811b71a16e7e42b7c3bceb4d6fd9168f66e5425acfa1890fe6ba08c02711655a943fd981c9
SSDEEP 24576:Bfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnHsqjnhMgeiCl7G0nehbGZpbD:Ba5POZ39Jt2pasx2+m9Dmg27RnWGj
TLSH
T1B065BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6a299019d1655c7824935f0e6a5df3e6bb5f1a99740503ef6cdccc1b5c09a87e
MD5 ce3f9b402d221725cde909ab860a98d0
SHA1 0832667931b68b989c4400f8f5802b47150de2bc
SHA512 2fe0f3c464f67b1ce92b794df77704e2cffb0ca9855034a9922ab23506d0905f64dbeb7d61720ed93a9f64290ef26ef23174070e35a4ad21cf44d35fb3761bac
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkNsqjnhMgeiCl7G0nehbGZpbD:eNc/zEOVHFyDmg27RnWGj
TLSH
T10A857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 11e75d2fbad1e3ebc9ab0cd2f01b933e77f9accbf1c1a419ba5b6afb1bba1788
MD5 1245bb32a7bfb15d75179d6591658c69
SHA1 5716f1457db67907c1b1a1918dc4767e79a176ae
SHA512 65f4feb35a674a5c43cd925fd7cae50c20d3204d774b0db4ed6e466d4c62b048f2a4490523e0513ed98bd74174f7c7dd3a57b603badac165e27bc014a61518ae
SSDEEP 24576:TtkNvNnaFeYhJNtmZBm7sqjnhMgeiCl7G0nehbGZpbD:TtMwBtOmvDmg27RnWGj
TLSH
T19455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e492ec1c63a77f17e15ee41e4acbfdd2b76d7663ea46b2949dab387d34894e3d
MD5 52dc583249344d5fed7b623a02c6449d
SHA1 d307509e2b4902724f48b930ccdc8b0df98b0c38
SHA512 691e26ea14b0842574f7d1d369bd117e9de7a421822832744248c22227f5093f31f50f577a0824c772b8aed5350dbf286dc1793943bff336143c64c0b7c98f7f
SSDEEP 24576:BD3FHshBIYQgAssqjnhMgeiCl7G0nehbGZpbD:BDVHeBIAAYDmg27RnWGj
TLSH
T1AF75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-284-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1156-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1156-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1600-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1600-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1600-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1600-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1916-1-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1916-7-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1916-0-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/1916-77-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/1988-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1988-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1988-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1988-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1988-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1988-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3364-52-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/3364-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3364-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3364-45-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/3364-46-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/3364-39-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/3516-133-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3516-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3516-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3516-136-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3516-127-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3708-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3708-115-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3708-121-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3708-122-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4556-308-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4556-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4556-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4556-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4808-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4808-327-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4808-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4808-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4808-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4808-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5012-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5012-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5012-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5012-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5012-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5856-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5856-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5856-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5856-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5856-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6004-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6004-80-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/6004-84-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/6004-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download