a76862ff665feb7f7ce9526bca125a8b0c8420b8e4c5f0aa7246afde5a7b48ca

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260727-m7grva1vex
SHA256 a76862ff665feb7f7ce9526bca125a8b0c8420b8e4c5f0aa7246afde5a7b48ca
MD5 d84e0f2def7a7d4e8695aeee18e65672
SHA1 9344ae4b65ae386decd6cd16af181eb3581fab96
SHA512 05f52e60e5abe2bf2c6f4693f7a9af9a2f32e67d25afb7daff257fcb2f94f2c8ec29d5f21632c78c2d48eed10996247d9e1bf67000c6dd2d6971f9bfa407c1cd
SSDEEP 24576:P0/C6CdH79Us2PtOsybpjwBRxSgo0xWrFni8+HNQyM7OUZIq:P0/qsa2BGgkrFniJHNQyM79eq
TLSH
T14B45E116B7E401F9E0B7D179CA468A75F7B2BC450720A78B03E496562F276A14F3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5688	elevation_service.exe
4328	elevation_service.exe
2252	maintenanceservice.exe
6280	PerceptionSimulationService.exe
1564	perfhost.exe
4120	ReFsDedupSvc.exe
828	SensorDataService.exe
6536	ssh-agent.exe
4544	AgentService.exe
4464	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6a3d82d957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d52e53fb81ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081a28505b81ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006b15b203b81ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac754702b81ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084bc3602b81ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c329b04b81ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef23a603b81ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4544	AgentService.exe
Token: 33	4464	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4464	SearchIndexer.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	6472	2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5688	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1064	4464	SearchIndexer.exe	102
PID 4464 wrote to memory of 6680	4464	SearchIndexer.exe	103
PID 4464 wrote to memory of 6308	4464	SearchIndexer.exe	104
PID 4464 wrote to memory of 3700	4464	SearchIndexer.exe	105
PID 4464 wrote to memory of 6420	4464	SearchIndexer.exe	109
PID 4464 wrote to memory of 5400	4464	SearchIndexer.exe	110
PID 4464 wrote to memory of 2524	4464	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_d84e0f2def7a7d4e8695aeee18e65672_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2252

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 16d821eef98626c246713e509bcf227d200054b67addabc647a702b99a03e891
MD5 29e3e7be5658e7b91fc2a4c7c81e5ad3
SHA1 d553b6706ed65157f499c30a1ff9973f3e157a5d
SHA512 c76be0995d368a40819728265d92b6c84336051c3404a8b25e59f8f1dee6bcdda4d2bc4ef875406e58eaca4c0d878f464984327f382e53fbbe696d2000faaf8d
SSDEEP 49152:8b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxBGgkrFniJHNQyM79eq:m3q6sjB2BdcFnAHqy89eq
TLSH
T1D8D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a2539aa0434cf8b55d9a7b12865507952ee21946960c04a8bd0cb1c3b8b0d13e
MD5 1bdb34ddfe95ca2cb37a4b14a0acfa4b
SHA1 ffe8f48e8c7cc3be4a30f3dcb784ed473b88ec22
SHA512 4b3bce0dc861665c18177c1b9caf8df3ba891555ae9f4234e36b40391b03aef3ef0698ad81c13f2537c46acc16fc7658df320fba46a3df494f96e5e6addd2399
SSDEEP 24576:oXYfDtczARwBRxSgo0xWrFni8+HNQyM7OUZIq:/tcbBGgkrFniJHNQyM79eq
TLSH
T132750138B3E409FDED674278D8A2C415E633BC914760E69B03E49A261F336D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8ef081e4b538ebeadb34932581b9bdffd06e24127d79b0dd6fe77c2ae11c25a0
MD5 c454191dc8ac26d8d7710db36d6ce46b
SHA1 71f6f83eb4a185dc1ba0f7c833d2a331e7664935
SHA512 9959b301956896aeea3e6cfe7bd70a36be75dd6229c4d98ffc52914ee3a8f9f00c416954387ff7c9708434b6cb9a828671fdd8f86d98a7ac62f4224257a5477e
SSDEEP 24576:H0Le5ji0hmxxrMMwBRxSgo0xWrFni8+HNQyM7OUZIq:HPji0AjgBGgkrFniJHNQyM79eq
TLSH
T1E995AE26F5788775D073C0B9C5D2A68EE97130825B3089CB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f3b452331721772b9f0bbd042a31eb2b6b24071e9090554f3f121102731f91e0
MD5 994c4b73fe65e10bdc65e9a4c045910c
SHA1 79128a8ee3b45fee4b886ae6d0426a266d498822
SHA512 50a50383f63e51b980cbe64578ea2a3f2b16c46873186d5d5382c4ee6156a3bffe73e6cc29446408a5ee7b9bd4f95568e4d12f9d8a25eef84285effee30ea7ff
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuWwBRxSgo0xWrFni8+HNQyM7OUZIq:M/ezSC6vUzPveHjykBGgkrFniJHNQyMP
TLSH
T1DE755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ce3471c7d09b0bfcae2926bc2b4b9dff19e20f8f0f74fa0f14edabc871ddccc8
MD5 f154f9731aed201633972b17bbc67558
SHA1 a5c87d07d51a79b9601d2f17ccf712a166ed2079
SHA512 56f4d835a19639d44388f321e360a55edf9afb6653956523abceac4d6727c16fec59c154970deadbea00160501859ee9df988f142b7af9afc5cae82088262c2d
SSDEEP 24576:VVbqPb88hv/l+YdwBRxSgo0xWrFni8+HNQyM7OUZIq:VVO88hXl+jBGgkrFniJHNQyM79eq
TLSH
T10E559E66F5748331D073C0BAC4D3AA9AEE3234415B318ACB1246D76C3E67AE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 eae3972bd9fc5de459119741dbb708c35b00e112b37ae35a515efd7039da111e
MD5 bd92090767ce2b572d6250f4144dedb8
SHA1 7f69354534ab4dc5b78e728225dcc0269fc1f5db
SHA512 ac67981955d547c4918ea1400d270e66d986869f1427136aded5cc5495a3dacd676fc13f5c3b70e4b398d256bc1148c7ac78d9529a00e760197d232e87c5eb28
SSDEEP 12288:jL4M9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:jL4wBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T10D5523B9E05C1DDDEFB31E7071DEB888D218ACD04B41183B736ABA2A167D836D853167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 932113f35174fecfda638e81c73155bdd07978f8384efe37425f10de09ace8b9
MD5 df77eb50363b3700c73f44284a1b0c2f
SHA1 e349d6c14403ec39d87296140eae84392dea8652
SHA512 07bc51c599bcaf4cb3e92be80b46d92a3ba7e5e6ae878764b1fa93e558053931a899af6f6a841de22a4436f5304bb9766769cac23ad7b1e37a49d7fb4c4251e2
SSDEEP 24576:lJIUlwBRxSgo0xWrFni8+HNQyM7OUZIq:lJIUOBGgkrFniJHNQyM79eq
TLSH
T1A275CF3BEE28FCD2C27A4DB856918640D77278704F62A3CBE175830E9E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 675660a9a1edf7627fd9eb53077cf1340483103d0534a05070fc44e4414c0c7c
MD5 37d0b86162dfbb1bcf19a41d2774e932
SHA1 39c4f7d49ed37811fcd67798b64f45c92b0b81d6
SHA512 02f98d532e728a7e33e027daa8da9864b41ce7bb8aae9047cf7a4d8a8ce6df52786244e471ed528f8bdd6623c5fce03b5e154956b1be1daa9f98c0d59f39d553
SSDEEP 98304:QQvGAdlCEL8c/DRNw5C7BdcFnAHqy89eq:FvyEYc/D3w8fpO9e
TLSH
T134266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 bc48512123d9ea4138e1321697c4736da83ace690d6eabd7e510fcf23f77559d
MD5 ab28e2522da96ec5202bc171de4dda91
SHA1 255bfd7c9fbfa3a410d10c44a57393d71d7f44b5
SHA512 64ddd5e955592ef339795455fab418c27fea6670c23612e914bc625e10e18e86c66b82a600dc78cb2087f149eb0a9974861c0c96de19fed0ba1068a0258f4fab
SSDEEP 24576:U0ewsAjHwBRxSgo0xWrFni8+HNQyM7OUZIq:JljQBGgkrFniJHNQyM79eq
TLSH
T11685E031FA74E436C7BB0DB22B26D706543CB9604F5119C3F3A89E9E5A301D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c9c9ae79b53469c415f33f93bbb9c2d3f3ccae87084be476c75c3b9e89f87ebb
MD5 884a3a879e68d15637b817f8b924427f
SHA1 81e734b758f40cda42e419fbac800aa07bd864c8
SHA512 d7af3ce4c450907039b7a52bc658207dfc8809d4ffc3640de20be3cfde54275c8a9205dedef0dd84f562ad31cd801f05021cac7aa63417343505f286f64f7f15
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSpO9e:6UEtQevvqc2W1cpV2tI32kO8
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 870d8fc477ac4bb059f7b32afd39e21dab7eeafa3fd20b0cefbd160e9c648ace
MD5 f7484c64a87d4488f48b00f1fe17d319
SHA1 3d4f3460390321d857a851a5c48fead4139f8eb4
SHA512 978b85c0f75f686abf9f5a7531b569795f19044a4f702729aa76707280b6af0d9e5ea6242b5cee4e90684d209531d7998f9240a33bb50fc13890c40536350876
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zwBGgkrFniJHNQyM79eq:xoq2Vjnm/BdcFnAHqy89eq
TLSH
T187D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 884fa5f95a3b2a56cb9aef154421aaf2b66e4442d3d9bd9e9e7f4c757856d4f1
MD5 d011ceec9e1959859d3f5bba1ede837f
SHA1 20e46a19daa21dc687fb7386c811a9f60b84170d
SHA512 43707a11b392e93dedba1905a08444496922a46fa78d8d3bca4fbf6a6e8219707fa57ca067adbaa38d756cffa7262e494783204a6b1212bc187e04d1e004dcdc
SSDEEP 24576:EAhGL3IFoiwtA5l7S53qwBRxSgo0xWrFni8+HNQyM7OUZIq:EAMUFoiq5vBGgkrFniJHNQyM79eq
TLSH
T12335AD90E7F955D4F5B3AAB8A9B69070EA76BCA55E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 45cd6da00cab6352d2904cb52a6fcdc3b84142cbc6777b7b3d15193b859f6b89
MD5 aa9c070144d1992831afd8db96211713
SHA1 433ae38ddc11b22df41bc9da9062693299de3074
SHA512 03f8377d38c92cbc36eca90abbe1635ac7693563ea2f6bfb29c06a793739d3c117eb59e2f186d0a4518109041f6ef30f9ff5682b9335fb2f5cc7e79973854985
SSDEEP 12288:GeZ1IyXM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:bZuUwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1626512BA72A824FDE6B30678E5EAA548D3317C91173203DF2225536A1F379D25C36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e61d40d5c3bb3611b02c80920a71fb04952622fb57f66c2fc4bcbb27bb69ecb0
MD5 beb0d41cb3e33af3f6a9ef660f5e3c98
SHA1 1896670c6a8ae0f507c379254ee55d125b051d59
SHA512 96f22ed785d9eb67d72d0fe3bcd74e4e843f96c5bd8eabf0a209ea6dca9e01cce30a2a997d08e8e097c8cec71745c581b3e134857c59e18c73ec3170fe47e678
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3yBdcFnAHqy89eq:1QyiKa/X+PNgpO9e
TLSH
T13F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4e9f6532629e95b637a2b821670737b9fb5f97f620e348ed9fd01f9c36b5aac9
MD5 26858864caa7d02fcce796efebe89be0
SHA1 e0110ff5158d4e10bf48a5bada80db73e7e083ac
SHA512 80f0ee6466b7694b4f913135a4ac0329da625da7153b24f20573a44e51aa92f8602c94680c8fdf68123048264a0785bb1534c4101fdf0b9fe78ac738c70bafe1
SSDEEP 49152:M68Qg55nhceWu7PNU3/gBGgkrFniJHNQyM79eq:GthLRc/gBdcFnAHqy89eq
TLSH
T13EB55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5e44cb13ceca2093a19f68af0a5f956a4d2cef720a0dcf25a6ec6bcd171a589e
MD5 4db7b87a4e837cb6067a80abeb6af9f3
SHA1 0132b35a3fffd70e62e060a17fd103e9fe1db56b
SHA512 3bc7fe187e41c4df115b6eb7a5e88ec9c6dc6227a045a6733908347bb20f5cdc98677068ca63fe9503b395663ed3c52fa4ecb1b591bea8b5d6351184fafeaabd
SSDEEP 98304:Cy5112gYy5azzVvt69nLKnhZ1BdcFnAHqy89eq:LLIHEWhrpO9e
TLSH
T190167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d827db243fe9aef1be2f9a336ee7e6846a951722efd3cd4fa8269ae1539afefc
MD5 edaad52d9c8c0fc075e5a8111437ff67
SHA1 0f84d7214cf9fde771462ba227a5ce5505d4a706
SHA512 45c22f195783f9f9cf89f6a0bcf83ffb9882d2bf9e3c571ee803e8735e28c2c2a63f99a2dfb9920f5a1e82f931ef39a7f3c9f8e3474bfa0ecb21948e3c838d53
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glaBGgkrFniJHNQyM79eq:6u6Jmdxd2daBdcFnAHqy89eq
TLSH
T1F4D59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 faefc7ffac436e25053702863098e8d54555d77676795425e8722a633583348b
MD5 fe81877a11f803beee3668438cc0824d
SHA1 cc5db9ff3c5d55fa3b5ce4bbc965b76759dc5cf6
SHA512 ef7b5b200f6cf583f0e1ac0d46b67c46eff48efbde37f37e8df60f7744102a08bcce7583aa6e73abdf6b0a9ba317f8d8096b7f6af35cd877a1ede7ccc5ab81f8
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xuBGgkrFniJHNQyM79eq:RmifPWR/BdcFnAHqy89eq
TLSH
T1AEB5BE13F2D901E8D06ED178875A9232EA62BC450B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d6ffb24fef98b78474489409a35841b6b7d485391a03e893e64efc0e22493072
MD5 a990c6e18d5feca6f451cf8974b75970
SHA1 f3abbf1cb1903502219da619f2be51349e7fae4b
SHA512 c553872e9f87edf041bb66c6ac676ea0a9468e0dc7ea1620401cb2809674885b72c9eb1262872b2eac6f0b09f997d2780acb93ee0e61e0f53f388f7d4757309f
SSDEEP 49152:ESuZQIY0Be2KcRVtOnks6NMHqhBGgkrFniJHNQyM79eq:W5dKii61hBdcFnAHqy89eq
TLSH
T103C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6eac791c1e9bc61113c59bdd9545dfc116e27ac6ad3df8e8649562378ea8369c
MD5 3d8b305d6646055c6b51f41572f66136
SHA1 3c4870f9ab4650bb49fe208a2a5232a562e4fdc5
SHA512 2bc9471a2e4e3c123679e34a1f04a37ca56db7f0fa0b6b957b33d794ae4b4bf2ba0d770a396eba6c1b85393cdd23f1ffd306e4a7b82f638256c69ce8998ec00a
SSDEEP 49152:mhtSn8EApI0fig3giDn0AP5wKBGgkrFniJHNQyM79eq:nX2imphTBdcFnAHqy89eq
TLSH
T16D95BE13F2D901E8D06ED174C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 c66c7bd56123de38f5021497ac02106e73c4a03a18817851e61a5fa92c795389
MD5 6d6178e7dede7eb30012b47d432967e7
SHA1 83678c92d7fc1e71aedadb1e998610717fdbc81e
SHA512 8228f3c52314d61a2a9b22172020b99695a9e5ef1288a72fe9402381b41a152b0ba14658b5dc62dc8aeb7dde0f053d9caed2944cdf1d644e409931a907caa91c
SSDEEP 12288:sAM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:sAwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1955523B9F06D1ECEEB631EB0B1DEB488D21C7CD09B42143B736EB62617798325813566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 f78d0c8299027ca4a3d9139edcd1f03a7841f448c8524f47064984fd768f88f5
MD5 25db56116e87c6fe9de849fb042b46be
SHA1 cccc8c1f47dd1d32d2506e0731f17496ca1a0db9
SHA512 1b29e5deda833b1e3c15e45e72f244747e7a0d25cce0b8ee802e094492a2e4fba49ce6ddd3c9c12c97854adbf6c15ffbdf9ffa059b3481092473f8f077af4002
SSDEEP 12288:YjM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:YjwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1E95523B9F06D1ECEEB631EB0B18EB48CD21C7CD09B42143B736EB62617798365813566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 40fcb564a0bd3278a25c9ee2d9ab83e69a2aa0833a5e82116a540d2f221d67cf
MD5 4174daf82a9ad094cc254431d99a5e1f
SHA1 acb96a1fba9a76df6545c166b39ea993bf069a20
SHA512 d7b5a7c40a1b9df5c016dff4fbc89360bce19b87dcd74a23aac8811c1c6a24f31c1681bb2a7448b2edfc399552953db2580150d72d35795d6f932bda9e6368e3
SSDEEP 12288:BNM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:BNwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1015523B9F06D1ECEEB631EB0B18EB488D21C7CD09B42143B736FB62617798365813566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 232e8b02b9eb1aae498c1cd8b38b563366f3e2b4a01b18bc4fd1b5c118fb99c8
MD5 29183977cb2b3aa6a1677f4f3ad76364
SHA1 44e357e65e9f2d8468f797004ef8508acad5b1f6
SHA512 cd527d4bfec77a63084a0ccf91f570a03fc07de74adbdb1a2ee5ba1677dab5a46760d9998ef4c120044e3ad01d3933cd21ba63480a9d5aee2ed0be45086c484e
SSDEEP 12288:kVKM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:pwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1E2552375F16D19CDEEB31AB0F19AA488E338BCD09B22143F7316661A0F755716C32B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 690755d78b931d32f2098f8905617093cf26b0bd7a10c347062188e9d4be67a1
MD5 8295b19ce36cf2e74a8d6cc37418e2e4
SHA1 a8db261cc0ca09ef282ddf87918252f9ab39a5bd
SHA512 0c744962c8ecde60e5f5a890bf970c3a898fe78c529aa8b23f06bb253548806bbbc89fa1687224077f6dd4423394fa2d0d7127eae1eb837509574188a141561c
SSDEEP 12288:eCM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:eCwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1CF5523B9F06D1ECEEB631EB0B18EB4C8D11C7CD09B42143B736EB6261B798365813566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 f1fa7366cf909120eea97d3cef090140c514e77be424e4e97802dbc56e052a94
MD5 9b6bbc7c61fb74bc7eacc16d4014746e
SHA1 b6057cc78f4c4877c00b2ed272cc210be179c74a
SHA512 89204c90a2507e646f060bc9aad66675c3057066733eb5dbb9de53dae27a8cbd956a51d261e45561ed2f68c6e963cafe8329944cf443e062ac814442b46c576b
SSDEEP 12288:8PM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:8PwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1F25523B9F06D1ECEEB731EB0B18EB48CD21C7CD09B42143B736EB62617798365812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 77310f64004351831ff089d6e9e823b5a332f9e84b60cd89223d6e0f819468ae
MD5 6b3335a18e4a23ef21fe6f01515cbf22
SHA1 6b69583c67a73da1a26de3ebf6c2d5035d34cbae
SHA512 ec93bda5d91f844b9405aa6c369c52fb67ede3a192c8e72c79388862d6c00132fe921bc13d7a6a6519565beaea1d405b4972c6e2ea066ec7270893f9543188c3
SSDEEP 12288:w7M9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:w7wBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1065523B9F05D1ECEEB731EB0B18EB48CD21C7CD09B42143B736EB62617798365812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 810445f738a9bca185be0e1d6f8968ec8b831a674cbbf63285efda653ec8fc81
MD5 44c01304b1a9c45ab0cfda526444427b
SHA1 fabbd02c7152371a8c07c43d38b0666cecab8c33
SHA512 7dea9b26713cf9e1455c42b9e68e461a735fbe2079c7ac5680ca02be868bf77f6bcea1dab506cd41b76419fcabad5898ef2776acb887c53227b3b27b2f537f01
SSDEEP 24576:fZMRzFVSODwBRxSgo0xWrFni8+HNQyM7OUZIq:fZMRzfIBGgkrFniJHNQyM79eq
TLSH
T1A07501B5B3A01CF8ED634639C9559905D2B27C550B60C61F13B8362B5F733A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 2a63d6708790975582e3d61a0721765063263cd61f3c201f90a08b4b12658c51
MD5 49ba5785b171aeb0ab0ad8960e2748ce
SHA1 c27d0f8cb71570c207b13a01d35abc6797a78fd9
SHA512 f0b2c4c4c454e82bd0cb3a60f06c146f07250abcfdbcdcb8c011a67d2482fed7c50848d85a728960e26f600a8481dc6ee0986c2a98a2e17b62b34b7e1ef20171
SSDEEP 12288:6kM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:6kwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1045523B9F06D1DCEEB731EB0B18EB488D21C7CD09B42143B736FB6261B798365812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 a14f5c001234af8251e595dfd1ec3a3c3d0f5021c4bf9ac32ce74b72c8ed1db4
MD5 34464d75c7cf678e85b54ace44e08e87
SHA1 6f6a7565dd774845096df407775f7424b14d96b4
SHA512 c58e572bf64d91e645cb6b5d511cc630b34b5b6f66b9ae63cb773ee07a696c01cb1ee31babe7a7e10d55d03306569919c2d9c4ac2381c475b7646bcedca65973
SSDEEP 12288:sIM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:sIwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1545523B9F06D1ECEEB731EB0B18EB48CD21C7CD09B42143B736EB62617798365812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0050dd533a2cc78c1cd0d67c56fd4e8d2d23e4566bd728ecb4d56908d7429551
MD5 678b74cd527d8bd72d09faf95e8375d8
SHA1 15e18e39d380562c4d62e30692bd086939e53dea
SHA512 fb07225032440310498a2efd59082262cae617e1511c469e3058cd41868e9bf1a14a8009674a29f24b7a0560745adf3bc4b909b3c13913ce781e24c352a6cd6c
SSDEEP 12288:YyPz5L8XM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:5zyXwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T10E65126BB2A530FDD6734234D4962905F335BC714B208AAF23A457362F376A19D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 1449ae2b05eba2e8df2be27b46a9f778fb3f694d0605fa753db55d6bca87c7b7
MD5 59c6682d21fe467691949bcba9ff05b3
SHA1 5e43efd1e072ab005c4cc9a7e4851961b74e05c5
SHA512 633bfc4f9c6e65ebeb90af2e66cca588156c6c8e5a3767273755a4e773528d2536134bff5c0250b7ebd90cb9c2be3ac4bd26d20bd42b49d2c90730f0696ed061
SSDEEP 12288:KkM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:KkwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1755523B9F06D1ECEEB631EB0B18EB488D21C7CD09B42143B736FB62617798365812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 49496e68e28b28e2d46941b709940cf43865864ab9a06737d2cfd1e99380c527
MD5 ffd808db3728655971f3d720b86c8dc5
SHA1 17b19ffcb1c903688e7f74e785855e5f3c8824b0
SHA512 9ebce3abb5fd47f9187d5f85b92c181e4ca55626fa2e6cd10204df2b0e971f34a16ad3f603b01cd8fbc24a0f47105f8f6775963dec3a0bb4d1927761bc0f2044
SSDEEP 12288:gkM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:gkwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1215523B9F06D1DCEEB631EB0B18EB48CD21C7CD09B42143B736FB6261B798365812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 584663577776f570c00d0aefafd2cdc1f07b18dafd0532428aea485738a6d673
MD5 3cca3e128cf026bdd2e516a7bb2ede00
SHA1 f8faf44ea9d257655008e305e81607883b5a61c6
SHA512 e2dff34ae4f2a1e58d8d781293f44c1071c50a5ec6b160946315250346f9e98812eab2c611f22fe2ea5bae5b0a24cbca5e13c2ab0a54626dd5df11dcef299492
SSDEEP 12288:gyPz5L8XM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:RzyXwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T168651267B2A530FDD6734234D8962905F335BC714B208AAF23A457362F376A19D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 d5e50d7199758d9aca7463ea544f027d14a3089b84251abe91bfdabe0084bee6
MD5 7cf01ab59969b37fa6485a1052b484c2
SHA1 42e30c473305fe9e66eb91acdd94da68de98ab5e
SHA512 98b92113ed2bdd080e5864111d04820edd059897825dd58038fa189b0f93671d4e18ab6063b20d6f31aa51adbcceb7c5f576912870e96979f0b085826d7df01b
SSDEEP 24576:cTDaLl3z0zD9wBRxSgo0xWrFni8+HNQyM7OUZIq:cTuLljLBGgkrFniJHNQyM79eq
TLSH
T1677501B5B3501CF8ED63463AC9569906D2B27C590B60C62F13B8362B5F333615C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 141ca25cd026d1bad8ec888ee372275f465784d0c8152e0390da6c7c07d29c51
MD5 b207ca0123923b1e45bd321192ddb566
SHA1 5afae9200fa1372e59d9a86d703fdad14bb7c7e0
SHA512 d2ef4d328e0db44745ff28eb6d60bc936737834619cdc849c439bc1528df00c4a040173910aaab1d22c74a8802489c6435555ad8bc0f3243fd52b5068b46aa59
SSDEEP 24576:B3vd9CHKy7GZZwBRxSgo0xWrFni8+HNQyM7OUZIq:xvd9CHKyaIBGgkrFniJHNQyM79eq
TLSH
T11E85CFA0F3E414E8F1B39A35D9765511DA767C991B31CE8F03A8261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 9eb0e5f4ab02ca8f78a9bc60952cf4074303f0e6d5ced9ba41c448f0e03936c2
MD5 b6711cc176fe230f87cf3ae8818e2fa0
SHA1 bc3a16f325bb63ab3c34ea09f5f35f43c5cc4c80
SHA512 42fb49e1a95cd3bd6f7ddd839a3baf2f69803f23848d8809b1d4f621f0dc9e2cb68def05818b2079d60518b7f4b516838511ed69b01bf42992183053c0290e3c
SSDEEP 12288:6tM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:6twBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1645523B9F06D1ECEEB631EB0B18EB488D11C7CD09B42143B736FB6261B798365813566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 9b1b8ff6e7a36964a98ee3877e55557b1ab18e90c93a22aed24c6db0c5bd85a5
MD5 66b5532bc3d1b550622c7eac5891f64d
SHA1 3d64609fef3fd15cc45e208ddf16744d0ef4dad2
SHA512 c94d9d3ee71159cca4b9b15c6d9212508e4e484a19534bd6971a0a14902afca1015564b62db0dd0f0d9b353cc50bb5d8523094954bd64af6059f9437cbde4e89
SSDEEP 12288:k3M9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:k3wBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1FB5523B9F06D1ECEEB731EB071DEA488D21C7CD09B12143B736FB5261BB98325812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 38dbc34f1ac8247a339541cefc7608a4564f8c1e38377f04b124c40016bc00c5
MD5 9bec0fcd07bcc4661f9bd110ee0dfb33
SHA1 8a190ee1736cade88d79a87d1e51c4a4c1be8f8f
SHA512 b4f30246a399416d296fd8594ebc4b8fcb5843e43b7b8389dbada192239e84ddca40dc631950407f7b9ad631067e165c0539ff5e8261dab340b3719e7338976c
SSDEEP 12288:YOM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:YOwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1CC5523B9F06D1ECEEB631EB0B18EB48CD51C7CD09B42143B736FB6261B798365812466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 6e81ed1e7248d3ccb3d1929debba986387d11eeadbdd079459550b2f7b2ed621
MD5 b04f56fddabf738da648d2fa8f125e71
SHA1 7e80e07fc6db8fa6a15eb9de911b13ee7fa2d9a8
SHA512 690ee654dda28b5968750505a590bbae43d3e77f9adf1ec0515ede6dab152dba43d2f792b32daaf93841cd75f4efdfe3ed071b4d8aec550916c8b1678bd7ee0c
SSDEEP 12288:wkM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:wkwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T10A5523B9F06D1DCEEB631EB0B18EB488D21C7CD09B42143B736FB6261B798365813566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 b23e6c9a8e195de6631e7401b9854ad0ebbeabbe3e2239213d2b431eabd6296d
MD5 262406df842bdbb6f90792ea563fc3c1
SHA1 c42ad60b67aee36e6fbaab8f5678e85c95540401
SHA512 a1a00bdcc171686244cf6a5c978584987b09c3d69c299f2d5084e1fc6a7727129f5d909a09f8331c42671ac62c9f6399722df793d135826bb48464ab9e21e98a
SSDEEP 12288:utM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:utwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1F45523B9F06D1DCEEB631EB0B18EB488D21C7CD09B42143B736FB6261B798365813566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 999a66f85081b878eaa1a7f8b83eb6ea5b1d534a90f1c9fb39b9f11e3c706989
MD5 a1e1eef034f56b5030eb90d3ab3cd5cf
SHA1 8bb5a5ef3c7dbfae47e959c4fbd92250b8c40dc2
SHA512 aed046bd43f7a36c10020b66ada788561fdaa7bec71a769421e5c32fe03a5b3bc0b45c4c773ffbfecc628c890ac05ff236643fc0d42253c62379c75191edd677
SSDEEP 12288:58M9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:58wBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1F45523B9F06D1ECEEB631EB0B1CEB488D51C7CD09B42143B736FB6161B798365812466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 33a09a983afe3bfdcead6174e5267d151408b286a6b28905d5c012d2b4ecba24
MD5 8f2c32ec106135a6eb8184e9d0cc120d
SHA1 b14e17c93107041bd10afcdbf58605919addf32d
SHA512 16ad8d1cb734448cb44ddf47fde4322882f66652f1415bdf846f7e93e767b7e1ecf9f520d92e6266f3903876a845fad208f2ab8dc1946d9d01db6fb1abff0e9d
SSDEEP 12288:1CM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:1CwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1A55523B9F06D1ECEEB631EB0B18EB4C8D11C7CD09B42143B736FB6261B798365812566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 c2a037ff3ad777f5e483a2a2d95c0cd76d924c35104c86e4db19cee16436241b
MD5 c774b7820f28d3595f37fe0451edfed5
SHA1 93b03ba2e836b580a36557836b6e78ce3669f1dd
SHA512 2d37788be9eac50d3eaa5207f063851dced0897194a355ece506ddd7aa5404ff2903a1692181733e757d03e45a592a5bc550451bc017a5d0617ea1f907b0534a
SSDEEP 12288:J1M9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:J1wBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T1E05523B9F06D1ECDEB631EB0B1CEA488D61C7CD09B42143B736BB62617798365813466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 b791aa3b30095526db0c01fdd0a5035f275082c9176fd0df8533be7acc5d672d
MD5 b2ec7f71479381e7aeaeb9d5dcc19f17
SHA1 d5fa4ca1a9e8db16f83fed780cd30dc2001950c7
SHA512 799c967192ace4ebca37abb0aa5bb884e5464b76cb6773dd2b032bff013d47562683dbc4f4b5c7d9c8ebbe4660990f0b3b6100f01f8e622f41fad43b62c76665
SSDEEP 24576:gfwvUk9RX6wkyAIYwBRxSgo0xWrFni8+HNQyM7OUZIq:UMnYIVBGgkrFniJHNQyM79eq
TLSH
T12D85CF29EBDC08E5E1B7923C99B7460AF2B178581B31C6CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3fc3d40d464351e8a5bee0d6379e1db13500dda0ce22cf3fb17d73122e4f12ab
MD5 fb0b56afbec6608c74604773a4daf52f
SHA1 2783b06aa86c6b797ec108956c97ad6dc6dc6af6
SHA512 ef8c0977b6f7d8604afaf1f9d5b7ff2a3d1c61619442d44d110ce509e677dfe401ea3f5b1fc94c6bdb911b9c488eec06f34cf6511d305d6a21f66d6df56d3244
SSDEEP 49152:rYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qBGgkrFniJHNU:uySzPSBdcFnAHqy89eq
TLSH
T113067C96A16801D9C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7da7cc5fd20b77a6680fc8625ecdd41611956e226939e9931094306b515949ef
MD5 5ec568d3673a865ea964eb3f4e85d295
SHA1 50253d4fdca8c1254cad0833a850eeb6d1dac7df
SHA512 9def26efe40a1d72e50f1cbe0fe480b626c3d564d86e82dcd1ee8076e301d24aaf66e76d0059937c31fbd03e920879bf59878b4a18710d4576a8aa45fdb153f8
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYTwBRxSgo0xWrFni8+HNQyM7OUZIq:w47JUQjTirIhCnDHUPfF/aBGgkrFniJK
TLSH
T16C65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a881fbf947b4f90e1b7075855898d7f70491ee6bfffc0ab15082d7f36d3bc432
MD5 dabae5761786dc92e2477ed3503ab680
SHA1 0edc52780b54cf88a0e9aaea5d816f134b4d22c6
SHA512 7aa09326e15ac424d6b27ffc3f300b7fd57c3f13b44b98955a64419933e2ccb4454d8de72ff47964ad39660801048851ad76a90e84a253ce5c75b03c0426eae8
SSDEEP 12288:BbsfUM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:cUwBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T103650169E29802D8D16E2270D38A9940F3377C6087E193CB63D0F53E1F7A5A09DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 4b452b7d9c01fd11a5586828c111c1fcf6c6e691dec3093944080e1be04369fa
MD5 860b7c03da8b7eff18e8677270f0ff98
SHA1 fdad0601ee9503f75de4b543cf83771526e1e8d5
SHA512 70a7b5c346ad59095ce55768b73a22f26a7928a1fa811655f64b4134508f1d5790615867a21804729624ce9dc5a718a10c7e92d6b65232107b928ec3a430ac4e
SSDEEP 6144:6sBC2naqQFZVDz17PGotMxjeWbiU3f+kzyMWWsEIyIBbFW1582zAA59NMJyRffAk:/WBG2U3fTW+QFW1K2UAdwyRQh0JMvj
TLSH
T1D9251751766BD75FC6A940321E33C1CCAB707D41EE45AB0372C9872FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d2db32c1ce3122b7dc55623f9032df023110ceb35e60993ad992b70049c6e111
MD5 071a9d730f7d7b2eb5a98a6c3edc03eb
SHA1 15f48afd5aa47cf8fb9edb82f4802be9159a39cc
SHA512 0433c59b274558307875203661ffc1b48729f4e3b845f7cc0c05abbf8e8d47997c7dab6f54d84875718a4c01f72bc316ad2c9615af3cd6f871855f8dfe9005d4
SSDEEP 12288:6r8Wcd2qqrgnBn3v5LYMjQh1E9ONnVll+/ELQNz:FdLqrgzLYMjQh1E9ONnVllmNz
TLSH
T1A675F8815537A3CFC1FA6032077A9B8D6B64EC16B7056F2673C8443ED82AA2570F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 23aff63fe3c814480556323b7a56672ccff91e29060b7dfeeededf14588f3d5a
MD5 d237cf5b85e74aec7e1ba5e84ab59575
SHA1 c2e5d0a86917c0753bff25391759c596a9b28f26
SHA512 69ee68a9f2007d0638bbf88a1c71823fc9ceeddbdf612e6c3e95d18df0c00ab0d2f5d602ee0ccf08fe414a9c0cde9997efcff0a91e38ae82881186d3f0454c9b
SSDEEP 12288:7F7sM9Bj+yxSCFo0YwWrFdZ5Rilm+HNrqswQvgjvpGsJYUqU0oJuqu:RswBRxSgo0xWrFni8+HNQyM7OUZIq
TLSH
T12E552375E05C1DCEFAB31EB0719EE458E21DBCE04F0144BBB31A761A17798A29C32627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 64f0441fa3e64e4a121ab04cebcfcbf083449f34e89388575cc8cb80d8b73e5f
MD5 478d0857a534ad880db43aa18d4a9d7a
SHA1 d89586340b098303f27044dc26f32ee1926a6020
SHA512 721cd5c1c2af23ef6fe79061a349e7a76e6fac9917498cf47bf12c71c18fa1910f37f1ed1387f971168115e3fcc9b08cf203f95fc45a2e34d0e37c32d36eccff
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYWwBRxSgo0xWrFni8+HNQyM7OUZIq:Zgb4mBIBhGFsBGgkrFniJHNQyM79eq
TLSH
T17F659E1E22EC02F5E1F6D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e461b2792336a1dcacf0c562135686a2258781df7375274a968fd5bbf2d5ad99
MD5 b2f799bcaa0a89439c84844f4cb5e482
SHA1 515504efb897266808d599c4821400acc9f7ea3e
SHA512 ced04fcc8fc14a239f913baa2bd08a62360807eb55999bea092b0fb182fa774b4b1033dab29c5a93413e28437fe94c520de4820727357d31a3299d250315b5bd
SSDEEP 24576:WG88u8FpJqH1bzria7/mDwBRxSgo0xWrFni8+HNQyM7OUZIq:97ZFPqVea7/jBGgkrFniJHNQyM79eq
TLSH
T1D495F175B2E501F4D477913889864667F6B1B8210360EBEF07A88B561F33AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4b768da1fe6f6b08de16924af9fc4b474aaed106e5cbc4679c60d51db836edc3
MD5 bf8cc4cc24196438c90a29de1d349a9d
SHA1 9b772eb1b377433ad489c97a33c9568690102d57
SHA512 754ff78c2836a85a12b461f6472454f111da1b1a0f1384680481c61895a2039f30fdebb74c085ec520da8ffa04544f842e9f51f97c19c882f10daea29ad87d97
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYBGgkrFniJHNQyM7T:ZG05lO43btBdcFnAHqy89eq
TLSH
T1FED5CF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b4544ac32ea5bb7befd110b7ad8294955aadb60ad018291c8c502156403aa805
MD5 de25cf929939d38919de89f94f05df32
SHA1 0f425c646bca1d354d3937a9caff1e560676221e
SHA512 148cd04a337e105b7110c0fe198d29a919386e2752c129cd4334be531416f4d051f696274612de749ccd82e525661885ac2ac02cd7fd6b85b621ef403b7b832e
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnxwBRxSgo0xWrFni8+HNQyM7OUZIq:Ia5POZ3BJt2pasx2+mgBGgkrFniJHNQ/
TLSH
T15465BF5EA2FC01D5D5B9D17CC583861AF5B1346153329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4551dd34361d38c780c15175d9e5b14aba8acedba29c8c59ef289ba1d5a89b7d
MD5 0982e64076901736cfc3f476b54045d4
SHA1 ddb5dd09286618a785848c18703486d09885b8be
SHA512 36c5500d07e5e00a6c12326df4b81a2892a8bdc5b29bafec9ca58f5bb0349011a3aff631c49079eda39ebc89e077fa02a516c92c954522e451a27356f23401bd
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkrwBRxSgo0xWrFni8+HNQyM7OUZIq:GNc/zEOVHFDBGgkrFniJHNQyM79eq
TLSH
T1EF858C2622E901E4F5B7E1BE897B9546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 01dcccbc00f4ee3c5eb4b4b933bb08fdd246e7ce0864d87150b2c9f49380e0b5
MD5 9cc37cd4806e76bc6623979e9fa39c3e
SHA1 3d88e5babdbfd1027b4b9aa8d351664cebce4ba1
SHA512 055cfe8fa3a3ad24e0fa4c4109413242de05c9fad9e246a7d8e164cb00d8aeab726cad270ebfc0681d044c374d837eb6ca8ead33ed2fdff6a6884f3d345c6ba2
SSDEEP 24576:vTkNvNnaFeYhJNtmZBm1wBRxSgo0xWrFni8+HNQyM7OUZIq:vTMwBtOm+BGgkrFniJHNQyM79eq
TLSH
T12755AF6EB6F806E4D1FAC6B4DD238512E6727861073292CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ef3bd50a52d3f31c9f2fa645e219b0453d7720055782db8ce99bbf8451b0e7d0
MD5 f40edd0896634cfbd0cce44d8f77433a
SHA1 4e4f9701b3485abf24790f80c8ccf02b046d1d90
SHA512 a41caaaa555344bc682579fabdd5ec39319da6bea242706b9286cb885bbb4a38757faca6cc3d0a56d53f86935a822d301585b85401b9a03fe371ed9835878dfe
SSDEEP 24576:hPUr+NQfwBRxSgo0xWrFni8+HNQyM7OUZIq:hJQIBGgkrFniJHNQyM79eq
TLSH
T19B75E13F61AC1CE9E676A17C95868609F771B861071291DF02E1813E4F77DE8BC3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 c013aa2a6db1d1970a84efd28f8a6fbf5dfa5e04036f14d533fcdd1ecda3c1e1
MD5 85df5f46271c6ad091b5903a4e37c201
SHA1 58e217fe4325c29804c3e0fb23f7e2170ff639fc
SHA512 370ef44d4d8144940be1f6a9492f28cb82a79e985035f759ce05aed9bf0ace85760446105ac6127641e22cb9bad9a439888f8b47955ec83bfe5bcdeeeb3a87bd
SSDEEP 24576:1D3FHshBIYQgAgwBRxSgo0xWrFni8+HNQyM7OUZIq:1DVHeBIAAdBGgkrFniJHNQyM79eq
TLSH
T1D785E17EE69C04E4E57BC1BCD6538906E77138A8032265DB12D481BA1F6BEE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 2.1MB
SHA256 4c883c67ebf695363d7c9c33c34bb10174534d77d2004f96e6456e4e6f0b1799
MD5 4837b0202301fa535ceeb69bed67f4e4
SHA1 26b90f18787ec5e84ec5348fece433848370afdb
SHA512 87a7fccae52694df2606a1c2c7d9db4cabf38d2b410374eb49bd66c74a475374cf3096f25e54180f503281f2f9e09dfa4719636ffc38139c83711864a3f8dced
SSDEEP 49152:8wwOzBGgkrFniJHNQyM79eqtBGgkrFniJHNQyM79eq:9zBdcFnAHqy89eqtBdcFnAHqy89eq
TLSH
T126A51269B1A81CFDEAB31634818BD435F7B6BC412B21962F1374C71B5F37221AD2A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/828-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/828-92-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/828-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/828-98-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/828-302-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/828-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1064-309-0x000001981D970000-0x000001981D9BD000-memory.dmp

Download

memory/1064-388-0x000001981D970000-0x000001981D9BD000-memory.dmp

Download

memory/1564-68-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/1564-69-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/1564-271-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/1564-74-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/2252-47-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/2252-54-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/2252-52-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/2252-46-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/2252-39-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/2252-40-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/4120-80-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4120-86-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4120-310-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4120-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4120-286-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4120-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4328-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4328-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4328-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4328-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4328-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4464-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4464-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4464-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4464-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4544-125-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4544-128-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4544-119-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4544-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4544-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5688-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5688-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5688-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5688-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5688-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6280-64-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6280-58-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6280-234-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/6280-56-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/6472-78-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/6472-7-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/6472-0-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/6472-8-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/6472-1-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/6536-113-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/6536-112-0x0000000140000000-0x00000001402BB000-memory.dmp

Download

memory/6536-304-0x0000000140000000-0x00000001402BB000-memory.dmp

Download

memory/6536-106-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download