0b994d7494d168da6c8e4af08b59547c7d125a6e973c90ebefc33032efd7e2af

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260727-m8tg2aae77
SHA256 0b994d7494d168da6c8e4af08b59547c7d125a6e973c90ebefc33032efd7e2af
MD5 c650948f594aa79b3e93d7a72b7e47df
SHA1 856d8ef9188b4ca4fe2c3effe538f84747a1f1ee
SHA512 1f14d4e245ada594dddb782a5fcd6a51beff0b2eaa518d0096b2ccdf53b95d1b7a3e20d2eb0673865b6cdd8e3d61f182fff3b1e7973e9947c9a4bddd61a59f6b
SSDEEP 24576:G0/C6CnH79Us2PtOsybp+xKOM730nZ6eSJW9l9b:G0/Asawu7yYdOlB
TLSH
T18245E116B7E401F8D077D279CA558A75FAB3B8490720A7CB03E496962F277A14F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5188	elevation_service.exe
2424	elevation_service.exe
4372	maintenanceservice.exe
2456	OSE.EXE
3908	PerceptionSimulationService.exe
380	perfhost.exe
4988	ReFsDedupSvc.exe
3160	SensorDataService.exe
5936	ssh-agent.exe
5832	AgentService.exe
3040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7bca86698f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008ca8b052b81ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe
5188	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5832	AgentService.exe
Token: 33	3040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3040	SearchIndexer.exe
Token: SeDebugPrivilege	2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2136	2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5188	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 956	3040	SearchIndexer.exe	101
PID 3040 wrote to memory of 5984	3040	SearchIndexer.exe	102
PID 3040 wrote to memory of 4412	3040	SearchIndexer.exe	103
PID 3040 wrote to memory of 3648	3040	SearchIndexer.exe	104
PID 3040 wrote to memory of 6120	3040	SearchIndexer.exe	106
PID 3040 wrote to memory of 4940	3040	SearchIndexer.exe	107
PID 3040 wrote to memory of 612	3040	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_c650948f594aa79b3e93d7a72b7e47df_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:380

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1876 2856 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2872 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1876 2856 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2872 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f00ea9b4a894b0e9f9c4153cab6bd976ae48a0a244da74c14f701335e1e2f349
MD5 626c5f07aa66874dd20c811da466aba9
SHA1 b314f6de7d413ca54da8b53cab1251684ade2b84
SHA512 b4e528a445b7129963a3bf1f600caeb5e49a8add256f9b915f6ff62ce26cbd5dfb62deb40b8d6b9b07b650b5f464d70a5f7e52a4e17d823dbf802c06aec9c460
SSDEEP 49152:tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxngu7yYdOlB:z3q6mjB5u7yYQlB
TLSH
T1A0D58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 22748d29057e339031c1e45c1789456dcf4675f51aecd5ed26ab044ea2e3bca4
MD5 5a977b3193f52eb798d1ee9a53b77900
SHA1 8f9f24a1235939eab38ba77836581501a0ad34f8
SHA512 92c003f781e364b23084b104f9e292a06e1ce64b44cd0eb7b7b3b7adc071a66dc3fc7f78d85479ed256ee905d4073db204fa5aa658b85c9d7dcc6e3103bcda32
SSDEEP 12288:w1XLsswWkxy2lRq2czA1BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTN:mXYfDtczA1xKOM730nZ6eSJW9l9b
TLSH
T13485F129A3E409F8ED67827CC8A1C512EA3378454760E7CB03E49A665F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b2997b7b1ef460b4bc3e338dc1bab97fbebf9640855e75316e143832d9ab4cf8
MD5 b4e1ec59939b0a67199c24b244dfb17b
SHA1 b59013303f0ce0c46614f8db20c0457cc4f97df9
SHA512 fc7bd56d21ddfba1e5f50efb539ea22892ac460493e74cce492dd51e089a7b4aa251433921af9977604ade616e61bc5bd1509698eed21fe806207df2849f631f
SSDEEP 24576:U0Le5ji0hmxfrMYxKOM730nZ6eSJW9l9b:UPji0Alru7yYdOlB
TLSH
T1F9959E16F6748331D073C0B9C5D2A69AED7230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bb69bc3ee213e01ce04793167291fefa4866b13d66f4a82ed71c6578a5fa9da9
MD5 a259934bfa08537e47aa59ee90f0f2f9
SHA1 14072f2f527a9918d9d41278ffa8bb66c476dd46
SHA512 a84ae82787b55e2e569ecb4107661d26b2517f44a0206dfded2f630f6ce20fca6f948cff9f17a3ca11ab714231acdaa4213721a2151edb5ac0c79d6d79488ef1
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWj6q8wyuSxKOM730nZ6eSJW9l9b:R/ezSC6vUzPv+Hjynu7yYdOlB
TLSH
T179756C55F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 beab56b731a7fca1e0afbae508ad755836f516d5c770a8e1f03907b772eebe1b
MD5 b188f0c23d061efa9122f5cfab12363e
SHA1 4e98230d6385bed403ad1895b7fe58c58e590698
SHA512 2b08a360d016c8d127f25cbb1cf0f60a0e6cb2a5cc73aa2261d8e14189ae8038d87778bfed7f9a18ab2a67abaee52b8ce787d4828e83dc1bc3602e5d2e001748
SSDEEP 24576:4VbqPb88hv/l+BJxKOM730nZ6eSJW9l9b:4VO88hXl+Lu7yYdOlB
TLSH
T174559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3b5dc35973cecb12e97eb6a3ce900ae2e07b529835042b3961239c8ad5d7e0d7
MD5 e88c6ec9007565856cde0735ce5d012d
SHA1 e204ae426da7da344bf1d57532f4c85c8b387540
SHA512 1a23f3d8daae41709383972fe6f55942dc3dda3fb40d9b347aabb76931cd71e775aa1c6cb2aff9d6be68aa0c86acbc3217adfe7c645ef9f687d6a0280780d7b9
SSDEEP 12288:L0MBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxbI:L0MxKOM730nZ6eSJW9l9bI
TLSH
T1076523C6C3AC2060D33F277894C8CAF7791A6F88C984DE869B62BBD2457CFD54A11593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 3e51d27ca535d09444cdf1314ab4d1a14ecfa0d79b40bf7a0960fd1e868f6a29
MD5 e4efdd9623bb82794c089272ae30c227
SHA1 012593afd61e55a156b59c0424751af7954057ed
SHA512 83dcf9558022bd3c87bf3938b5ad1ba264d79369b7da567a6b8c5def957a4022d15e33a025156bcbcfef70879c881c83144cf00d9278ea84e28fa902e8c86900
SSDEEP 12288:ReBNUbTVO86UBBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:RJIUBxKOM730nZ6eSJW9l9b
TLSH
T16F85CF7BEE28FCE1C27A4DB85691C640E77274704B62A3CBD265834EDE235E10E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 59de80919d395f5d3698e16f5d0e87436abfd91a323c21c340505693d3b03e18
MD5 ef2eb311470a0e34c7244ececc8bf599
SHA1 a984933e70b42443aa325e984bd9cac748e1a47f
SHA512 83011d9204fa6d29f5de5bebfc0e3650697b0ba4a28bb8891531413d050fe586231d1b92b48004f4a9f340b6a2b986e160224834e42e3fac8f76184e27955042
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THN:XQvGAdlCEL8c/WRNw5Ciu7yYQlB
TLSH
T14A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2c21af2ba955b0b94eed514e6ff26399bcc9ebc7133025bd249232f03b1fb1a8
MD5 8e7110517e5660430b94176c3b6e6c2a
SHA1 def3c6b5f865c1410f3e1e1d3c6b8bd4fc0c3ce1
SHA512 bd166f26b8f1a9bfc701dbcd42e53f1b280c0e3a2262089f615bddaec133390dfcbafe8132a5f6ae95e2c1e4598db21e8f1344ee50e2b146486911b8507a5a64
SSDEEP 12288:zAwSfxL/2Dc3oDLLmt0LDQewsAj7BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dU:sNewsAj7xKOM730nZ6eSJW9l9b8
TLSH
T1B085E031FA74E032C37F0DB61B65C716282DBA204B511AC3E3E88E9E59746D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d6260193e4263a88aa19a7275a838269404bcc72b4d8acdfa827fe511e77dac3
MD5 f4ffaa5e19d96a085f6cf8447c51720a
SHA1 57458ee194c7803afedfab41851c8602e6b44a99
SHA512 52b313e278cf2c6fee2a657ec4f11a07188998145af63a6ab5f11cc7a1b8705b55874192fef1f14555dcb8d3aa908a46df5bb29546b9ab4e28065b283fb5f7b7
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHC/e:CUEtQevvqc2W1cpV20I32C
TLSH
T1DC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ed0ac874cf99b43028eabe1735957ef2f72918c8be361f355a111fcfd04293e0
MD5 5a031b51c599bc4bf943c4d2542b36c5
SHA1 247d052ef6512dab39f1bd4dd3f25d9e155f6935
SHA512 fd41dba84c1b9f21d2fd15784e8755f6d7bf96c2bbdf94bece9b4f9dde72db4c329bfb521f3c11ac1a81f3a39622dc907fa08f06c3e002b843e4467e0e7fbd5a
SSDEEP 49152:tCbRquA/m2yL5zifFiV+XenmE3/zbu7yYdOlB:KoqHVjnm+u7yYQlB
TLSH
T1EDD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 95d349c0875d4dbb2afd1f31f7bffa4702e495442c56624e4bdfd6b15ec5ba40
MD5 9baaa5080068e5d869fa2e371703d9d0
SHA1 02e404524fc054b18f39b3b9cea79c340330ad79
SHA512 e539dbaaf28cfe6a84226137cd36283e1f7bc47c6f186371257f27109c04454541cbec682983f0aa2dd9c1d9a9850167d284b5994b0b63d51afb3d25058486fc
SSDEEP 24576:iAhGL6IFoiwtA5l7S53exKOM730nZ6eSJW9l9b:iAM5Foiq5Ou7yYdOlB
TLSH
T1B6359E81E7F955D4F5B3AA7899B68171EA76BCA95E31C20F2250D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2ee5b0f8fb6fad59c4d251f7702b74b3039fa37906978064ae117e1e3e82490b
MD5 6d5a3915aa6688e3e2ab127dacc0d702
SHA1 eaa8f92e1adfbdf4055c91f20964b9f67b20af44
SHA512 40649bf726a7963c903efb6d883424af7624c86424739a5500ae91c3aebefdffcb045ebabdff2598e30db142ab18988b947185ef576bca83f2691d742710aaeb
SSDEEP 12288:mmw5HEjsChNWBFgl0WDm+CyBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgB:/wu/OWHxKOM730nZ6eSJW9l9b
TLSH
T11085F18A72E81CF8E9675238C597C536F7B2B8012A21DB1F1760C75B5F373616E29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 d1640af85d3c7b92c8b1955658eea3c12c39b6a1f4a955304fa502b908e4fd6e
MD5 49b137ce7f44170af7b4409da738b98c
SHA1 ba35c449ce5b2fa84ebada1ddc77840f7d4cfac1
SHA512 7b232bae7a7d6d9b1106ff9a6c2f8f6dda82328a6b5884bff3224f15393d95a73e51ddb3ae3d40dd755519702cb14f4ff5323bb883cd4fb42a685f2bfdb2a22c
SSDEEP 12288:MIZ1IyLBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:TZuwxKOM730nZ6eSJW9l9b
TLSH
T19175128A23E830B4E277527CC8E48A96E7327486577183CF176187A61F76FD60E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7627cf151f1878b7c550c6ec8d2b9d691783f26ec775259981e6d099ef7959e1
MD5 6eff77fbfcbcdc08143dabf73de63fa4
SHA1 b1313c6e4a0e45c6c7dcf6896f21aa37ad8d3357
SHA512 67913f8d636571958f7cbb6b4eb248cd8497a87489782c61c08e4aebaa9e0ebf62f22443b4e85824ac43deb7f7170075af6b71b2bd6cc0f0c35f7d2385da2f42
SSDEEP 98304:oQRQyi36YOcPDLvw2gAf+PN3tu7yYQlB:/QyiKanX+PNk/e
TLSH
T12E667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1c273f5d3fce69d077a2a557ffec3b0bb41d9c4523fc4742d73500d95edca78b
MD5 3e063256abe13d7a23a995ee8cdc1c9b
SHA1 c476af489e4b94a6de2aebcb7403cfe547bfe5b6
SHA512 ae66ff08640af2929c09654f9b9a89d775617f67c3ca53d7b3740e404418363664ca131f63f84c80d75afa54a5a9f308f1ab4cd5a7c94bb1dc70d85ce83ba029
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3tu7yYQlB:oQyiKanX+PNk/e
TLSH
T119667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e9dd5e9578de6194a4cc3ec4ef0ae8ddd6eac27c47f025ebe8cb62066e7b9f19
MD5 443456c1687086343afce46889758f12
SHA1 144188fd0b63450764206ff9f71b9b622e62fb45
SHA512 52a14d6d903fd94d9067c1b40101e99c796b29b44d33fd20ff867ae661730dc51949ed80a0cff50c250925435fee05209122f30317a51cce6580d5c63c6cf434
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0gxKOM730nZ6eSJ:B68Qg55nhkeWu7PNU3/ru7yYdOlB
TLSH
T156B54A33B2F600A9C45DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5089ce742ee164c703eb93615b35f7d19a5cd529a01bb2e561d75330a001c034
MD5 879a8a86cc9b732471243619684d4e1a
SHA1 44a595b718a01b30e81c50fedf587f41444dc32c
SHA512 efd8c082a866ef440fa59968bd674ff545aa62eb2264b540c38c284963c98f050bf9cd3f60fda8153ae272f072ce9d71312683490758640fb58bb80c2d1be716
SSDEEP 98304:hy5112gYy5azzVvU69nLKnhZMu7yYQlB:8LIHRWh3/e
TLSH
T15A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2d38b8817b1a87e9f4d33689d9a2a47edfba999465b4d22ef50c4ab525137bbd
MD5 f574e3920c3e5e1ec791a85cdb955ad0
SHA1 5338337a4d17d92bb7608abc45d951ccdcc79835
SHA512 b4dde1ba3a1f06e52402f0476b0efb5ac00677d8f73382e093efc1efd885f40a928325f3833c65e76fd6486495a8abb9d1e02765df89c25f187a25290c8254dc
SSDEEP 49152:QB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllu7yYdOlB:Ku6JmIxd2dlu7yYQlB
TLSH
T15AD59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 992c8d6ecad85d6c885eefe47e6a71e87eb64a61d32543e45a9db62535fe39b8
MD5 e9f6a080b33793d00c05d91ac4c467e2
SHA1 a838504424f4299e5b4c908cae03597d74a6d48e
SHA512 97fbf9f121712e45cb9fe93942e3ecadf1bd7d32f7563379b6fd0f2a37d7894b78b04daf48a984182b727b3f3f98964c5b2f39e08bcc1990dd26353e56ef120f
SSDEEP 49152:L1hpsNoJpF1A67U44CwH7R4xhu7yYdOlB:LmifPqR+u7yYQlB
TLSH
T1C4B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d0fb3506432882caeb814dfd1dc076efb1efb9705cd83ca748cda2617e14239e
MD5 367a371dd3e3963f177d0202f26ca7f5
SHA1 df21ff9f22e8ec26a098a158b9d99ec04ce63593
SHA512 add543ac87df8e1742a366da50d630d60c679655acfb5584d7c774d9c6ee4704a997ffb11e791461c5980d74a82943ac0122188cdee8fc4de5ce983491bdf5f2
SSDEEP 49152:wSuZQIY0Be2KkRVtOnks6NMHqwu7yYdOlB:q5dKqi61wu7yYQlB
TLSH
T1A2C5BE03F2E941E8E0BEE67887659232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ff29ebee84d1c8ab81f38775d679d1fee40cd4d0973195d4ccf9e184fb62cf15
MD5 156ffb88f4a61530543220a6ee805b48
SHA1 a6713796cbf3aec931b9e0926ee3307b551f6263
SHA512 b71330b6578e3890012e22162aef0204a176b02cb0668cbf6e2a006d8e4a6c4aed7398681e9c30076307ba78cc18c6dae14623d5ec53cf870cb93fb0fb3bc38e
SSDEEP 49152:9htSn8EApI0figjgiDn0AP5w1u7yYdOlB:sX2iWphqu7yYQlB
TLSH
T17B95BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c216c56744fe13dad77820e3174d8b7b0ba65b6791c9cac2cd452d38130add9f
MD5 3b6c22c9dc235852daabc2c6a68b4759
SHA1 b7ae923248772b7a99ba5b2f8c851093e46082a1
SHA512 da4afa94f56bdf8ef0298031cf914703ee09af18853f6be55efe2460f356f0e38d2e57912bfcbd1c57e94ab836072b1b1b7757cf9c5936864c31d080e1f58cf4
SSDEEP 12288:skBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:skxKOM730nZ6eSJW9l9b
TLSH
T1DB6523C6C1FD2160D23A13B8C0C4C6E6B81D678DDA41DBCBAB67A7D256BCFD50A019D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 e9e8854aaf82113778b166b768d4dc57a868b478b6b4457b41a4a42d266e6dc0
MD5 cb4677d143e61685e42033d8ebc52a95
SHA1 e27613c298b91d65448405aa4bd060474981b503
SHA512 4a0fb7dccecea3890f3813c01293e6a2e33699e550d332b2a3e9b4241df8e50594e221a0cb501d6250518633557d6aed2584adabe364d15134dfcb99495d0fa7
SSDEEP 12288:uvBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:uvxKOM730nZ6eSJW9l9b
TLSH
T1736523C6C1FD1120D23B23B880C4C6E6B81D678DDA41DBC7AB67A7D256BCFD90A019D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 69fb008a245f2444b734e14fc94008c168cd33918bc98c899be2133d43b21580
MD5 e5ca657736d3871b1d823385be790065
SHA1 4b64e00d270e6e8d36e091a701acddc3e162ed14
SHA512 017d9b0e2182836ef91a03ee8fa2449333b5aba1e3af4c5fd0db8b8b7decc358939c27c868301aac75c63c480c90095e5f53710fba836f234d455da3df056e0f
SSDEEP 12288:b5BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:b5xKOM730nZ6eSJW9l9b
TLSH
T1D26523C5C1FD2120D23A13B880C4C6E7B81D678DDA41DBC7AB67A7D255BCFD90A019D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0f97d38aa9e4b45992dc63176c1e090edb4fdad50e8485eb5fdb07b08361bbbf
MD5 08212f0526c7100c7477ae42a4cf2e4c
SHA1 7988f0def6d5d7b66a89582b1c85a3a154267700
SHA512 0165846e95cd031a3f418284877a25d4d65f9f705ae63359a89e11c84ddb3998721528e6484a35a479afcc346d756082d4a99ef47c6a070e8c77b756cb6a2ed8
SSDEEP 12288:vV+BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:cxKOM730nZ6eSJW9l9b
TLSH
T1CC65238693BD10D0D537A378C4D4C6A6F53ABB88D721DBCF9B125B920E74FD40E20A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9ec0d6efd7be9635894627b3a412febff39f152e02115107e172308ea2fe83b0
MD5 45cf438443a6842a098934fb33d169ab
SHA1 03eab9f13a6bb3f0eb9af365bcb8c4f8d1b39922
SHA512 79453fb32e9b7d6b1cd3183bbda63b31577c904226efab74a19b2445304cf4a3c8f75854699435a3bea238051e769e0e45c69d77b91fe97e55ebedc04bc5e005
SSDEEP 12288:nmBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:nmxKOM730nZ6eSJW9l9b
TLSH
T1896523C6C1FD1120D23A13B880C4C6E6BC1D678DDA41DBCBAB67A7D255BCFD90A019D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5c78ffc0326762fb0a788e66b2fdfb0d1c73d706a5ad7bae80123d4d7ee4bd2f
MD5 b37a558b32e107fb41c4be714c22dff4
SHA1 6526ba04fd0445b95f443f1127d87c7f09ff1b88
SHA512 aef1f93cbd85ca2a4414e530167c3862e6b1d93f369925eaa67b0ed287466ed2e49b4c077ecee41d159da1287597bffa91807212f7cfa098badb792fc06b32f6
SSDEEP 12288:5TBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:5TxKOM730nZ6eSJW9l9b
TLSH
T1006523C6C1FD1120D23B23B884C4C6E6B81D678DDA41DBCBAB67A7D256BCFD50A018D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 dcc8c5fef83edc51ad3ec6e1627d1cae0fc46a7b95c47b86fbeb1f9eefc30bb6
MD5 1114b1d899d36bae2430ca84ed3e2f6f
SHA1 c7b7fbbec808832b025675c796004c9a983990b2
SHA512 20e500c136d6d0cfba1f0fb584bbc0e211949bb760f30978ab5703e24fecafab50d32844d3216e2ba6a7b2e74c78f43008974cc30cb4074f904ce91d291f36e1
SSDEEP 12288:u3BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:u3xKOM730nZ6eSJW9l9b
TLSH
T16D6523C6C1BD1120D23A13B880C4C6F6B81D678DDA45DBCBAB67E7D256BCFD90A018D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 867a4ff77d4c054991a4669a02732ed8f82e5f9248a71999b632edcbf64be126
MD5 9a832da74472e4790f742565687bbc1a
SHA1 72ce13af3c537ec8f0e5d7de024852ba48444497
SHA512 a3c854dbd8513dab7c9b6fa2f3731aae12cdf25cc03a3c7c3a3922c68963bbfaddbfb3fe2c685f494c1d1b68a81e3f509dc51a5570e12712f2d8ab567dc93bb8
SSDEEP 12288:AiZwb5zzFEoS2cPvyPBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:DZM9zFVSOPxKOM730nZ6eSJW9l9b
TLSH
T110850195B3A018F4EC37823EC8558956E6B27C5A4B60CA4F03B437675F337A10D2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 ed244c5396a5a832525d87487aaf487a92297bbb2b318539fe9c7397265896b0
MD5 2e3195fa74aa593bebfa4d795687276c
SHA1 67a7c41aff32aac9900edc22ec0f2d4a6b58fd2e
SHA512 064ee31b4a78c592ba422e8b3a976a74e9993f708414ff1f54bc9ebdca125ecb26b0df6b062350b72755ac0141ea49ab66bf107aa965ff2a7f8086eb1193f931
SSDEEP 12288:eABzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:eAxKOM730nZ6eSJW9l9b
TLSH
T1C86523C6C1BD2160D23A13B880C4C6E6BC1D678DDA41DBC7AB67A7D256BCFD90A018D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ecbd3aa06f8e30d02082e30f7884e1c749ad52fc72c69ed21ba0504ea1667251
MD5 15dc8d05966f08319ad792f318aa2a53
SHA1 fdd9504a7cf68f0f69c09e428ffd2300e6745921
SHA512 96c7292c5ce2b9c23eb00722b4177b0be17e0edbd51753f854afc97c5a793d16d87f035057750ca8d8bdfe9c24acd40f38a308f6e1024715bb3493ee9ef360ab
SSDEEP 12288:PcBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:PcxKOM730nZ6eSJW9l9b
TLSH
T1286523C6C1FD1160D23B13B880C4C6E6B81D678DDA41DBCBAB67A7D256BCFD90A019D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 fa7cbb631a0eb5df74ac9e05cb89e3283a48f79b259fa4eca772f8207b13a944
MD5 550f0405a9052935e9c97b83003a2921
SHA1 85cb5a339c5bd95367a135ebcd5e3554f7ddf74b
SHA512 95d4d2db213ae6806a663dedaa3b3b7124668a4f3e20863a62cdc2e932c5ee85eac1bda5197ebac70c7670004cc11016981ffebe7211864babb4a40e19434cbe
SSDEEP 12288:zyPz5L8LBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:+zyLxKOM730nZ6eSJW9l9b
TLSH
T136750247A3A530F8D1375238C8914A52F736B87647208BAF57A047B62F37BD14E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 f8a82c37587596d829b746c2f75cb684ca949d25f4c5db1bab2e817a22ca47a2
MD5 d9a861019cf4dbb812887fabdf07e2dc
SHA1 356d4bbfb9ccc722b41973fa3b8316d4a84600d8
SHA512 88bc9d08a9da11b57f18e08ed4ff9c20ff61121ae3868f37cd98486d98c63e82217f69a1ebb38d2189eef07bb3de17d1662b1bfa33cb1e034164d6532cfc5696
SSDEEP 12288:cABzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:cAxKOM730nZ6eSJW9l9b
TLSH
T1576523C6C1BD2520D23A13B880C4C6E6BC1D678DDA41DBC7AB67A7D256BCFD90A018D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 7c8db139e8c0ff461cf75cd030416f4314db904a285cb81fac50e1fbfb37065a
MD5 2facc7717841dc60629a18515d20d05c
SHA1 8256de047e6650a24814a43765f14b9df9dda442
SHA512 ef8ac4a123f2c42a90399a2222de4b54d065c0bd94a61594d5e60df87345f2049f7218d5c35d39f6d97a769127529faad47baf92462d090a25a2c93a19ebf61b
SSDEEP 12288:tABzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:tAxKOM730nZ6eSJW9l9b
TLSH
T1C46523C6C1FD2160D23A13B880C4C6E6BC1D678DDA41DBC7AB67A7D256BCFD90A018D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 36f9bfe450b7ace2841c60ce5f0d56c2c074dd9039ee5c8a0bd5550426af608e
MD5 447399b0ff7807e632d82d87dd706aab
SHA1 3db8d3020065ef276f103b26ebc92c17b9196e33
SHA512 34c18e41f443050a1a8a2075a8cb65276957029d80217369c776b3bb965517adf43bfb811f19172fe3cd921a62cb3bfbb9b424b45a7dddf4fbf7e0a6d1ea1f7f
SSDEEP 12288:XyPz5L8LBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:azyLxKOM730nZ6eSJW9l9b
TLSH
T13A75024763A530F8D1375238C8914A52F736B8764B208BAF57A047B62F37BD14E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 fd9a3c4a3525f50280ecabe9dba34ef78f022f4c15701ae716d011417e462880
MD5 6fc4ce18b8787b509f0d2dae0f846695
SHA1 c4f5d69893ab9ddc5b1e822f39801ff111c8d6e3
SHA512 0149d66e6f405e318811afee26ec521343c20c3a044ec37f5ed4cab86338cc11c2e4cf47d87683394c37a2fa75af58c1ae565703221709bb95a9022ff0e5c2bc
SSDEEP 12288:OCd9bWYoaLHF3z0z04PDvhpBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgB:fTqaLl3z0zDpxKOM730nZ6eSJW9l9b
TLSH
T11D850195B3A018F8EC37823EC8558916E6B27C5A4B60CA5F03B437675F337A10D2DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 fe80f51e2f971cd6c711feff3370605fa4f6824f14945b1d416b4a8b30dd7453
MD5 aba4066644489f412ce3c2e9fe386bc6
SHA1 acbe3df9db408145feaed960b486d230402ed9d1
SHA512 5f9e391f215c5da5637a946f6ac1e6f149f00b96ed70006d00d52f9002b45cd6b9fe5e147e412c47dfb48436bad88103181b7ba0b4d6bc80c464c1bb6117fc52
SSDEEP 12288:Ii4e78RdTfgwCHKy7GLbbdIv6BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm04:I3Bd9CHKy7GZNxKOM730nZ6eSJW9l9b
TLSH
T19595CF90F3E810E4F0779A3589768512DA767C9A5B31CE8F03A4665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4f1d1641e43662a5a2b8987a2ea733f11f3810cb07c4cc924ecf7dc3e06f4e3b
MD5 b0d0a9887c2dd0e61947e2fc632c2ccb
SHA1 ffe54e83159eb62e166f6bef10bae80b7e70c642
SHA512 b4dd38cb14d81fee4ac4ec24e0bd0ddcc0df6a4e96e5daf6a69c82b30b7ae02ecf1f8464993871afc18895f172f62b6912cd79516e55d26e9e9d3ac523010e8c
SSDEEP 12288:XZBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:XZxKOM730nZ6eSJW9l9b
TLSH
T18D6523C6C1FD2120D23A13B880C4C6E6B81D678DDA41DBC7AB67A7D256BCFD90A019D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 320a907c6e58ef5885ce57d7c6ba892a0300f5e40ccef13deb771063c50f118c
MD5 f9b60b37d0f6eaa0415f464010f445c9
SHA1 320a5b0806b31721386863dbb3f3ceeca63a13ff
SHA512 2f64ef523fdb5e2a90c217f5294be42eac06fa26a90ec4de097b8168a367849b705b03141d30193075be570ce51b9c1eddb4e94e4ec1d3f95c546bcc1e17770a
SSDEEP 12288:SrBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:SrxKOM730nZ6eSJW9l9b
TLSH
T1246523C5C1FC2160D23B13B880C8C6E6BC1D678DDA51DBC7AB67A7D256BCFD50A01992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 7951d1a27b8a2ca1c4ecaeabaaf2b882172afab80703a426beb7bf83692add58
MD5 6d2ac2cabae87bdca77dbe4f9661670f
SHA1 13e4f439bfc70a1393d7332599b07b9fc020e256
SHA512 c50bb0c60bd342503359237635d88a3a1f26577e30a3aed411c6063e7ac99839ba9a65c6cf7e2487db58fabd772d210e75967fe77025597fbd9d73f1c15617de
SSDEEP 12288:S6BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:S6xKOM730nZ6eSJW9l9b
TLSH
T1566523C6C1FD2520D23A137880C4C6E6BC1D678DDA41DBCBAB67A7D256BCFD90A018D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f714b1041c5a34e0950c113802c1363bcfbb039b0a26d12f1da6e9cdf7910639
MD5 a9e1e3b893a23d130b5c615e5c3b1644
SHA1 964d46292d152520937a1eddf9085d77c5272e89
SHA512 2e747272d830d2f11c0b69519c5d01a8411fb08c3c9f21538651acac1ce18e169c7b8d905de979cd8272d6753d674c5917601c7be8735c1f53ce29e8698b203f
SSDEEP 12288:cABzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:cAxKOM730nZ6eSJW9l9b
TLSH
T1936523C6D1BD2120D23A13B880C4C6E6BC1D678DDA41DBC7EB67A7D256BCFD90A018D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 72cbfc1c50c3242f0cd7549ea7ce62fe93dcd85fb2ffda75c303a43d4568450d
MD5 f4a2e6392a42d4abd67166a25c365ccd
SHA1 d23af1396870dc68518a22ea44452eb5af433460
SHA512 ad5eb6b40b06f046f1ffd6860083a9d9674e266acf0a4dd0ad6e3d14550b924d5debb6c399dbf20fb93ec12a923ca5d31d1145a85caab048d088e3f64bb026d0
SSDEEP 12288:eZBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:eZxKOM730nZ6eSJW9l9b
TLSH
T16C6523C6C1BD2120D23A13B880C4C6E7B81D678DDA41DBC7AB67A7D2567CFD90A019D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 1bb47fc6b0b486d1e1e681d88dcdaaf65199230ed56824f6ce7c0ee74ba9119a
MD5 2d1a93cd4837af3f0dded4fbe060da10
SHA1 111827aedd4ea951b2fc65d3d9983e8e9b95c5fc
SHA512 c105afa2776d0c84a54e01da93409fd6e2f53f0400fddd122321b0a855586325f2d81c603f328c33164e1985793d45c666f4f6899267c9c0aace9c6dd5a8695a
SSDEEP 12288:2IBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:2IxKOM730nZ6eSJW9l9b
TLSH
T1EC6523C6C1FD1160D23A13B880C4C6F6BC1D678DDA45DBCBAB63A7D256BCFD90A01896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 0404c6f7a4ba6f4e755b2e872e4d4407cbb6d962101e86a71838b2401d418dce
MD5 eb6d9519f9bc861ccb1d705ebfa72645
SHA1 81d7282ef9efd25a49e3fee6783ad651dab2a722
SHA512 c206568c31bb81f2498cb81d31fd0790664ce5cb294e6c26a5281bc37a901bd810ab68df5f1238899e9db967a6f1f7cdb716a5ad749291ae0ed66b15288fb6a7
SSDEEP 12288:smBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:smxKOM730nZ6eSJW9l9b
TLSH
T1C86523C5C1BD2120D23A13B880C4C6F6BC1D678DDA41DBCBAB67A7D256BCFD90A019D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 51ea29edf60586b9450c6cd0d122f3d46a2889664946069d5d5ee3056f2dc0e1
MD5 0dbd6716a1c23e0356a8fd6a2e7599be
SHA1 8d02bc03e1eda221d59c74bddec2d0135400017f
SHA512 7e0e0c0d28949d018e9b170082bf0b6db809466378c75d355aeca4c4d49c945ccc24f2d00d5b800bfce5f46a3320c360b3fe3d1f9fda515b33afafc261643d8b
SSDEEP 24576:HfwvRk9RX6wkyAIsxKOM730nZ6eSJW9l9b:cMnYIsu7yYdOlB
TLSH
T1B295DF29EBDC04E5E177923C89B7460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 792c7f2a42d2b3d82926de292a8589792b9a46838b7b8b6034c9b3920d041fa6
MD5 14534ef7e6ef79076a255fe75fee099a
SHA1 32a24f149b9d41269c9d55c9c12dc34370930ca3
SHA512 0e6c66b4e530e2fa0f0674d2b2af20e37ad07b9c822b0e0cf8c54284885c656d9c44a4656ed272dbb2fbaedd55ea68ebeed8b5b9c07a60499ac61719f91cd9b0
SSDEEP 49152:EYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Vu7yYdOlB:7ySzPNu7yYQlB
TLSH
T177066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e2edbd5c2c55798ec6490c7a59fe232128591c75590f143f5e9ab3184b0b7d33
MD5 444ff92f083b36ba9eb67587ea827521
SHA1 dcb66370a23fd54d11d2461ff258d97494385425
SHA512 4f031cac38dc68063c11f0528a33ed4f0d6e6e8793fd8aa3f92d9272d3ed5a2dcc4c7d1dd1f57a45cdac32b8544f794ae9c0a5bcde33af952f9950c28d49b07d
SSDEEP 24576:l47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYfxKOM730nZ6eSJW9l9b:l47JUQjqirIhCnDHUPfF/lu7yYdOlB
TLSH
T15B65AE1EA3EC01E5E17A927885558A5AEA71742E1F31CACF2270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 07603e492ca4b343fce2295a07370ae46a3f4107a9b0b3961219729b90dfff7e
MD5 103ed2e3d0fad713ff77788402010918
SHA1 3a63c94b23806a3d70c1d7189ae96bf82550d5b6
SHA512 6db2eb87c04a29cfc8445c62fd20a57e18af9ebbbf005ae02275d481ed60497001e319a6dacbd15e52633325544645a159ca8156f38938d482fe8c5dff7f6856
SSDEEP 12288:wDsfwBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:vwxKOM730nZ6eSJW9l9b
TLSH
T13375F14AC2A812E8C02E6278C7858A81B7377D5587E1D3CB57D0F67E0F79AD04DE9A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 928KB
SHA256 11e1008b9416c651b352130314f14d05258ec46f71ff770bbabc46655f313980
MD5 80fa793cdb19d7d945dd8b4ee5ed3b48
SHA1 df4f5c05ff6a151685288b3ce871292c475e171c
SHA512 2dba80057c834ca41827889be3a42783c9b7f07f5b53339a50e91927896effb0493396271575bbfbb883a72fef502d76aba9f5551b0c022f70e61e2f236cc9ae
SSDEEP 6144:HsBC2nanxr9bzW331SmotMx9/WFU3fckXyxFXO1I5vXIIUJgziscI90LC+2byuK2:YC02U3ffGogzJcvW+yyJuhDhIN2xj7z
TLSH
T18B15F7017627D74FC6A940321E36C1CCABB07D01EE45AB0772C8873FD576A59BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 bc0ca343d3e68e78742eff7a2349614bc535a5333989f5fd676942250b38d5e9
MD5 cfebf8474e3df5392865c26550953356
SHA1 b6cddf30ec14c858710b54ab2aaa9612dac69354
SHA512 b56f002a337940730fca7433736c24f103e1a0bdf267ac6889a15f6643e6ee9d407b60b1e2d4b97f484ff20700b7703e54fc54f097c90e23dceeb5790b4c1591
SSDEEP 6144:eyTcldjpxrNq1FiHHR2O1VgRs5HY7I1Zbi7qSqtMxCugtqxSqtMxIDneEUzNJZbR:D2jppNq1FuHR96OBostq6bn89x+yU/
TLSH
T18665D8409537E38FD1BA6032072A5B4C6BA4EC167749AF2773C8053AD82AB55B4F83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 750c235fd132ef76529c848cf4c6970f366549b170dee1102403ba602bb0ce4c
MD5 c2e6aefde10bbc45b8fe358a41aef086
SHA1 cd475cfbf65157fab7d4bd7d8555ecd7e0019b07
SHA512 ea816148e9994c1fe7717b3356af7bbba981608e318f73ee084a378a142340bfcbbd09729e0a5a2cf0b3b7f871179f39fb22715ff13dedcab0104c467eefc2f4
SSDEEP 12288:WN74BzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxbY:S4xKOM730nZ6eSJW9l9bY
TLSH
T114652382C3AC6520E53A27B844C8C6B6791EB788CF40DAC7FB52A7D25578FD50E31A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a21e66964707d47b7a02ebd3866a20a8572b1268dda153c6590084db879b175e
MD5 1f7bcd61bb3960326bed1298d0329c08
SHA1 d6be2000ab2c1f2a418c53ccec8e23614a9f9e26
SHA512 48e4d7afb8c5fca0e7fbf45d8de5766ae5a224516dcf18ab37f49502075b438546e9eac1e57817885faaa96d5295483f22cf9f89b9a33322578ccd433b5e0f3b
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYSxKOM730nZ6eSJW9l9b:Sgb4mBIBhGFfu7yYdOlB
TLSH
T10C65AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 af3ba5a85803035275a887f43485026c83af5eed61f96fddcc40ea6053a88262
MD5 7e018985ae31a2f5676ffca91331e103
SHA1 fdb73a9b5e594186b62b256f5117fb8b6e17ed5a
SHA512 940941b7a748d6c08515ce904aba139cc9a785bdc1b826a4128279d315f5d7bc0cce41a5a5fc072d60b601dd2bd7154d9888195a116253f1c36d71f10ad0aabe
SSDEEP 24576:hG88u8FpJqH19zria7/mPxKOM730nZ6eSJW9l9b:k7ZFPqVka7/au7yYdOlB
TLSH
T10A95F165A7E501F0D47BD138898686A3F672B4150364EFDF07A88B911F23BE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c4692f425a6e763d85eeaf2eaaa2954b51c3a7614d6ce0878a314e775096cc45
MD5 6cff267c0cfaea7508d5af307e662727
SHA1 f42189ac51be2a8bab1880a2ca596bbfd77c8a57
SHA512 1964fac988c3d4be07be216f3154cc87aea2632774f93adb2eb5c212dbd2c5a99ecef8d8001d3351f70f3edd95d5bb1b1d047cbf2f38d0d4bf757273776cf82c
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTu7yYdOlB:iG05lO43b0u7yYQlB
TLSH
T1A9D5CF6A62EC11F8D1BBD17CD9C68A0BEBB23415033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 18fea6568149a7667d83f0a356199fa25a9176a1fad784a2a7916ff79e8a57ef
MD5 39cc4898b134cde17d6cf220a08b20af
SHA1 d33fd6aaddbff1f9e7369a8f17ccd2c598a2b7bc
SHA512 c43f4b2ec73f8f85e779d977948ed9cb352da07b4760f75ec047b77be34289ba7e9364bc0c0d913886085d1b571e83e1950802375cb2707fd7fa71c003aea0c0
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnVxKOM730nZ6eSJW9l9b:Xa5POZ3lJt2pasx2+mru7yYdOlB
TLSH
T19765BF5EA6FC01D4D179D17DC583861AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3b93840962918749b124a55559a705b483d71a0742ac71a8177fae947c3a4584
MD5 8f5cac8948dcbd2934150adc75ee79f1
SHA1 14e62fee85afa852fd164c75789269215b695b42
SHA512 a1f21017331752dd861eef5fb81f73742412bb69e987e8ee169ef7a2935ff200e899f511b9b03227c1b210932aab1a5e66c070b1c83c7801a54a466b5b9ac59c
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FknxKOM730nZ6eSJW9l9b:hNc/zEOVHF6u7yYdOlB
TLSH
T142858C1623E901E4F1BBE1BE89779546FA71786953308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5f503567a2d8c8249dcc6553c56392084d7b6b357ef59b3da631c6b96377d934
MD5 3f417b152753d177b18c1a7417a754ef
SHA1 1c5dd2b179089b788094b8a6aaadeea75544c1b5
SHA512 31f9b969580584af936db472dd0a48dd4cf65e90d7eb9e7a36f95c3084961fb9acdaf4156b1a9586b15de370a43c9db3370755f4c0ae36c35028bcba9412a4f4
SSDEEP 24576:qzkNvNnaFeYhJNtmZBmRxKOM730nZ6eSJW9l9b:qzMwBtOmRu7yYdOlB
TLSH
T12455AF6EA6B846E4D1BEC6B4CD238512FA727461073293CB5390C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 68c36ebc0854a6ec96b30712f2e114f4244240abe6749aa36aca99d2c032cc70
MD5 f3633a130e303156272c54c44db1313b
SHA1 06bfa6c0df613fd814328282f2cfe3d0d23eb011
SHA512 fa3aa37bf9bc769c72a50658e741dacbd5d33591b2c7da50a9d9ef1a77d1cfd0547ec8f3b7e3b9fd130f057ea2c4b9eec4f1a4d29638576852a7b46f0de96f45
SSDEEP 12288:nHvUrBFrEjwaQjBzIg3C1YpM730nZ9wvpk7mJKNltBBFkI59dAm0DgLrTxb:nPUr+NQjxKOM730nZ6eSJW9l9b
TLSH
T13285E15F62EC18E4E67AA17C85828719F772B4520712D2CF03E1827E4E77EE86D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7304277f2cef722161a107a45d3af51b598ca64138090b111f5fdabdcf6e5008
MD5 2d5bba5045a2357eb2f55a62fd006f04
SHA1 2ee3363cc3678b4c64c397a3877f2a520472506e
SHA512 564fd1da3471f30594e246e2d443caa4bed629c38344a6c61af8f7dc6d254a50eec6a400076816939bb28a34af61d4b382af38c2144f579d4f683601307a02b1
SSDEEP 24576:LD3FHshBIYQgAExKOM730nZ6eSJW9l9b:LDVHeBIAAEu7yYdOlB
TLSH
T18495E17EE69C04E4D57BD2BCC6938A06E67138AD032256CB12D4C1B61F6BEE42D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-309-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/380-79-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/380-80-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/380-85-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/2136-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2136-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2136-78-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/2136-0-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/2136-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2424-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2424-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2424-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2424-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2424-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2456-55-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2456-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2456-271-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3040-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3040-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3040-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3040-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3160-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3160-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3160-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3160-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3648-327-0x000002F63E510000-0x000002F63E6DA000-memory.dmp

Download

memory/3908-294-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3908-74-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3908-66-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3908-68-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4372-40-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4372-47-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4372-46-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4372-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4372-53-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4372-51-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4988-97-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4988-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4988-329-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4988-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4988-91-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4988-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5188-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5188-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5188-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5188-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5832-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5832-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5832-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5832-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5832-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5936-116-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5936-312-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5936-118-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5936-124-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download