7eb168b517c61280bd306c5aca2fc365c5803e064de3b1f35f03c3424182106e

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260730-vrk4bswxfx
SHA256 7eb168b517c61280bd306c5aca2fc365c5803e064de3b1f35f03c3424182106e
MD5 a43924b0f0b40ec681e50a987f97192b
SHA1 dc491f16ff4d83931b2b3e3e71f984c2aa6ba5a0
SHA512 6183170b33782400ec67b19cffc4b517437b134cdb2fe95b6c75f2bb761efa427231e250658d86b8362352eed1bbcd1b0c936485e03176b4e4b676cbf077ea2d
SSDEEP 24576:v0/C6C+H79Us2PtOsyZpY6mctvE/BT76+1NCE:v0/LsI+6mGvKVO+n1
TLSH
T1DF45E112B7A101F9D0B7D179CA558A75FAB2BC490720A7CB03E486562F277A15F3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1336	elevation_service.exe
2848	elevation_service.exe
292	maintenanceservice.exe
4744	OSE.EXE
1736	PerceptionSimulationService.exe
5136	perfhost.exe
4920	ReFsDedupSvc.exe
3228	SensorDataService.exe
4740	ssh-agent.exe
4900	AgentService.exe
2512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28e972f683806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001485a3074720dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b27bb0c34620dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000056247074720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060c008c24620dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1336	elevation_service.exe
1336	elevation_service.exe
1336	elevation_service.exe
1336	elevation_service.exe
1336	elevation_service.exe
1336	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	4920	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4920	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4920	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4920	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4920	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4920	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4920	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4920	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4920	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4920	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4900	AgentService.exe
Token: 33	2512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2512	SearchIndexer.exe
Token: SeDebugPrivilege	5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5684	2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1336	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1300	2512	SearchIndexer.exe	101
PID 2512 wrote to memory of 5696	2512	SearchIndexer.exe	102
PID 2512 wrote to memory of 3920	2512	SearchIndexer.exe	103
PID 2512 wrote to memory of 5860	2512	SearchIndexer.exe	104
PID 2512 wrote to memory of 2732	2512	SearchIndexer.exe	106
PID 2512 wrote to memory of 1812	2512	SearchIndexer.exe	107
PID 2512 wrote to memory of 4832	2512	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a43924b0f0b40ec681e50a987f97192b_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2848

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:292

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3228

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1700 1696 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1700 1696 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7e533d171636d011c5206a2c3bbc4066a1f5fcfb2a348d838b8d64861c926c16
MD5 1dec67946158290c466c5c8fcea2a220
SHA1 f07e15e2a1de38d94a811e6f77dca5ab0d11a2ce
SHA512 c538960d3296f69b849b18c24d1a850837e8051ea8b7164702fc7897b32a4b1d0c4f28948d425e0819b7323b67cc22bd1d5c6218b11ecd78a687af8899db5dec
SSDEEP 49152:Gb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn06mGvKVO+n1:43q60jB7XeN+1
TLSH
T161D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 e5a965b6e786b7ad646ad1822bdb29545caf40ee767c294c7cd9027a1f67aca5
MD5 87dd9b85e86c77e179ff79605a831c25
SHA1 b0a5987f40c9606ad4902930744da86e6790515d
SHA512 8a3f895c38b6f479690529313e410836fbdb840aac1a73272751615a87c343fe11d4ac3e4217e54c2da6217482cc26433384de918f8f3d246858bd3ad991bbd7
SSDEEP 12288:/1XLsswWkxy2lRq2czAXtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:9XYfDtczAX6mctvE/BT76+1NCE
TLSH
T154850224779504F9ED6B4278C9A2C112EA737C9547A4E7CB03E4892A1F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f5ba09a8893f771017ee18fa76c4b90062eeabe8f1c0fdfc169573934be72100
MD5 a71c392eb53ce36e55ac9941e9a3cbc6
SHA1 5e4b129ac0e61a43f93b3e72f1d33e7069e014fb
SHA512 076bc71649b4229924f7da22a771ddfab35e9591ae21d49a7c9d1d58f1fb4a4fc0dba3af2e78041813fce686f86ceea417a5bcb324b4578e9707d82c54b4bca8
SSDEEP 12288:TXZNYVLeyUji0h90ZD0wxpGZIVutrHs8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:F0Le5ji0hmxqrM86mctvE/BT76+1NCE
TLSH
T102959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4aebc37b604999c59f30b3a309f61bc53ff274f610e40e65c9a971c55076140b
MD5 781d749258d5738e5286dec6d8db0fc8
SHA1 5e0f742f3eebc4b516411c9cdfcb0c17ff100536
SHA512 e65ecb261aaa73fcd2a0aa95637dc3059e73ab21ecb3d4959196286cf06be6f2cedbabe69d1595a59368df482ee968b7d6b221d1ab51c1bf820234d3696de53c
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWr6q8wyu+6mctvE/BT76+1NCE:T/ezSC6vUzPviHjy56mGvKVO+n1
TLSH
T184755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0902622488c3cfb3b6478661c15013d42d9b12f7160fc864c4fb5dda715aa189
MD5 a1eafb12e57d900a214d99e0439e6a20
SHA1 49ae07322aa48aefe01c72e9642faa152e3fa06b
SHA512 346037db666c338d5eb76b64d41ee84a10dc16716c11f397804163d5d681366220a624d56595fe5615d4f848999e2c24cef4cc3e617ff5efc5a46f11c05c3c43
SSDEEP 12288:SVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98LtM6hct28uP18WR/FW2Gb8JTCMx:SVbqPb88hv/l+bL6mctvE/BT76+1NCE
TLSH
T16F55AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 78a697cb50e339a7f4c7bf4cc8ad7f815eba98a87fa341d740e2b3bfb4ed264f
MD5 dac09ed9644b4ba5fc994dab1f30cf2e
SHA1 cf0a08b3ebbcd43313ac4ecd85370adeb2def95e
SHA512 df931ef18270bc994829b8d7d4893adadebc384245a86e2da03c5e94187a3363942e4a6e247f4c13df1469cb9d43baac973da9e92bb5636bf0021b5da7a1d7e9
SSDEEP 12288:XMQtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:XMQ6mctvE/BT76+1NCE
TLSH
T1F2652382991B11D0EFFF07F06395E296E8516EF934DA1C81D322991F9D30162FD0B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8a8eef808165a15a4f76f03f9422a65cbff9815c87ef1541d40e6272057ff8bd
MD5 e6f0d384b3011c7d912146889b37b90c
SHA1 e0e3cd01564fd35a4c34da2cb76024f53ae52b57
SHA512 5446853b2a4111eb8ab015cf7983ac1b9c92a122bca536d39d2275242d8cc93b075001b3ea3a2b2314cf6c938ac9a8bfab3a64fb621914fab21ed1a20b24d4a8
SSDEEP 12288:ReBNUbTVO86UztM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:RJIUz6mctvE/BT76+1NCE
TLSH
T1CF85CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c15c014d6f84b78fac23bc3541687ee73c62e15cd091bcdcf3ea3fb5b0e7db86
MD5 46b2e064c049e6b6fc94d2bf3ab8be4b
SHA1 93cc181b87df99c087d473c16810c6d2afad0f64
SHA512 79e02130759c55fcb98db134f4c748c8b9fd5880db60019a4d0340fa75b1dd31a1eedecf53cf49d812587774dafe379793f417ca3079d87c0d0d6f646461258d
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THN:QQvGAdlCEL8c/RRNw5COXeN+1
TLSH
T197267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 164fc655b29fab53e86922c44980c786a9f25420a4b2339f3b110409632fb76b
MD5 95ed9c14d650ba1fbe4fb1a1ba89bfc4
SHA1 c7053fb8706e255625b232a4ac7d7979250f0a1b
SHA512 11816ad1c2c0dc70052f14f461942754412f479bd18ae56029fe96b4f301ecae9536915c0eec791178e1287bc347f3968b36679c9c7eac6ebb64158aa266be8a
SSDEEP 12288:FAwSfxL/2Dc3+DLLmt0LDQewsAjNtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:mrewsAjN6mctvE/BT76+1NCE
TLSH
T1D385E031FE75E036C6BF0DB21B26D316547C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 681119d16ad4aedae92a1ef1c5e20622bd80509efd5dbfdd6402879bf26d618c
MD5 3838c7cb823b59da7fcc2cba497ad5bc
SHA1 5e3034c381a7fb8334a07c129fe5ebc9b2e5b4f0
SHA512 d28112276331ecebe30d435fd54c8da738f01f46320a8e46da071b49c2b6b569a0173d26618b3c73962a85e59261677204452bcd50282379d734ee776f159b04
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHFXeN:XUEtQevvqc2W1cpV2RI32le
TLSH
T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ac822d0308108c25b8fc187049a49dc906be479e68ae19866c37d5155e53906e
MD5 76791106fe9071c4cbce236e9d760956
SHA1 913bb98977e137da812c0e6f0af534ea67d6ad7b
SHA512 c03c42f29f7e54088cd79146b49d6e4c9a0f925f6328de79adacc0d33d3f3e372a40f19cf71f4ede335adc112d5063badecfd547d8d85506897be98e7104cec6
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zt6mGvKVO+n1:FoqtVjnmqXeN+1
TLSH
T1BBD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1a1ac8423f3628fd1e4d22c85260535c9aa3b90455ad8065a16bd770ba9551ce
MD5 0b7c5b240471f7cb51a001128596e064
SHA1 67fb2fcb12045c4303807b3d0be039f374a3284c
SHA512 17e125b6b1b492baf1ceebb5539380d83492f353d661f7ae5acfdba397a0eccb7b05c7670be9e18fe7b7ebff5f003021257a7242f4720512bfb3fe448c0a6306
SSDEEP 24576:JAhGL2IFoiwtA5l7S53K6mctvE/BT76+1NCE:JAM1Foiq566mGvKVO+n1
TLSH
T1F7359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3be7af2d6abae8545dc95d950a54c65555c9c48b169d618baca26972011ae284
MD5 d505a9588a61abca62a11e235791052a
SHA1 e10c22bf2a88ca905102bea52be41e613de7ace7
SHA512 41ce51a7c05f93641d9ca977fd0059f199c833a5668dff60da970d055f081ea6afa026df922f430060d6535aa83979e01c8c670dbe0a3057b1133d29034474be
SSDEEP 12288:lmw5HEjsChNDBFgl0WDm+CetM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:Awu2OWZ6mctvE/BT76+1NCE
TLSH
T17F75F14676A508F9E9A742788657C136F7F2BC513A25CB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 35af27720e63dec465e346f5fccf180399a2ad64bf2d67a29eebd23ebc906ba7
MD5 59c4a6ef6312929a4b6be336b2214dc1
SHA1 b836ca29a102ef237e6d853a98f3453fed319de6
SHA512 666b9d5e7b0be31a9c6f616cee84672a4c2e356ab96990b414de8d870246ab8668d6ea61db6b3a519f85f97ca029afb135f742648641b4bed10a3f8b4c0eb525
SSDEEP 12288:VMZ1IydtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:aZuE6mctvE/BT76+1NCE
TLSH
T11B651286226520F5D5E702B8C9E19245E77138E6377603CF5221466F6F33AD26D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 62f2c59cd80a0ef6fcf3c1a076c85c5b1c5f75f4b0d93d28f8c6c703c9ed2b9c
MD5 f16270059d6e707021ce3dc0a5e2d61a
SHA1 e80b08f44972d5404570ad1e27cbfb580ba6f4a9
SHA512 124a9c8775ad3403c7bad12dc2fc235f57c793a595e3ae05d627ef9e8301001d93105dd8e9c3a2930e9ebd845ee53e818d43a4f8e2ba8c943ab91be032a16e62
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UB:XQRQyi36YOcPhLvw2gAf+PN3/XeN+1
TLSH
T15B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a5238a807da34f867b6fb3fc6f79e57d28ed65bfae56c00213788c50f7e8b2f9
MD5 594a55cb3f1555235d6e7be0bea2aba3
SHA1 524f338524f4a079c02785869b04d06298890647
SHA512 2c07c84a69e8e72aac544a52f4a470b44d2af23679b8cec6533ac8d82e560208d9df4d5d01027c17fc5fe694cd1c7ca2054aaf835ff5531e998973d9393f89d2
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UB:oQRQyi36YOcPhLvw2gAf+PN3/XeN+1
TLSH
T1FA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3b929a2ebeef04d7b22e496a5d2e60e4f11b8c85ca06f67482f101085e4e933e
MD5 9271af3d49e7bc86857a5aee76da7297
SHA1 a510f9a478e591c44862320eb56065a24ca0cafa
SHA512 1bbc4949b8a86e8be3d2e6900cfd8d84a2899c72a5c1c987c2cabb372d2827f269ff1ede018628a8f319f5c31af463c26c9efb5fde4464987d41c8f83fb7f9c0
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL006mctvE/BT76+13:+68Qg55nhceWu7PNU3/96mGvKVO+n1
TLSH
T185B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 30e01cfaaec09a9199af2ecc538ecef2def1f0cc9e311f11ba0e7242db1ff20d
MD5 6be461fea31e388307345e14d487d85a
SHA1 be5bb46d50e5f38ab14ac92fef62eadc555bbbc7
SHA512 4d087743cdd1411035fe9292bc714c9f46ab7df66f2952eedf4b460631632a4bdf824898a702227b6d7b3100678bef9520263592ee515d0c87f0439d51bd2855
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk993:jy5112gYy5azzVva69nLKnhZQXeN+1
TLSH
T1E5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 05e4540df2ec63da17de65fa1d2babce9fd0801a978507a1f126654a3b2b4b18
MD5 912ed0591c2f6e9d179edad205e8e180
SHA1 70c9e86fb575e54d399c4ed5a48fa76f29d2d034
SHA512 7af2bc4b066a01271cbe0f0656f4ba21cae844e154ddd8a7d9b747262719111f3a7ce469d5b19140218cb1096ae9e13d45b22084a010ac1c42db8b364191110c
SSDEEP 49152:RB+taZ3usBWOBr4tEG20bqx0z+n217aau1glH6mGvKVO+n1:Hu6JmUxd2dHXeN+1
TLSH
T159D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 928e2844e702b722f47dc84d6eb691653e317ca404de2ea0ab4e03060d5aa0c0
MD5 c957ac2513d9b2b25baaf545f260606d
SHA1 e2fb4e01d299a704f63b0a36dd0bb41db1f24adc
SHA512 bc6e43f6ca0573ec75a116854988493d4a5fb160edc219b5e7acad97f8ebde082f66cafbfb15d36b6bb212a9698a891efcc21cd22170a04992ee30d61c124d62
SSDEEP 49152:Q1hpsNoJpF1A6BU44CwH7R4xT6mGvKVO+n1:QmifPkRqXeN+1
TLSH
T18BB5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7758bb14e0d8b4a63f4ecbbfab191057c2769dd54feb0175af12b3112b6b9ad7
MD5 259c2fd3688b088d292851fd398acb99
SHA1 bf0a4fafb01eedfc679fc9eaa5829eef8b1cb7d2
SHA512 b1284b426c4d0f404eacaaa451f04bba350fac1a9ff952b9dcff77bfdcc374dcb0fb0237fa51bd3e3b58d6b57834425c3f13a42466de4c1f5fcc11f338c976c8
SSDEEP 49152:KSuZQIY0Be2KNRVtOnks6NMHqE6mGvKVO+n1:U5dKvi61EXeN+1
TLSH
T184C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dc311677c5df21c8cac24456e51c4aa7d78f3d2e5ad80c04ded935b33d746621
MD5 a8e3445f9097f9434f653e8e0ea17d59
SHA1 f4821c6645a58439d999cae6b84677f568f08a10
SHA512 37e03764900bd7eaf19bfd5820472f3e17964d5ee8a10a68d9a3881fe884afc4e2422e973a98708cbe14d04626bdf31b484ea4ade575c30312148b70d5f0e6d4
SSDEEP 49152:OhtSn8EApI0figXgiDn0AP5wX6mGvKVO+n1:PX2iyphmXeN+1
TLSH
T1BF95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1ac68354c2734c3d48981b20366a925a1719027fb505de26341f659258f79972
MD5 ca95c2ec2faf813dbd6a89253420a3fc
SHA1 c751aa660f391ce23a703c483cc5591e3d5ca2fa
SHA512 13911412a63b9f29d24ad0f116c756007e148c6acf851bec2d2bdf6bfa5c8af971e588e7891cab8c28d1d1fd1bb94141234cf1d9bddbf6744d199d1da67256d5
SSDEEP 12288:44tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:446mctvE/BT76+1NCE
TLSH
T16C652381981B01D5D9DF07F09395E29AE8502EFE74DB1881F326851FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 9b47141718d3a0e1250a20fa212c4b90b4c9a6a485ee347ce0c8add33a4b4df3
MD5 c8499e0baaa9d19fb5fdf8411478eaa9
SHA1 505ef96387864c96d93d9e7a5db8aafc57904427
SHA512 d89b77f6e72778b804b6067273ac70ee2894ef69803846a9e03fba24fd9252f73f5c06586c739062dcd8282350cfebd92eb91837149526c45438a4320698f758
SSDEEP 12288:PRtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:PR6mctvE/BT76+1NCE
TLSH
T1F9652381981B01D5D9EF06F05395E29AE8502EFE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 e2e39a2a5dd5cf48315aad802873a7f1b774b4151a2d28a11687a31f92e0954b
MD5 0c1b9cbe65bb5fc7afe17ca50d882b86
SHA1 6c88c1267ba2a84fddfe9e9e844cd1c21cc324c3
SHA512 e3141d745a341c4f2bfd70af01dcd4225fc04b1c6e899437085631cc0b5e234a17627913f3702acf83da407e4a523efad8d958d63c66458732fe2e052488af8f
SSDEEP 12288:G7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:G76mctvE/BT76+1NCE
TLSH
T10C652381981B01D5D9DF07F09355E29AE8502EEE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c14ba1ff0f2f1a88843968df30001a4adb961770fc9a33c822f5f560472302d8
MD5 402918cf40cbb8cadc93679ed3c8e9ad
SHA1 e4f87b230711d80ca7acb55e936ef26f6cf89a12
SHA512 1e233577f32752b68ac32390917ecab885a240913b2922de292c087d9755da0a2c8a6b25beb2e6c098521fa23d15501d5ecdc63ded869dd9a91898efeef27f3a
SSDEEP 12288:HVqtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:I6mctvE/BT76+1NCE
TLSH
T174652382692B01C0D8EB43F0C6A2D256E5B07DE975B719CBE311491F5E303A17D2AFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 81a96582746bd600046551c2f9ae3e435ce0a454d84b037e0844dc5d0d31b129
MD5 1c84bea6a51123b491d4e72bd0cb06e3
SHA1 07a2faa6b4fd1d63d9bee676b4018907b94b240d
SHA512 308a103ebe2ff7c20031c2871b6b1a6caabfc878c71847b9d64bcf7b6fdc3902fcfac127919bfb193b30436c156897db5d7ad1c76cf220fd42635c8f4830fa48
SSDEEP 12288:TitM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ti6mctvE/BT76+1NCE
TLSH
T1AD652381981B01D5D9EF06F09355E29AE8502EFE74DB1881F326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d1a54cb702ad617d7cb83097b84155070b9ce266ad5162dac8b3246e60392218
MD5 e67069d301eb087cb695f092e9d7141f
SHA1 585f5213a181c07166000a83a1671710b775596c
SHA512 9d9340cd6783344f7b6d4fbd3ef847b84c2c53bf58b6c6642f81b2b30bcfd67a88ecf091148e30c368a494bc4a8e4d5a062b844ea8f88b58c2c8c3e36d8b9f4b
SSDEEP 12288:SVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:SV6mctvE/BT76+1NCE
TLSH
T130652381981B01D5D9EF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3d6a0e5e9c2c714327d9c0f2e29b523c0eaab50ee34e69242e95895d55aec415
MD5 7f67ec271bca45a2a276b65a519436d9
SHA1 24597f047ecc1c6b8ed1fd15a1a004f5d6af6f07
SHA512 d05254b1ee8da7a8931a99797ffe39d8f0a84faa1e3ab9964e4da168925fbb583620fa3036d55da8bef1d2eb6b57cdf1f77b2cda721b5b495ab05a72a6070964
SSDEEP 12288:nJtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:nJ6mctvE/BT76+1NCE
TLSH
T1F3652381981B01D5D9EF06F09355E29AE8502FFE78DB1881F326851FAE701627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 9f0e8012ba2fee038a047a9cf06f53c6346d819ed26dc31d63937dc5d9b03675
MD5 2a925e4d3c8095bee74dfc8b759c0ff4
SHA1 67856bac973a122aa48a0da4c430b1c2648e95e0
SHA512 27211f4c702617582bb4c97b6ad3adff8287d9e8f07dc4a2a39d4025afb97a18177b6b1955d984166966ddb35cd297952e47f1d88a37e383b61be6b05c1d1bbf
SSDEEP 12288:UiZwbrzzFEoS2cPvyxtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:3ZM/zFVSOx6mctvE/BT76+1NCE
TLSH
T17B850295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 86a999bba7ade9869ce2f34735ad96370803d638a0c18508b94ba1b83d0a94bb
MD5 a6660a864ed1ea028f49c3554ec3f553
SHA1 6aba9f8df8d4cfd1dc0d1b310014d8d76750d98d
SHA512 573a2dabc39064bef6b7cfcec57ea6d72fd0af22e443c9ed85d61cc3d3ec45ba07df87f753191754b858d6154444fcfdb1b4aadf0ea39557b2b3962ceb6a23fa
SSDEEP 12288:5UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:5U6mctvE/BT76+1NCE
TLSH
T1DD652382981B01D5E9EF06F05355E29AE8502EFE74DB1881F326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6ef36094f952b82e6e140b1227621c37e9ebbcb2398b8fc6e385f08b87a18cdb
MD5 9e32c0cb78daf0ee5a9fdd9d07093492
SHA1 5802973f8a3f9ce2ff6ab39b578118c9ec2e9528
SHA512 0d54cf44d50351326acdf009894dd25bccee15b927e080b7af0c40db74472e573ad085c873f837138852b6360a949d4d1b99e7f612040c7f7868d2adc4bb62cf
SSDEEP 12288:wgtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:wg6mctvE/BT76+1NCE
TLSH
T123652382981B01D5D9EF06F05395E29AE8502FFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 a4f31c960a98c7a5fc4e663bd9d5e2436635b5d1ce5c85a7c1db943430591c9f
MD5 b5c677c029ed6ea5a8a1b6ddb245addb
SHA1 871c61f23f6fdb525acfa7813cf8f9472135100d
SHA512 0b54ed0e24ce2e625325cd9c37d55ccecf8d808b23b0f37a8003ea2df17d2d8272666ab5a7e67596330e2130f6121fdce7e47ce8bdcd8fe59148def9d202999a
SSDEEP 12288:1yPz5L8dtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:czyd6mctvE/BT76+1NCE
TLSH
T129750143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 8828023e7a1437c28309058dafd46b0b67c5f7823bc081667b367a208b07fc16
MD5 8c8e819d5005940a053c182ba70257ca
SHA1 aafd8703ae050c091dc4e6efff3fde8ddf6ca292
SHA512 f8e7d82af8068ae8d4fcecaa5cc99a96a306a51a007c2866da4a6f81706de912bd9b347fd1c1781ca758a8758f849005c55c119274b75dcdd539a4f7377e95ec
SSDEEP 12288:OUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:OU6mctvE/BT76+1NCE
TLSH
T158652382981B01D5E9EF06F05355E29AE8502EFE74DB1881F326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 5c4c333fa5add2cdf518a8e07f13b5ade164c64abe99cf8fb7b8c4c0e10ba397
MD5 9a174510267ab2c47fff87e8b7d60e7b
SHA1 7763bbabc7dd5c4bd7e748c050567b56c24a972b
SHA512 e0cae1665af9a0c03eb58d0338bfdeb509b94a7a7c23ff9e4e418a50a9cefc8926bc28d2de9ce2e3d2fd7545a59ce9f3e84a84cf1c97642dfc2632afc47d58ce
SSDEEP 12288:pUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:pU6mctvE/BT76+1NCE
TLSH
T161652382981B01D5D9EF06F05355E29AE8502EFE74DB1881F326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e2618b37ac1a2891590b06fbeaecc2fc7b8cda647b7177b047bea16e9a973957
MD5 712d658e0b5acde522f0c1dc83ba9802
SHA1 fc190bd4f9424ef0f0389f76ef47d9e4ca8905b9
SHA512 54d8cd2666f8744b57eac3666305e3cbce10329bb9a08e26a0319a5ccf6dcb39335e2d226b8312c0c5d03481352614c108a295409876d7c8081544c580716c52
SSDEEP 12288:kyPz5L8dtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:9zyd6mctvE/BT76+1NCE
TLSH
T19D751143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 053c27cbbdc870db0f44818f331d9d04df50e9442b670c8823418259b4e0a9d0
MD5 c970d19b8e0ef450e4cf338833350e96
SHA1 c8792201d0c3fe45be31877656cceb2f922a9d4f
SHA512 ca53cde973afa54a68e3befaef069e0d1c44a5295671b98fd9c443a8f458024555bd64f3d9bfd7ce41003249abdfe8aec633a2760c90a2ff91cdf66ef3f4c594
SSDEEP 12288:4Cd9NWYoaLHF3z0z04PDvhrtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:hT0aLl3z0zDr6mctvE/BT76+1NCE
TLSH
T1D3850294B35118F8DCA7427EC9558506D6B27CAA17B0C64F13B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 adc2ba2e4f90e04db438677b11b4a51b1c6c3ce87d6ebc775fd1b9e4779e5b7d
MD5 215fca5dfcaaedcc8e53992229f17d06
SHA1 249c7b2372b8540c4baafc203be52f62a9887d5d
SHA512 c46d134abf47cdc614975c8615f1ad97e2441caa536bf14d7c666d75f95f2d5ac23998724a5d017c870380e6fab14995a6b4d202635a79d7283ff573c80b0266
SSDEEP 12288:Ui4e7PRdTfgwCHKy7GLbbdIv2tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:U3Id9CHKy7GZf6mctvE/BT76+1NCE
TLSH
T17195CF90F3E410E4F0B78A7589769112DAB67C9A1B71CE8F03A4661A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e0f4c19876b5ecb44ebdbdfd503650c8db85b3d612c63d986f905c96630c7a9f
MD5 0a7c46fb9fd4c06c6a4f44b15be75093
SHA1 5c5031b1dd1909acee93601ba224c1f423944d2b
SHA512 b9f95fdee2edc48329cb9ec499920a98f86d406ab61508e16b3a058b218fe27e021128e58ae5545a93ca18754f28328ac9d4500240c22bcd48620e7a0178cd67
SSDEEP 12288:CbtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4L:Cb6mctvE/BT76+1NCEH
TLSH
T18F652381981B01D5E9DF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 c9220d577248d04717ba0b300a53442c00923f10f4628d81f6c3334ef6f0b2f1
MD5 20c97d182736c5ce826657a6d8633131
SHA1 63d5022c25ef594f8f65ec8f80d6377145002165
SHA512 36f60ca9471615aa67e2910b45403802c68767b1bac6ae45472f20096eb54cb2b0a1e0b342e8a60b7bef0098c86a69f7451b232cb4e9cce774be4a9415acfc4c
SSDEEP 12288:P9tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:P96mctvE/BT76+1NCE
TLSH
T1AC652381981B01D5E9EF07F05395E296E8502FFE74DB1881F326841FAE705A27D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 389d7a0a96805cf73f5e5d410073b01acc923f3574b7823a3220f83fe2229364
MD5 d021847cce14c79444678bd4703fd332
SHA1 5dbba9e4824449b953b1a359f4a6812cf146af16
SHA512 4e48902ae8d5e53893ed9c8e61583afbb0239ba34d85597fbb8272767ec97971369381a3e1cb27b37ed987cbe2f9eef4775a72be65e8a2b5e1fcdb7656b7e011
SSDEEP 12288:H2tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:H26mctvE/BT76+1NCE
TLSH
T141652381981B01D5D9EF06F09355E29AE8502EFE74DB1881F326851FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 e6276506c8bc8d25f1c079b80fd0914b49fbf5fa0146eb55aa4f6df50b81dfef
MD5 cb37b12a40bdd82f9db267bdf52fa538
SHA1 faf33fdd726601e2839dce421ef1b002ab5f1e92
SHA512 84f4202fd3e55cf05b9ffa5854fa095e770cea3d4aaa51ab1ccf27f84b49545ff687cc570cce16ce61a7518abad8458e37a03083a2593f0bb710b1851c74e2ea
SSDEEP 12288:CUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:CU6mctvE/BT76+1NCE
TLSH
T123652382981B01D5D9EF07F05355E29AE8502EFE74DB1881F326851FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 ed61a7b764d0b7aa91c83702f7499a53fb702fafb0a59ac496d761a08450e583
MD5 1f32715e2fe1b3135f376a25893ed08b
SHA1 e4f0fdf78b565d6b937c8b42060ffdc5ef81c340
SHA512 60537aceb8ab45c152146acd5e5d2ed14b17d26bce2a1df688d67cd02c82a9f82826231ea2c63b05eb7a3feae041dd43bb90851d7a93aa9c0d49b57d0991512f
SSDEEP 12288:ebtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:eb6mctvE/BT76+1NCE
TLSH
T1DF652381981B01D5D9EF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 54bcde994f260d5cc80b5df78dcdf96c87fd150244b37caa303ce72d4f9b0a5e
MD5 bf9a665358edf5f5d66bf5ddfe69b3a6
SHA1 6e37e24563d8284209f5c6f29fc6536e28bdac34
SHA512 e0531b0241e0bb06d11c4b53b63f66607da19cc91264859f33d2fd5d8539da151be5c4fd33bbe6f0741c863623e1c2f5bef1af69ce91b4381358c3005fd61cd6
SSDEEP 12288:QstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Qs6mctvE/BT76+1NCE
TLSH
T144652381981B01D5D9EF07F19395E296E8502FFE74DB1881F326851FAE301A27D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 0d6e275aafc136a469a12e00c6a6f29582a601e144720b7276a321efbb48a596
MD5 c58bfb759030de065946d2819411dcd3
SHA1 6ee2d4df10bd5a33811304ff9f5372aab3ad94d8
SHA512 9c9e0d0054ae6ad788378b8fedf03d144da8211eed3a8389cf42e858b8cc7e72e405c0bde89d31959d0ca409ce91664f69019352e928284ee4e0da5fc3f858dc
SSDEEP 12288:6itM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:6i6mctvE/BT76+1NCE
TLSH
T19C652381981B01D5D9EF06F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c4aeb9e285225595a3e1995ff8fd5dc0e745d3b81b5c3c9b7a994189ea2b4dec
MD5 3ae2045abe9cac66bdb93183099e9fee
SHA1 881fd9a42dd2a5461ca8f1994096f6d271b5b651
SHA512 a5f075d8fabf47b75fde5d3fa8f6d1033bdf9a3bd11bb44718585f194daf930c25c035eed3a67e89702c146662d82a1b98ce7c5a83d5b2d344220938549758aa
SSDEEP 24576:Sfwvik9RX6wkyAIw6mctvE/BT76+1NCE:8MnYIw6mGvKVO+n1
TLSH
T1D195D029EBDC04E5E1B7927C89B3420AF6B178691B31C6CF125A536E0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5b75938e8faacaa491a341f51a5649a08df89770dfce3e4c36d5c8034398a6af
MD5 da1606d7148849e556f9255538ef9433
SHA1 7cbcbe84e13adc310674e0f16749ac72afe6d2ca
SHA512 b3351c478124b9ac7dcb98e9d067b885e627d8b0abd47428a08ec3ef5786ecd2f52d6a7aab667869cc8bf5c690c4817726ceab797cef37ec4256ac63014369cc
SSDEEP 49152:DYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK036mGvKVO+n1:dySzPfXeN+1
TLSH
T1F4067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 92668a2b8cf14f6a5615ec0336734a7933ec91d46f48aa26fb6eb3aa82e53604
MD5 30faca4e9a8f3ebba5fc82b8e5c5de43
SHA1 ff8767263957f87171075e46f72d47368adf82f2
SHA512 53b8972dee1a60f0498d1beb2211600ac0f2d5bb8e470f777571acd0970aae015a4b5e4679d0e93e43651f083d10abb9610f1f764215d3b6b425006ff7d30fec
SSDEEP 24576:J47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYB6mctvE/BT76+1NCE:J47JUQj4irIhCnDHUPfF/H6mGvKVO+n1
TLSH
T18E65AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 9539d5e6ba1d6e4d8e3c58f75664be9d3c6a50ac7009e77f7669d5e30de0d958
MD5 90ec073331dc063d092dcbb92c69dd41
SHA1 2da5c8d08c168bb311e9174fc3b08376887afa8b
SHA512 9ee4c43ff364fa6d80283ab2bdff2c7694c6f25932c9547ff86e8e8d22acb07dcada7d3c07042165db4513344a6de6fbee63af8087048ec382bdf96837140f95
SSDEEP 12288:i1sfEtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:3E6mctvE/BT76+1NCE
TLSH
T18B75F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 984KB
SHA256 deb4efcb0c41d6248e48af3d4207fc3fdd4347ae84cb9d0a40f3134f0868382b
MD5 967bcc4554946762c2040dfc238e53b8
SHA1 1abde238403973698569966db66be77e171ae6ee
SHA512 31e44b34c4dad2d66afd360033bf83ab348b68fe6d722bfcdcc93279ef44d2a4148c84153740b82c3628051266c64a91c13eef92724330185ce0c31eb70546e8
SSDEEP 6144:ysBC2na/GNDR9ybZcbPotMxNXBIU3fUkIAarSI1jXgOqx+MuE35Bcrm6gmna8Xds:n3qVU3fIAaFwOqEk3Hmn1XdLOh4iJ7h
TLSH
T16F251850766AD75BC6AD40321E33D1CCAB707D01EE05AB0372C9973FC576668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 519KB
SHA256 7be458af374e479d28254bc0d53ff5cdb8537d40c00a5516454b38acbb8ee8b8
MD5 e53386e3c5c4a2bb9a82264d57e7baa6
SHA1 6158b1feb0a48e9316450974dab1795156f8b5da
SHA512 faca756f93d29f44d2cddc3eb19028059cc2be5859dbb5d78e052972a82de2de618ff26e69ea23ba15e28f689ebd45bf18db356086578b35cb8eff15943fc2ba
SSDEEP 3072:APxFNoFNxXjcK8FNGFNaV54qHq6qnqdze3:APQXjcKUV54qHq6qnqdze
TLSH
T174B4D841663AF79FC0F6A03242396B8DA778AC03BB056F1A27C4487DDC2666575B93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e1c623f3a9b2601927c318667e5ce6702b3c71aa26ea0b92effbe95f2120cba7
MD5 f7c83d095072ec760923e5121bf33173
SHA1 42e19f386eb32fd36d59e55bd4740838e896ba9e
SHA512 42d929b696e1a25713e3f62dbb751939bcab1581332072a283eda68fd98d0e3969dfef1089ddf8081a0b8bc34e0a508ddc5a5f77930d901392ae96bb6cf4187a
SSDEEP 12288:Fv7ctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Zc6mctvE/BT76+1NCE
TLSH
T1B1652382991F1184E9FF06F0529AD225E4157EF93B9A08C3F212851FAD305D1BD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 15d8ba3f532e9b6552b7099a5d26c4a9a85eedb2c61c255d20828fbf2ee012ad
MD5 a8a1a001a082a3be9ddbab965ee22fa1
SHA1 83c5fcfcd0087a5182b72790cbf92a7cc8992637
SHA512 6eb7dd024917bafa36a3be6d9f4e20e88e8e7f5784a7297fedc2a866d9d1258a5413f94fc636ad004d1560288d2a6792a2f6ad35839d9b51fc11f6b83c4a7da7
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bY+6mctvE/BT76+1NCE:rgb4mBIBhGFB6mGvKVO+n1
TLSH
T134659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 86e6d41929f6108ba125305619ee7573b0a4b395a9769e2553d80faa912e798f
MD5 e998d1864deac6ade73013a0cac5fdfa
SHA1 dfded1fadd6310a5cdef2a9586423a66299f7535
SHA512 58914a73bdf19c707787d16b877f6722ae7cd83f15e19c5e954b2ff06ec9d010f6ac68b32832679551cb48b53f5b9b9d2ebcf28967125332575703c2c23e3c08
SSDEEP 24576:iG88u8FpJqH1jzria7/mx6mctvE/BT76+1NCE:57ZFPqV2a7/W6mGvKVO+n1
TLSH
T19395F16176E101F0D47BD1388A864263F6B1B8251364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 21086bd90e7ea02683bb687541831b9231c6050e5a05d58fe836c8f45d278b3f
MD5 ef4d9aef8321f03a72e5d74b98eaa7a2
SHA1 1422d02aac86479f7406e218b014a3e65d771bb0
SHA512 ee520221ea645e9f1eb12322ae5394ca6b7baa06451c0b17b2df9db461000f682ca24f60a59d6fe95f346062ebf52c95e2c0c8ed427d1ad1fd0149378e572647
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjV6mGvKVO+n1:zG05lO43bIXeN+1
TLSH
T14ED5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4866baa7eb5f5a2738eea92cde0ef0cab289d13f1c77b8a5e3801a52335ac75e
MD5 ad264c733327ed2e6dcc7d25a9cb70a2
SHA1 acee32c9b162464dac3f28afd769f9a8b8d4b97f
SHA512 aeb2ebe973da46860fe4f4815c461f6a923226c760dc56c94a6245ee3472a4d77f01a9f4a3163d4a0793a34be04ff16ea3fc5b048e5185fe94a8d7a8f442943f
SSDEEP 24576:6fa5POZ3dpqWVM50JicR2hG0lasx2+47eidn36mctvE/BT76+1NCE:Sa5POZ39Jt2pasx2+m96mGvKVO+n1
TLSH
T14465BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1afe8ef9b719cbb3c5bcdd76fa4a5b3ab96cd49a34fb9abd2d204d7ea1a8168d
MD5 019d5035540fe43cdcb3140c42c1a0b3
SHA1 d4006cf70f33ee0a1cd5ec4f3d7a2e09ec8b3271
SHA512 0c5b959fc85ed3e4ddb964a27594b695844f9c76f26520abdb021a7c5b3cb552533992ff7af99b4b02f4dd2d434dc3ad24c4be3cf041f629023587c58f9706e1
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7Fk56mctvE/BT76+1NCE:5Nc/zEOVHF26mGvKVO+n1
TLSH
T14D858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 121d5073813369abcd7350872218008a5992e183c853d64e2089a5fc16ac11e9
MD5 63d7d6433e3031411dbb55d7e21b8186
SHA1 37e817c1db865891aaecb6f1e4c2466c92dd5eef
SHA512 3b9a6364d21db35f126ef3a19d53e97c2f366b207513ed1d2dad07e4ee74437d8bfc6e24a2cf4c4f90941c804dd92eca1fa1d57eb4a9ae97849436551bb3b6de
SSDEEP 24576:ztkNvNnaFeYhJNtmZBmD6mctvE/BT76+1NCE:ztMwBtOmD6mGvKVO+n1
TLSH
T1D155AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 6cafd3c2fd7b87c94ab9d5a5f4800a09c18c487950117f2a9ace662a276fa163
MD5 a1472d8261ab47dfba911bdd19f2f9b0
SHA1 6f17c8545cc7610b5bc7b173dde283eea001ae2f
SHA512 38fd3e340293807da1c14ebe4e0dd4a1a6541b739e00e5cccfeab97bb77c716eea87328f38c6c904c5394dc3f5cdcbe6f1072112b30928bd3db824932420b8a0
SSDEEP 12288:7HvUrBFrEjwaQltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7PUr+NQl6mctvE/BT76+1NCE
TLSH
T11E75F21F65AD18E5E67AA17C85828319F77178A2171292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 82d9a490cf86c6d9f2ca8c8ac9b95c9dd1e24f41d9ef7ca59d4502ec452809b5
MD5 baa9ab045a8975c970a4cd37414aa8ce
SHA1 b5e2aae5575210805f1935793b81b9d187fa7f2f
SHA512 8c15c222b3ab1719ebeccd759f1933a9f52e2fda27a599b481070f3633c8e5f2f6855990585cd31fb60d24e36ffed5dd67df9dfeb6ee408d2b65a96dc43490e5
SSDEEP 12288:VQcMxWDXN1Dp/fshBItT1IQgAYtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:ZD3FHshBIYQgAY6mctvE/BT76+1NCE
TLSH
T17D85E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB029481BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/292-53-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/292-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/292-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/292-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/292-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1336-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1336-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1336-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1336-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1736-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1736-68-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1736-74-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1736-309-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2512-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2512-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2512-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2512-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2848-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2848-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2848-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2848-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2848-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3228-314-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3228-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3228-109-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3228-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3228-102-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3228-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4740-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4740-115-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4740-313-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4740-117-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4744-62-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4744-56-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4744-55-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4744-294-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4900-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4900-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4900-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4900-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4900-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4920-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4920-346-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4920-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4920-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4920-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5136-310-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5136-81-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5136-86-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5136-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5684-0-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5684-78-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5684-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5684-8-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5684-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5860-336-0x000002DCD3600000-0x000002DCD3848000-memory.dmp

Download