5e0fc8d1d461c5fdb7dda08c0ff43026baf7ff57f57f5f11cda71527f58bccf1

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 11.7MB
Sample260731-mx91ms1xes
SHA256 5e0fc8d1d461c5fdb7dda08c0ff43026baf7ff57f57f5f11cda71527f58bccf1
MD5 e1431bf818bdf2673062dc9b4cb026f9
SHA1 8a4b8849c4d08b4aa55799c67fa55ef14bbef9fa
SHA512 d986d35a83c4666814f2c60804dab5aa91adedf58d6194ec6643363e550c82de0a02099d283d40d0acf739abc2ddd8c851dda9b4138ec74cf11dede70d51fcef
SSDEEP 98304:BpfXgO9/D8Ysznw5nv9Klz2rEvEFLOAkGkzdnEVomFHKnPZwFRKIh:Bp4OBwnO2z2wMFLOyomFHKnPSDKI
TLSH
T1D4C6D342A9F8C484E495CC7EB5A2C5FAC6E2BFC04262424764F87E5BFA7335D1D06272
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5184	elevation_service.exe
4988	elevation_service.exe
3220	maintenanceservice.exe
2752	OSE.EXE
612	PerceptionSimulationService.exe
124	perfhost.exe
4616	ReFsDedupSvc.exe
3980	SensorDataService.exe
3000	ssh-agent.exe
5496	AgentService.exe
2404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5af929bfb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1b8b2a7da20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5496	AgentService.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: 33	2404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeDebugPrivilege	5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5184	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5096	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 684	2404	SearchIndexer.exe	100
PID 2404 wrote to memory of 2908	2404	SearchIndexer.exe	101
PID 2404 wrote to memory of 3248	2404	SearchIndexer.exe	102
PID 2404 wrote to memory of 5068	2404	SearchIndexer.exe	103
PID 2404 wrote to memory of 3740	2404	SearchIndexer.exe	109
PID 2404 wrote to memory of 1224	2404	SearchIndexer.exe	110
PID 2404 wrote to memory of 4552	2404	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:612

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5496

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0fbe60ff85ea28c14bfbea1b3fb331abcedfda580c6f8b8b394c0a75043fcf2f
MD5 6c7e81743129c30cab428f2da176987e
SHA1 b1925eb88565d81048842165c80e3e698d5b3445
SHA512 2793cce2d07955ad39f7142eb2192904e8a13ae3d754cd1590978b5b34ab32a8521485962dfdc63bce98ac8a8b2fe398f80d494019e231735383eb3ae9698e84
SSDEEP 49152:Hb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnWXozsr8zlLwJIh:13q60jBPwFRKIh
TLSH
T19CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 9bb9cc5e34a84b5f51aacc2390dd232f2ca83329d743b0374631021f01c22e16
MD5 5e3f39a0a9c681171c295b667f553b07
SHA1 14e8aa1722368fe01cdf1b7b586269b5e277ba4f
SHA512 1b474bccdc14e686db81856e1ed2ae7d8801ed9d5509da240b45d8d8579ea1320b24e615e8e2b50638cd144e4eb122b5142048d39aa08aa309be62c4232fd721
SSDEEP 12288:D1XLsswWkxy2lRq2czAjksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ZXYfDtczAh9Xozsr8zbhN6GwXOGIh4
TLSH
T12B850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 94aab4792cb8ce8bafd7887ff1f32ee3af1e6a8a59abe2e365c53412345df64f
MD5 c45fcc64d30c3f88a12560c34a7b1db1
SHA1 9d47341c1fd3082340045edebaa52a7ab86cd704
SHA512 9bb2b7694d67b64fdebd648dd99db88dd03f35171c44d9d4d1dda2b2497180e9eca3df8442ab72902216dcf2d96a6e4f565e01ec8bfce4adf75bbdccda61cae2
SSDEEP 24576:40Le5ji0hmx3rMk9Xozsr8zbhN6GwXOGIh4:4Pji0AhtXozsr8zlLwJIh
TLSH
T1A5A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7c84ab9515ddcd87d30e2f01fe4751940c623eeaf0f86cd868b301add4c7329e
MD5 632a5d14ceefc791458b1abb7ef748bb
SHA1 cfcd7672d732aefbde5a324096135fb3b70a7914
SHA512 73262506d3af9ff18d00538c75c8448d931a03645fc180f63e3a938a1de830c468e700d79d6002c2b031986e8f457c9b5533abdd8117f7cd6621103013198d4b
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWr6q8wyue9Xozsr8zbhN6GwXOGIh4:2/ezSC6vUzPviHjyxXozsr8zlLwJIh
TLSH
T1A0755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0f52becf616f5f2af9b7998583926d412b8bc8384edb6da12768ae4d80270ee3
MD5 779ff4bbe81971bada243e61a8243ffc
SHA1 06b3710a64a4ffd4285f7febaf3f2cb65de55b03
SHA512 f64dce535bc2834ef204ff240de0c16cde5d949225dc9d855f8094f43b54cbba0125ef2dc8da64bb37bd90f35d147f874288d69d6b31bdfaaceaa4f2686dffea
SSDEEP 24576:cVbqPb88hv/l+b99Xozsr8zbhN6GwXOGIh4:cVO88hXl+LXozsr8zlLwJIh
TLSH
T1C255AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 298b173fe2d00baaff1459fc6d8949d54b7238cdcaee301d2672605f0c4300b1
MD5 6914acc0877cccaccec352839abc4b89
SHA1 c022978a680f1a8bfe222b31e7c8dc3e0973be6b
SHA512 9f03122a4bdb26c3a669de99db80cba086bb51ae7b757baf9875c4b7b18e96c4af342249791294f3f18258befd3c3383e15e4b066b7681cc6fcfae688f6aa93a
SSDEEP 12288:ARUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ARA9Xozsr8zbhN6GwXOGIh4
TLSH
T1E66523B7E691A442EF671F3139916AC4DAA3FD9E49C11B5112382186CC7E47AFE31332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f3f69c194b452a836bfcdce12ddb15028e1d92ee999ca963f87b1bb43b2ee403
MD5 5a2a931f650044ce75f181c1fc839a57
SHA1 55c24119de7617913f1e4a7328c13f777a602724
SHA512 9aec08b46ab2ce0031b414394d810bd28c47defd1e548e6227e217539253d1399749645b754b2c8f0ed53262ed7ffddd2f56693e40b8a2924fa71deb1607d488
SSDEEP 12288:seBNUbTVO86UXksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:sJIU19Xozsr8zbhN6GwXOGIh4
TLSH
T18085DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2fd60478f72fe2aa8f4b415d68823c0c4791e587327f624f1a702a3aa2876b5c
MD5 90e9745e747ea39436b17c156a052a1d
SHA1 5cf1b9673506c51a3c951abe82a765c065f04ace
SHA512 79be5badc7e7b1142ff975b61b460e2dac2043655c185ab9b6868127b5e66a76a64f4590fc34555ff33adc15a7dc010c51aaee20992d3f267547fa3c7424fc75
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THg:KQvGAdlCEL8c/RRNw5CswFRKIh
TLSH
T1D4267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c635a0def91596e00bbda064be03a1ca91b0f1b94e561d1e70924509ce056121
MD5 38f10f5e87282b7b3ec6bdc39804ba14
SHA1 970ce2cab78cf907620c077452595aa3499e732c
SHA512 bce3274e488caceacc401cfd478def44dc16dc5c3e7552ba90191ba2638c65973777748e2d0b0e1d008bf6dd273304401b8a6de18009eb1a0f0acdf0d7011b4e
SSDEEP 12288:kAwSfxL/2Dc3VDLLmt0LDQewsAjZksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:54ewsAjn9Xozsr8zbhN6GwXOGIh4
TLSH
T1CC85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 10719a9e2359d3249988e4e9135337b8878cd5fc5bd9f31fa52e2bbfdef70166
MD5 ca524f2c5b6b540a015f6b7e94995586
SHA1 e7a4cd7d0902757464e066511cfe3c1836c9e4b0
SHA512 dc0d7b7276e5752f3aff8b6190df2734fce163fbdaf0c643992c822f148b1d0e9e8254583736ca578a5bc5fdaeab721077fecbfc5d36a962156db9250eb73f60
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHCDKI:aUEtQevvqc2W1cpV2RI32CD
TLSH
T169474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ce3d0931a93dd2ef2c20da9c39823fab859518f82c8ea1316109a73006b0203e
MD5 a33a36601b9f50dbf93bcdcb3261c580
SHA1 996d60768b5313d2af5892efc10692c24518ee45
SHA512 7f7030105103256e53cf856a9650c7136e45899f46249f618ab2e191c682e60adc237b62d54954f22e2b16e7d3bc0cc2e7acca9a063c607b9dbbe5b1f3e84a22
SSDEEP 49152:gCbRquA/m2yL5zifFiV+XenmE3/zdXozsr8zlLwJIh:poqHVjnmQwFRKIh
TLSH
T164D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5b129ce714f3da946bf3f8a54c2057a717dd992e66c7d4c7e8a828eab8c60591
MD5 b6a60aa95c26003949adfeea8d9f4fd0
SHA1 dde4ffd6627c80f8ba8ec607a5077f4636e4e0e7
SHA512 1241d2532f7aa09b5e92edd93201013ceae98c77aeba6345e954207253ce0e8d89579c2f5536270644667ad68f94e62879bce668c530bef36ace79744138dfd0
SSDEEP 24576:CAhGL2IFoiwtA5l7S53C9Xozsr8zbhN6GwXOGIh4:CAM1Foiq5AXozsr8zlLwJIh
TLSH
T14A359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 4c287474f84325b631e79e93ea1e85114586d5dc7db54db8b3cbf485ce74ef71
MD5 a6f03c0c74e2219fbe6451aad5856288
SHA1 4bf65530138270811923a5bb84eb772b354ea196
SHA512 6dd0e8077fd9b4340dc2a1f4c8c4545bba872fde4b93adbd2befd548c59ec00f993427366007433d42c21807fd12ca7194ec4b86f7874229fbea8af0dba34fb0
SSDEEP 12288:umw5HEjsChNkBFgl0WDm+CqksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:nwuVOWb9Xozsr8zbhN6GwXOGIh4
TLSH
T15585F14676A41CF9EA6786398597C535E7F3BC062A21CB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f0f6a564d41c5860ce14bdb0921684cf43c59a37d7b33815df594806085e8380
MD5 a7c334e37b8b2735d50e2a852328eb53
SHA1 b7cf3cde33c3916a87c22ef5907868f27187f11b
SHA512 fad935d5e8e01e617d50696eebaa02af780e7e40dee9247e9c808da12f699e627e3e77261a0c9615166f78f090386a22338f2e8fe752cfdde00ffb50a808e78a
SSDEEP 12288:2ZZ1IypksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:IZu89Xozsr8zbhN6GwXOGIh4
TLSH
T1F47512AB73E030F6E6A3473998E15A44D7B3B856577203CF123802965E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e0a2b1755225a06bfa72f24421125e37d87d16806c739f5d66e63ec3df6ef801
MD5 c89ef0f89a468b30b21dd0421d8e93ea
SHA1 ccee2666e4a580f30eb66362510ebe82a0f2394c
SHA512 a6c4273261c140aa6862925b209454c2397417b2c6208620fe4ebed9afbdb0787507df8cffb5eae772071ffcd6414f71d58564c129e84bd05feb59672061c1de
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UM:cQRQyi36YOcPhLvw2gAf+PN3rwFRKIh
TLSH
T1A8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 518188ad51ff02c1b502959051dbb28c716f1cdcda9a03cd9ca74fe3d2650902
MD5 cb7d462798b4c3c55641005e925c571b
SHA1 934c43de9520f5f73e121ebc08ae2bad83362b54
SHA512 8c8ef42acb2b19988aafd7c2dd932df0f13551819c7950da737a3b07ba5b987d29b5472527891fba0ac3f81c3a1f2789d039ff58beb534af1de437e576b2bab2
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UM:JQRQyi36YOcPhLvw2gAf+PN3rwFRKIh
TLSH
T11F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f2bcb3f658aa24dd2c0916abb35657707a6a393fb02cb6d0d35bbddf6e6b10f1
MD5 94b7276c3147f9af6d7d7ab19b09f0cf
SHA1 8c5392857f5af5ee3807fd263fc2b267ddd70353
SHA512 00ffe45eefe9edf9451cb5866bde81270a73c30be93624b517a97ebb10db7e475a3eb1046a0e1cb16361663113fb8ad21071681593505991e023e9fb24ab6d3e
SSDEEP 49152:368Qg55nhceWu7PNU3/tXozsr8zlLwJIh:hthLRc/RwFRKIh
TLSH
T181B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fd770faa0c74dcf7251c0d407a5ac4ad0a8b5af765771f269f69e148cd9e0606
MD5 26de62863f2b133f7c2f40517d7949c1
SHA1 a252459c34c846f67f2b125edf1a41e2b3f99360
SHA512 88e9269a372a67b792e886801d613a2964a6340ee0ffa3151d91e22835b8d8c4323e383339bf144dc630e0bff0ec8024b197480cb89adde215f2534985b1222a
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99a:Ny5112gYy5azzVva69nLKnhZ2wFRKIh
TLSH
T1EF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2f7274a9e26d371e1d9c4e7f396c76ded5926be9fba90659e7d8333fd35c02ad
MD5 659ed61d57e3433b396d99650c9b4ce5
SHA1 363d3731ff637c187e7f926f83402b754807ad2a
SHA512 8183be8f7f59a887bb6f209f92c60bf7d453f5c212d9573b0f39abe3c93b793de87c16de141a9f7d7a703aee4a0a015e9b70f87fbeb4ac5758fe6adb0cecae5d
SSDEEP 49152:OB+taZ3usBWOBr4tEG20bqx0z+n217aau1glDXozsr8zlLwJIh:cu6JmUxd2djwFRKIh
TLSH
T155D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0af0e1135dc6686136bddb5e814f1f7481365f5229e26169498570dc8b42ca1f
MD5 fcbca22ea1b0f55385102ee93f40b832
SHA1 c710b969fabe22e698ef089bc76eb8d4a93b87a5
SHA512 67a4a17cb9a31bb863adde795581198f02c52ac8448893c725a3bbb52540b8e2b516e6bbc468bae9530e441b79665eade2abea808d9c951a0a8c745e1c3b44a3
SSDEEP 49152:y1hpsNoJpF1A6BU44CwH7R4xnXozsr8zlLwJIh:ymifPkRQwFRKIh
TLSH
T1ADB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 537facb93af572b8f27ac52bb78f5916d3c21558632a51678669dcdf47d77a00
MD5 05da73db83f6ed92aa8fa98f7c984ba1
SHA1 003b1fb618715b871f418320e98b612fb44e9f94
SHA512 1872bc93b778a5a658b72b0fbb1c448002a54a686843c6c9501e5910ebebdc7f0d27eef5beba47ee587130c88fb7727a534ce3dcd1fff8174b4563bd1b98a870
SSDEEP 49152:5SuZQIY0Be2KNRVtOnks6NMHqmXozsr8zlLwJIh:X5dKvi61ywFRKIh
TLSH
T14EC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d0c984ecfa288f47f0b5f25c92d0a4c94d7cf068c61c01db54738c53ccb53ded
MD5 1ecd2ea5e4e11cad963b4437afa1f58b
SHA1 d486dbf46d3c9658f3bfa8d7427f0b06e8dba9a0
SHA512 7e41fa4164a0292b8b6deeeda7a4efe5b21e9aafe7078a8b0a392bafaf49194e956ca21f7666771a9cd6e6550a36bcbc631d8e0ab7b350095cd0f92ad44e353e
SSDEEP 49152:bhtSn8EApI0figXgiDn0AP5wTXozsr8zlLwJIh:6X2iyph0wFRKIh
TLSH
T18495BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 f8c1675fec63667f403ae79cdb2bd217454380f3c71bbfde2ae7a4cbfc550943
MD5 fc3ffcace3e6793692ec3d56fd20fc3a
SHA1 e6665d93b5b97f88d63b15c47eaf3a61c71e7250
SHA512 39040027297e0a8a5e6b66963fbf500a0b23bde59b1f93d3b89b3598205973dc319e86dbebac9fd195ba93e10060c62b4edd619c20ed4715ac4f3d5ace88f5f4
SSDEEP 12288:Y8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Y49Xozsr8zbhN6GwXOGIh4
TLSH
T12F6523B7F992A442FB575B31298126C4CAA7BD9F99C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 704e27d6e189be54911f09cb61e3ff9e77e9df5fec74c9d34babcacb4a44d112
MD5 4060e5ccd243eeac6e4520194acfd6f1
SHA1 4473710d969dcd2894239045fa5078ce866701f5
SHA512 4f690fd732e0ee9a810eb763ba45ade3014cbc6c1c42ef4c003dec1c7d9099a1633c8948ce833d8f982f5a9b76a7795a4464579d4ae30acda32bd98054b39174
SSDEEP 12288:IFksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ij9Xozsr8zbhN6GwXOGIh4
TLSH
T1756523F7F992A442EB575B3129811AC4CEA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 a9b8feef7f5249e4e53475c8d5628edf8cb042371377c85962fae44040129a29
MD5 e21c0659f284b2d6aa0943d179b00137
SHA1 f6052afee9727464f0a43c143f7747d6aa9192d4
SHA512 ab4a5320ca5ef711efca0a7ff5b6fa56b6f84414b20ff5ef2fca1d24909de2eaf71d3475f9b6e19f8aceb0146b406a53085836b6a7be50b6072e6e8b50031ce5
SSDEEP 12288:2fksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:2t9Xozsr8zbhN6GwXOGIh4
TLSH
T1A06523B7FA92A442EB575B32298116C4CDA7BD9FA9C21791333D1042DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 296883f19c88cefbfbbaa319a4255190b3828400279daeab26cd8cc8b9a1978d
MD5 556dac96bcbbe3fb8531deb2d1a99b69
SHA1 e24be2b99d95241a842bc1a2a46956dcf792919e
SHA512 24b2c0a59d8d4af435daecb38bb9e08c0ac953c6a3af7aca0831a650e6a74f52a51e1f36e1f1f35e2718cf1dbcdb7c890f943771f40cd45c61d8f80c3d5aee7b
SSDEEP 12288:RVuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+9Xozsr8zbhN6GwXOGIh4
TLSH
T1226523A7F7A550C2EE679B3198915680DAF3FC9E9B5207DB233800468D76669BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 5ce009152805fdad1a04203edb7a6cbf75dba16afd16abb3f1505a49fc23ffff
MD5 f14020aacdefe1beccfe8f38105c1f94
SHA1 82e6d9d4ab2e85a8775365e787e6cc9d4d3e2d6f
SHA512 13ffbd68f56954ca580f055526be48e33b6035c1191cc58b3ac41bcbe96d5c4d699bfd8d7d6fef9796ab7ab84f79e9e1b0a6eb64889b9b9d5df983095ddd03ab
SSDEEP 12288:GGksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Gq9Xozsr8zbhN6GwXOGIh4
TLSH
T1D76523B7F992A442EB575B3129811AC4CDA7BD9FA9C21791333D1042DC7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 3f3cfde16ba2334bede8f1ce64505875a6edc9ec468bc52523541337fdc5f60c
MD5 c7763f452efc98a4975bd2c81c666586
SHA1 34885e1957fe2c850b072cff3fd21a2e6eb98644
SHA512 cda169942e3a9814759bc68149b86c5b8cf34a0fc94d2fd7a2b4e5dae6fdb8e852b4a18ee8f3802f832a2c230a3d1b7fd54f38b8b15eb07d54e15de041a4225d
SSDEEP 12288:nBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:nf9Xozsr8zbhN6GwXOGIh4
TLSH
T15E6523B7F992A442EB575B3129811AC4CEA7BD9FA9C20791333C1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 daf216c44f62777a7190db70517bb3ac9689530c5b0eb3c78f2d7a4814690ab2
MD5 184f1afbaa7889b73855089bc3a34ff3
SHA1 190a537ecf188101c5337dab4edad6a23bb35653
SHA512 1a5b038f638246b1745a9780249dc9834e46812e76f82e66d809bca0b5885ee6d6c5b23b083b56b27e262ed386c4d670cac786511113ed0d4036564ad4f16509
SSDEEP 12288:kdksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kL9Xozsr8zbhN6GwXOGIh4
TLSH
T1566523B7F992A442FB575B3129816AC4CEA7BD9F99C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 717d1eb6e2c94399937664c81c5e3cbbff671ff845c851b0d61f5a73a026f832
MD5 2798c8f126cb154ca11d5383a8631040
SHA1 617353c6458c72ce56fcd7e2fec072e33b9188cb
SHA512 10f80ebfa329a9e4c04408b7393f188c4f022efd133ec5b6e4757e1f443d61f20ffb1cc8d69d76fd479797c9ca1854f879975c4f36896bfccfba3f1222b1b666
SSDEEP 12288:ciZwbWzzFEoS2cPvylksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:/ZMWzFVSOD9Xozsr8zbhN6GwXOGIh4
TLSH
T14D8501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 650f77db22bafc1e83adcfb379c2fb68931afb9d2fef661c95654a8136abb5ef
MD5 53a7df6aaa42b267a30d4ed0875dcd8e
SHA1 abc5222f9e854b44ddc2a4f78115519d5385e846
SHA512 93243b84119c3d990df7099e9099849f09b1e52d0703cb17bc56b20aea9133aa62e9e51341f60b10ec47fdc884c503c8468b7eb92c87f3122864b9bf59d4e957
SSDEEP 12288:vgksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:vM9Xozsr8zbhN6GwXOGIh4
TLSH
T16B6523B7F992A442FB571B3129811AC4CDA7BD9FA9C20791333D1042DC7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 b542ee592a1cedc9e56d79dea129cd68ef600b1d0761286d1e2c47bd44d58963
MD5 b137ae520930b00eb9550bb3ea7e1d1f
SHA1 6245e28a45ee4a869c4b5628c220155e549cb7a7
SHA512 6baed3bc827f5a906df3b44c43e50b9e87bc84fec3537053f492dc2a36fc0df8447185c34d3d4f5aec7539c5d5734bc07d0a8387208b9e21258b1adc8cc6a11b
SSDEEP 12288:TkksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr69:TQ9Xozsr8zbhN6GwXOGIh4
TLSH
T14F6523B7F992A442EB575B3129811AC4CEA7BD9FA9C207D1333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2f0ea3c1e8e2a7a92278c65e3515c2af614d0400dd570ea46e312e9bb5e01f5e
MD5 704235b02fa5ab155346b476b8955a55
SHA1 d00c340f32a61599abd7064f3cd37e429421095b
SHA512 a1c32d16836cc335ce065aaebfaeadbc2ede0675130a69c5beb99b38c8d98758553d7accfcb3afaa9be5364fb0b46607ede762af346e80f019efa1ddf82e4958
SSDEEP 12288:6yPz5L8pksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:nzy39Xozsr8zbhN6GwXOGIh4
TLSH
T109751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 a1614cf271f005c996e555cab1d8a6502cd12ccadbec9b7bd81382f22ce225b4
MD5 6d574174d2d12fee6b6c02b035dd252b
SHA1 1ff12a958948ab43ab5fa44fa98cb091ddaa0093
SHA512 b5f0025ef59f01781fa237a40fc191128ad9974703d7e928b2417a5b9c7a9852dab97de4c120a8df37cb4660e7c48b5087f83898661fdb84df3e51ea073b0daf
SSDEEP 12288:PgksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:PM9Xozsr8zbhN6GwXOGIh4
TLSH
T1E56523BBF992A442FB571B3129811AC4CDA7BD9FA9C217D1323D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 edad2b861d8584e9b88533188cf3af533a665922c0d15b3808426156e1c5df13
MD5 56fc56b450d6ee7db17a185f0ccfe08b
SHA1 ef864e9f82102c6fbcab2b5304e3f10ccbcf2229
SHA512 b117329e2ea1e7851a396de5fbd4b1eb3e5a90f93c77d84d9e8a0b25f3598965771a609c38c3fece883611b8fdb8b4a60740dd855600da43785fddea96d78385
SSDEEP 12288:AgksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:AM9Xozsr8zbhN6GwXOGIh4
TLSH
T1256523B7F992A442EB571B3129811AC4CDA7BD9FA9C21791333D1042DD7A83A7E34335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a351f079b594b0b85dbb1a2e1fd8cdf7f8abe463b778f2f604cf93144e870b87
MD5 e556fb9b24ba521c3e6ebeafdc8bd81d
SHA1 c31ee59db0ace94908f91b7ea9017292ec14caa2
SHA512 111dc50f7462a2a4fe3303a1c6559243b04ef1bcd22a999482db78ddf80233cdb6f87933700cfe8553356fcf352b295cdc55708ad53fc8102e2e2354dbe7d430
SSDEEP 12288:0yPz5L8pksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:tzy39Xozsr8zbhN6GwXOGIh4
TLSH
T10E751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f58ac7031295f6b1710846c95d4e5c932118dc2ee1eeed38353cf82a34728a98
MD5 8769c4a42ff63ea50870af1be6e4a754
SHA1 9cf70d9d591757fa71fe6d327293f7d48a888a24
SHA512 44fd900c91eaeeae1fbed312512c51e28f966407e1b03123265e78481f9c3a1a48185e783d3fbde325c5710361d8b62792e16103e86859a15bfc1be6e4bf335c
SSDEEP 24576:wTHaLl3z0zDd9Xozsr8zbhN6GwXOGIh4:wT6Llj8Xozsr8zlLwJIh
TLSH
T1918501A5B39018F4ED67823EC8518945D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 0d4372bd97d5b8aa9759708a07e58d6d8c4b148e5070be092c20fcd7e9aa59b9
MD5 50109096a926197611e008d48eeccc52
SHA1 974eee0e5cae6068f118549e34d85fadbc46335c
SHA512 ca5645131a895ba274815530d3449b674272971af3b2b97fa31715da1bf48b72624ec6eeef5f76db9a39a93edf17e61c61b733e61b737e379be6bd4c33222e66
SSDEEP 24576:93Ld9CHKy7GZZ9Xozsr8zbhN6GwXOGIh4:dLd9CHKya1Xozsr8zlLwJIh
TLSH
T1A495CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 1d5e47ddce4b952e13826d29225b418520e13647e11a85dd6f5c7d8810cbe019
MD5 0e12b42abbbc1df51bbed2a73de9ef51
SHA1 ffc1857c8c0c08afb1b050feb8a1e04323512f5c
SHA512 f4ff1c7edcde4abab42b7676af6755a9ee0274c56329a7014d8452bc7eacba8e9a7a105d5ed70755a129c7269ad6cb6931bc08c1259901d21d348213f1e4508a
SSDEEP 12288:l/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:lN9Xozsr8zbhN6GwXOGIh4
TLSH
T1486523B7FA92A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 837475e60173ae1dd3ef3b595a32947dc3126211d133956f59958af64f7ae403
MD5 3c64bf9badd55f3969b5a77af38aafb5
SHA1 99915efa9b44b071d25785e6a0ac150c9b89f074
SHA512 aea356f8c4f029fe4ac9747080f353c516931c0c20c785d9926aa06f1b2c56b6d8b01b43bef4c92fc0d25aca2742276d6c2772203c247824927b372e27356a7c
SSDEEP 12288:1JksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:1X9Xozsr8zbhN6GwXOGIh4
TLSH
T1506523B7FAA1A442FB575B3129815AC4CEA7BD9F99820791333D1042DD7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 fbeb86d276893c4775c596567bf03ef1d7e6c76ffc5813927c15feaf74846dc8
MD5 58b7bc02656085de557ce60c8a02a13b
SHA1 537375652aa44b927a0d686ae515f087980520df
SHA512 7f8b905b7961b14c9e68dca1e2c758a039da73f56e456457e6bb012f049dad1df33e6d66f515f377deffaaa4b494f901b62f0505bdb7220c2cd42b55c7b75323
SSDEEP 12288:0CksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0m9Xozsr8zbhN6GwXOGIh4
TLSH
T1B36523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C21791333D1042DC7A83A7E34335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 7c8df7ea5abcf31c628954953d4b2a837e9bf4388e03e4df53e2ec755d7402ff
MD5 b10efcadbe4d0123d7cb4a5c4e3a8ca2
SHA1 76203968e7dec75c32822d9c6b38c38d9832555d
SHA512 188228963cfe00c4d572c388e9a149768afa7c2cd909e016abf16540f413bb166f97f99e1c409dd13e314e3c5780519c3a778e5bb1f3ffad334b6ccf2c743ff5
SSDEEP 12288:+gksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+M9Xozsr8zbhN6GwXOGIh4
TLSH
T1046523B7F992A442EB575B3129811AC4CDA7BD9FA9C207D1333D1042DC7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 87d39b67641e8ff2ced01db933bbfe918f7fb53d2ce2cf2a3e860d2267c2abd7
MD5 442e3f7f9a192b0a0187d857e4474f72
SHA1 8e5ef6f832722c36045c65ce647c40d71a46e100
SHA512 bd37ff2ba9b0935c5378579264016092a050ee16cac654e6d0c65bacc6ab9245cafab9264b7561ea4a4fd5565075df94347bbb612619fc06754ca8ec08af6113
SSDEEP 12288:q/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:qN9Xozsr8zbhN6GwXOGIh4
TLSH
T15A6523B7F992A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 3274c8cace2c506b6d3b95aca238f64760309d6973d54a7dd3355ae6e8873002
MD5 c035c956dade38cb261b0640cd2aee66
SHA1 0ab59da227a1be67ee238efd16292c006a492fb1
SHA512 de71d8ad2e7520590502318881d324b66a4de92ed5328ace91b186723ab3b82e1da25c1b23cd25c21b69344a6058288a8f6345cca56b2ea8e8e3aa4533721f2f
SSDEEP 12288:E4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:EU9Xozsr8zbhN6GwXOGIh4
TLSH
T1D76523B7F992A442EB575B3229811AC4CDA7BD9FA9C30791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 1cb9d4656f5a0d57564b403bbb0c7b6cde2a6255409317d7b4905be8719f92f2
MD5 96cdf2e342f43684b7b266b3347e834a
SHA1 c52686cf7e690903cbfee4f377be9abc4155449b
SHA512 8899ff93dfd30c2e79445850dfbd029226d13d502f438adae9160ef058c6bfcb452bc89f7a5e7723e832dfa01d9e8d2583b419aa20bd3c7ad53cc2d47652a457
SSDEEP 12288:EGksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Eq9Xozsr8zbhN6GwXOGIh4
TLSH
T1626523B7F992A442EB575B3229811AC4CDA7BD9FA9C20791333D1042DC7A83A7E34335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 d04199791d6f31f870d77f86aed7af49b2ab8877d8f9bde894135310fcc3ac5f
MD5 16340cebdfaf62b1140ee18c4472db8d
SHA1 4ef2da7d2587b361af2a4de8375324be670e2df5
SHA512 596ec25afefcc19f779c3f9e0674379c058cb7c1fc3cfe87365e5cedc07b15bb8da41b17a45ea923544254c8c49f9f8d38236ec068e225d6001c6373a7e9fb4e
SSDEEP 24576:ofwv7k9RX6wkyAIg9Xozsr8zbhN6GwXOGIh4:jMnYI6Xozsr8zlLwJIh
TLSH
T16695D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 db69935cd3ca474154c3fa523bb94bff9d1bd48f3859a00653b48486f78e84c8
MD5 ab7973feb444f5508d0944d593ef2974
SHA1 f35454d97867761d2c87b331b6b390b9cfd22032
SHA512 2a969d7736e35b6e6b31d758a99885869ba0b50c693a09a3752855b5c8518a3a0ce73bf4e126deb880a3562ca55b3e5138a7b53cf562904aabb41ae738d70645
SSDEEP 49152:rYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zXozsr8zlLwJs:VySzPLwFRKIh
TLSH
T1EC066C97A16801D5C1B9C1B98B17CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aff886d58e183120753dbdb177853829fc3a1ee68de2242c76ed791271a0a0dd
MD5 f839dc0b7aea248d7c0921bad6c5653b
SHA1 886639d47c28876ac53846f40134fdab03442998
SHA512 23daf8fe822a64cbcafe0c7104b1d3e777a09c61507a4aa033eb456e8034a492a65cae95e8f8478fca0521202ca926e44cd8f48796ac1573d9ec0bebd57faaa4
SSDEEP 24576:b47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYT9Xozsr8zbhN6GwXOGIh4:b47JUQj4irIhCnDHUPfF/DXozsr8zlLT
TLSH
T11865AE1EA3EC01D5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 fd3e25f9602b47a09a2e6a2f84115ce690492487816eece3453f5f99f88766ec
MD5 cad5251ade711b5af78d693b01d7b2f8
SHA1 bd6de60ff51c6486fc6cf46955ae4e37923808aa
SHA512 6219f9d0e2385058079c162b221d8dd2c936af2ff7da28a5cef180d6cec17ff018701a2f24c8ee14c94b2bf79de49f52cdad6be81627a875135d6c5cdc518c71
SSDEEP 12288:0QsfQksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:O89Xozsr8zbhN6GwXOGIh4
TLSH
T18C75F15AE29411D4D16F6235CB414A80F7737C6A87E193CB22E0F03E0F7A5A5AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ad0fbfd45c07f29b19740839a705104ba299a587aa7f0e7c5f76c14b2092aa09
MD5 98700d0b7be46cb559dce99eb01c7150
SHA1 019161a7fe54c9a258eabe21cde4c6c398b94555
SHA512 dfa8f1544489a80340b00d46457f4f5e85196e525f8929156171aee7abed469710aed3706cf356f8d2b19aad526d2f02a9cebfeb4d573ce7424c65fb75ddc983
SSDEEP 12288:y6qEDoKaU3fcNKVRtjCGBb+pb0YRk6ZMBQ5W8W+iin:y6jURUPcGPjLToMBQ5/W+3
TLSH
T125352841762BD75FC6A940321E32D2CCA7707D41EE05AB0773C8873F9576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3e85fa35f18e56f4f0ceb2ee2fe97cde6a2dce529be5dfa05f809a8d70b600a3
MD5 13f86d6f6733ce9c4642a82fd9815713
SHA1 a33cf84bf18668af325098f3535040dd0e8bc22b
SHA512 95372099d3b66c486b5cb535c560285db1ac82d4ba850b54453853cc472e9099bba8dbadb513f500457c3d8bb09f0f98a2fafead26d8ecd3212179726cc37224
SSDEEP 6144:2HMteC/cJ1a9+Jb+pbTthtJtRKDGzAXh4bF9KxfC3tMxKzbBRmZLa25JEzCgC3tH:2HMteOAb+pbTthtJtRKDGzkiZCU7uReE
TLSH
T14565D8819137A3CFD1F76032072A5B4CA7A4EC16B7096F26B3C5053AD86A725B4BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 132db2f07df355a9ba98a97a2311950e3d12ae4c4382f77f55cb413fab69d040
MD5 bf26bb72daf229eba815f329031e540d
SHA1 fe879a45119bd566c096630e0c3b3d523d7f37ed
SHA512 f5827c83df06a2dfcc251983ca17018064ec335710dfe37b71814c8fc2b16408d9646f3989e83bdee9afad2b185007d89460f801816f2e23de1e47cf87e8b511
SSDEEP 12288:Fd7oksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:/E9Xozsr8zbhN6GwXOGIh4
TLSH
T1506523B7E795A802FE775B30289156549A5BFD9E4F8107C3322C1186DC7A8E5BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f3962687323a695ddf805d083cd88b9ff103b9240939fa1711700d6e4f41d882
MD5 6229e37cc23c48517df5b7dc58a5d0db
SHA1 f2f04b57df0675e820f04801715dc5e7b857e0f0
SHA512 fb1bc36bcdd71f57524c66775925b16ecf62241db87b8396712ac73a85fd89ded034bb83c390c4177f1623d26c4f863c4e3870b908d500a277e8a7df6788a654
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYe9Xozsr8zbhN6GwXOGIh4:rgb4mBIBhGF5Xozsr8zlLwJIh
TLSH
T12E65AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 0f04929100afc7e08124bdc7d6bf050fe9f29856306cf73fd23b5f73b46e58d7
MD5 f376439a503535bb38920854807c1b11
SHA1 289b56e8ca5b95d5a8feae3ad220ad45e45ea81e
SHA512 0e5f4db8192f412604ed85a177bba0e8b2f5b7fa6111769458e8f9065a61a06ad656b8b558b5402cdee9ff17eadcfcf524e31af9ea3fcd591655f7ed67ab4224
SSDEEP 24576:nG88u8FpJqH1czria7/mD9Xozsr8zbhN6GwXOGIh4:G7ZFPqV7a7/UXozsr8zlLwJIh
TLSH
T1D0A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e509fd2bda609441402653de712c9f19377ea07d5a688c88dccfbd469e4181d6
MD5 454032b44e899d6023df0372d8bc3d57
SHA1 cb5b6b33cbaabf67f7b2d1483df60b1efc5845bf
SHA512 78cf98165da8d6f42aa8cf7826c819846b02a8d478bda085b1f43d7197dce3525d8afb0de48a6c0ea5f3ff9635f8160ee80829870cb6a2d892f3e64e3d1b6e40
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlXozsr8zlLwJIh:+G05lO43b+wFRKIh
TLSH
T101D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 36ed4a7b88ccab0909342df8bef8fa40b4a47eaabfe28a6af7d91877f9b3bd9f
MD5 6fa904b31a3e4d5af287123a89947fc2
SHA1 c1d74c86988f7c5a857ef019d8d775f6701467c6
SHA512 8a5d0da6d3d8ac07ac1e0363e02d854fd0b434299663c1264ff17001b3bdd9a2b8346f5702668964e816f20110df8221354b7332d92c524d7fd7bbd79c332c4b
SSDEEP 24576:4fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnB9Xozsr8zbhN6GwXOGIh4:Aa5POZ39Jt2pasx2+mtXozsr8zlLwJIh
TLSH
T13965BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 427f4eec75383e6ae109f886f0322c39de904a29796e0684e460f48e37c71227
MD5 d7ab0e31eff3e08ec3ae71a62f5f8da9
SHA1 58563a7291ef9984bbe7864db6db028327bbb5ec
SHA512 967e50469850b1912556a089fc7b8a2492a922aacdd80cf2447bde1b2470fd694c66ded495940a73cf68f486c6e3d0dfe52b085ac929bc0dae329c61f8d83fa5
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7Fk79Xozsr8zbhN6GwXOGIh4:/Nc/zEOVHF0Xozsr8zlLwJIh
TLSH
T199858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9526955d2df47894e8c4c89991565a2821f0c766657a6e5ebcec93b5fb3a5588
MD5 9808cc6d2914acd58aa57a5dd2df9458
SHA1 101c36fabc99d3d90f52b570e42c3d69b230ab33
SHA512 ae5098dd323285d13fb1cb396b17b66b992cb0cdc2220f79ad14e6fe091b4b3047b9c2b0405bb86624101160481959b3d3bdd34300a2f64b1e046fa5e71fdf47
SSDEEP 24576:6tkNvNnaFeYhJNtmZBmF9Xozsr8zbhN6GwXOGIh4:6tMwBtOmXXozsr8zlLwJIh
TLSH
T12155AF6EBAF845E4D1FEC6B48D238512EA727861073253CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 cfe1dc20d1f2bf37e9aae214804d9f1b276c50dbfbb9a5aa91cd1311982f472d
MD5 9f624127408bb6e4bdb8fcef1eaf6e09
SHA1 7df16592d06c70ac56e632ac83d0ead2afba2ea9
SHA512 91f65a0c9dcc5d5c32cdb80d148dee8919e4caa363e6e704d6d7c07501db9c8cfacf7cab9bdc8c95f60e1841c7d3290b3ff21fccc0fcd0ebce4a407578898ba5
SSDEEP 12288:OHvUrBFrEjwaQRksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6T:OPUr+NQv9Xozsr8zbhN6GwXOGIh4T
TLSH
T1FB85F26F72E918D5E677A13D89824709E772B866071293CF02A0817E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e4a706ca87369a8429a0d22f66fdb929567a2e4c7bda720026b4ff18cb9aba07
MD5 e9fe078dd128e97ff4378b65e86f917d
SHA1 72696b29d44a8e0f7a09a38048d2dc64713420fc
SHA512 61c0b01b9953a3e8aaedfc42a46db6f46e4fb81092041587eaa416a4c34e98492cfbd088b9a1dbf7cad70a2ec2a784420106d611c2431ad6909d63b1fbf150f9
SSDEEP 24576:nD3FHshBIYQgAY9Xozsr8zbhN6GwXOGIh4:nDVHeBIAACXozsr8zlLwJIh
TLSH
T1F395E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-294-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/124-81-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/124-82-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/124-76-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/612-71-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/612-65-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/612-63-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/612-278-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2404-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2404-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2404-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2404-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2752-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2752-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2752-249-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2752-52-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3000-119-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3000-312-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3000-111-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3000-113-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3220-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3220-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3220-49-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3220-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3220-37-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3980-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3980-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3980-309-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3980-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3980-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4616-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4616-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4616-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4616-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4616-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4616-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4988-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4988-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4988-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4988-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5068-324-0x000001C24F9D0000-0x000001C24FC5B000-memory.dmp

Download

memory/5068-397-0x000001C24F9D0000-0x000001C24FC5B000-memory.dmp

Download

memory/5096-332-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5096-6-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5096-352-0x0000000140000000-0x0000000140BB7000-memory.dmp

Download

memory/5096-75-0x0000000140000000-0x0000000140BB7000-memory.dmp

Download

memory/5096-0-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5096-8-0x0000000140000000-0x0000000140BB7000-memory.dmp

Download

memory/5184-14-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5184-22-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5184-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5184-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5496-130-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5496-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5496-124-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5496-136-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5496-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download