f21ffb73ce756a13d2e05dc1cf561675c1b991f2361383b67f23da49bb2a65c3

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260802-kvxlesfh44
SHA256 f21ffb73ce756a13d2e05dc1cf561675c1b991f2361383b67f23da49bb2a65c3
MD5 32a4aff050e57b4d986841d1f9a6190a
SHA1 931f464c131feb67aae73b6d48e427e6ac62607e
SHA512 3a44bd4ccb4e53896e095c06832636277c2ec13aa0977da7758d3865900a0caf9234010ae796f5137699481fcaab73d6fb965eb29eaa073507c29f3a0b0ad2ac
SSDEEP 24576:4G5EIkLhLj9sYwyj5r19d+cyULD34FdkRCPn1sLCVQsqjnhMgeiCl7G0nehbGZpv:4cEIEsyujUOiRqqdDmg27RnWGj
TLSH
T1D785BE8A93A401FCD4F7E274C976A903D976FCA90770569B0291338A7F3B5A4CE78712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4112	elevation_service.exe
5832	elevation_service.exe
4464	maintenanceservice.exe
2028	OSE.EXE
1872	PerceptionSimulationService.exe
2348	perfhost.exe
5108	ReFsDedupSvc.exe
2892	SensorDataService.exe
5912	ssh-agent.exe
5280	AgentService.exe
3712	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb0b23c5238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ca7f31e05c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b5f6adf5c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9ad80df5c22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009370d1de5c22dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1bf98225d22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000671022225d22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5108	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5280	AgentService.exe
Token: 33	3712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3712	SearchIndexer.exe
Token: SeDebugPrivilege	3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3340	2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4112	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 1048	3712	SearchIndexer.exe	100
PID 3712 wrote to memory of 4860	3712	SearchIndexer.exe	101
PID 3712 wrote to memory of 548	3712	SearchIndexer.exe	102
PID 3712 wrote to memory of 1852	3712	SearchIndexer.exe	103
PID 3712 wrote to memory of 3256	3712	SearchIndexer.exe	107
PID 3712 wrote to memory of 2560	3712	SearchIndexer.exe	108
PID 3712 wrote to memory of 3512	3712	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_32a4aff050e57b4d986841d1f9a6190a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2348

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 78d8a6fb36d7cfbcea8bfda3abb759a8d87f0760e889639d3b1b5b8d065fb48e
MD5 765f50de38c26cae7a29fb6611113c65
SHA1 f6a509c6451f11949aa3a1b97bc425ae7df50999
SHA512 6d06725f8b45eb212d00357c595d30a3cdd7b0f5adecc108f0e5919fde1e5039a6baca12bb65aea4682e69f055d40b695b540860534df17e159529ce2c4011ea
SSDEEP 49152:0b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn7Dmg27RnWGj:u3q6sjBgD527BWG
TLSH
T15BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f8c8f04e89ce299b339488ca239c6d42c87cad8dfe35df3c3110b9ca692dc82a
MD5 1c95abd9b5736bf5ae05f31156353f00
SHA1 3946e3096dbcca43aaea0ade5357033c7195dbc0
SHA512 d432a9b5c767fc8902f058daf335e4f63f12ee57548ea7cab79509077c3db5262606b4bbfe9b53f95eb83f21e7c529f33535f2181e8b1ce8f7a6cd94cd6209fa
SSDEEP 24576:MXYfDtczAosqjnhMgeiCl7G0nehbGZpbD:rtcBDmg27RnWGj
TLSH
T12F65F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 cffcee0837dafa37cb53938d484243132179c9ab3988bcb5a489128942108c35
MD5 e2d222c8837547ed098001a7041fd187
SHA1 28dab68d2695d6e5e2d12c87da9534fd1903fe4f
SHA512 93426e5823c6dd1f0c762e708be6c3d717727dcc767bd5a2f7a6313fa40a7fb7ce396238b1ad52a3eb00b79fec30fc841088d01aaae9304028210fd3522f600b
SSDEEP 24576:+0Le5ji0hmxxrMPsqjnhMgeiCl7G0nehbGZpbD:+Pji0AjeDmg27RnWGj
TLSH
T119859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 789c7e64593607da4addc343faca85693db8c3a1ddbee48fc1c07cb55a4c6e66
MD5 fb57736c675ab14083c42b5af2f21714
SHA1 6ccafd9ded9876d16aec7a953a5e260e30c6319a
SHA512 2988ab8c2343c76447bc11dea1d94402df5f434ccf78f5057c7c4c783165b35e6d6f019ef6b2ca36495a81dad57c2c66781ba413c69d9b7712f4eff81068afad
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWn6q8wyutsqjnhMgeiCl7G0nehbGZpbD:7/ezSC6vUzPveHjyCDmg27RnWGj
TLSH
T15F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 684d75e410c01390b6418ee4d0e8d4c63f71683624c5af1810d7d3ee384a0e57
MD5 733c266896eefc84ad79b5fc664cf2d8
SHA1 9a1b3e41a6fffbbff01098a479c80e8f2d7c560b
SHA512 44eef5217fb046e5d7f0f71fc19d04322194ff0980aceec8bc8ab99c4e02e0b12db56327723f9352958943658d8774efdae0019c825f7eff09f34e091d0b5510
SSDEEP 24576:gVbqPb88hv/l+YUsqjnhMgeiCl7G0nehbGZpbD:gVO88hXl+5Dmg27RnWGj
TLSH
T176559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2e5b0fbec65c680dd6658521d42961c22ad01d2986461acec41fb8dab293506f
MD5 9f732db29d3978819e9ca5bee12c47aa
SHA1 8382175989996933cd422d4bc381bc2b522a9f06
SHA512 fdf2bd3e524b9ee290166de6c3ca2444c0f09744b80e45b6e439ee042e25b4b25bff97249df60aa20c8ddc656cc4717b9ba3273b88afe794fa8d7e525a0e4f4a
SSDEEP 12288:PLbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PLbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BF964C50DAEA7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 379ba0253e29d5158641792a5dc95c72fc7550531ccd8229645e0082859dc2fa
MD5 b148810fa160eb500a7d5b50ff16e370
SHA1 5a9538353a78c29b1540ba2e6df3dd3352158633
SHA512 4a526bc6534d31b0bacd5f9faaf1eb576621342cef51b29b0c8ef6368732cb3d6419cac887a1af2ade954db7158ba5081f4c174dfea269ac392b02925d96a49e
SSDEEP 12288:peBNUbTVO86UcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:pJIUcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17465CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4303eee3ee4e10477380a7131f71d33ad3ad19058013c886997a37ee87e167ea
MD5 ec03f0fca45683edccfceaec857524fa
SHA1 ecd51eecf774d5022546076255a4ee86c8c0d614
SHA512 152e239c71bd01350ad7bf8a7d9bd78afc7594e5054d240f7299635f568c1775d346e4202cdff9cdf96a29e01035fd3f472a0d8e0bf691cecc81c5cb082f1d94
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:DQvGAdlCEL8c/DRNw5ChD527BWG
TLSH
T12C266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6961f4d2944ba23c630b521acb09233db7264a305bce95e5a408c253a9c92c80
MD5 33e449e11a2f6780280e7603a8168924
SHA1 c3d4cc8edf56925ce3cdd965e22b0cc7380d3a11
SHA512 e2c9dd51ce12fce8e2f4f6f01068741e85ad534a137e245e009520059dd1ad39c050c236105fc8edb5363e4be5f50b466d3c784cc6453b16628203e0be7a9416
SSDEEP 12288:uAwSfxL/2Dc3RDLLmt0LDQewsAjaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:T0ewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T15475E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 697382f1c42b4aad31aec0ef160074984266670b6bfcc6b0ecf67073ca1ced8f
MD5 044695ff13a7a6f68c93623c43e68762
SHA1 25ffdc25b7531e6473e21ed72d6ecf4927ccb497
SHA512 d508e16be8a0144bcc3e335c53e1bcc169e45ac4ab076b1c55edc974e794b6eae3078e3328246888f2b4ba094053f1025ddd774e8d03c73e98f426cc04172b32
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWVQBWG:GUEtQevvqc2W1cpV2tI32pB
TLSH
T128474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8210d4d61601ab1d49a8c72235ec0c3c7fc63dde25c9fef49cbf9ac1d0b5a877
MD5 e4e8ffbb95449943f4b3da3f01eedb44
SHA1 a031291ed50064093afa0a863ab121e39c0c913c
SHA512 d43aef44422f74f911b79226b824dfcc1d646d99d6dbe1285c6c57d8292de46740a8ed890b673d0556868af9e07cd2a00ce2fe513731b9b9c48d7adbaf161649
SSDEEP 49152:aCbRquA/m2yL5zTfFiV+XenmE3/zODmg27RnWGj:voquVjnmVD527BWG
TLSH
T18DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0883636bce602e9ae078ea0a5c52022bbe0ec02d66aefd3204c35a34b760ddd
MD5 94a1031efa68c3c859e495663bbf73e9
SHA1 814a9bde3906b23de3071478547d50ee9b5ce96d
SHA512 3814f9320a27eb3ff2527496f46972139fa270b7077105f6efbf99b3092f700a340ada48aeabc1773353fc15dc88a7d3f4ef617e7f9f31bc935e1e6a7152af2f
SSDEEP 24576:dAhGL3IFoiwtA5l7S53hsqjnhMgeiCl7G0nehbGZpbD:dAMUFoiq5lDmg27RnWGj
TLSH
T13C359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 fea4340122c8afcf1e77f39dfde320d732b984598e1e8a76cb9b2b70d6751d6f
MD5 c6b58cec250b5254737fb6fe7ffba317
SHA1 f182c035a78b1cf10ae06475dc4809ff206f07ba
SHA512 25e557c2017c6b3ade2781f86098094fceaf64aa3464fc711d7d61aa6ca4d9bf44dabfb323eee760545f5361f1b23b96d73ffb1fb016f449f4332a5a38449004
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:awu4OWOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19865F15A76A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9069356336e50a8f4ffa439639eeff684acc3957284393450fa1ce7b70a8eb7c
MD5 af5c403468a2174b9018959ad4262669
SHA1 ecb5b39cddfd6d02ba0e83ec1191ebb898745b16
SHA512 d9bbba295c1329d975cdc388af2bf8cd5b76c8258ba9e042f84ea99b14804c1e9e31e9df4bd3e7251759497fa7e062e11fbbffe06cbfa4da727883137de95d3a
SSDEEP 12288:SeZ1IyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/Zu3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 76d996c23ed7ac1d0bde9affe439a66af8e10e803728c089beeb2872c1484305
MD5 1e0bb48af503c42c618f8fc55d5b7e78
SHA1 1dbdfa2b90935128790926fa048fe03c8780f3ed
SHA512 5f77e1e5e6b387b5566225880e9092fd0f3c90b550e64dcdc6e42ad79c41c5c89408ec98eaafe2656ce2abdb94c794046344ff5e3445dca028c409b7fba8e2ae
SSDEEP 98304:YQRQyi36YOcPbLvw2gAf+PN3MD527BWG:PQyiKa/X+PN8VQBWG
TLSH
T159667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 22bee93bfd2d0eda396b23af39907b9547b19ff8fcd886b1e2526b6c16eef351
MD5 be093a477b53a42f6d8b4a8c626c7a3e
SHA1 772eab7b0c2cc893fa968d374d91d0f5356a3c12
SHA512 d934f1695ffa75b1bd8a2408683038f5551422479fdbdf95c78fc367a2f03ac98485152e86cd7ccd0951e52d60b05bbb7bad49d9924136e60375f27e46c58a9a
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN3MD527BWG:rQyiKa/X+PN8VQBWG
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 12a17968c16cab42ddf09658747d47e4311a56b3e5c2f47edcf1b3b2329add74
MD5 5dd8d9178d2b176a9677bd8cab288776
SHA1 4bb4638da75ea98ab6aec9cddaf989920813a358
SHA512 b40c691e8e71964039d487e6354ad594abf65815b748998b5c53d413b7b5bb95e8de696f7bd70a193813c117f9c7bcdf37397290011c01941cea68961a0207f0
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0nsqjnhMgeiCl7Ge:+68Qg55nhceWu7PNU3/eDmg27RnWGj
TLSH
T17FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7a77fcac4de41d59858aae3bf1e6f33ea944fad6963690765ae4d44d6bf6de71
MD5 30c562bde738c6df63265b69f3f42c8d
SHA1 0dca28a47086b5db1f9d163929c66e1f95dd371c
SHA512 7dd915ee9718cd45e31634bbaf0fed48e030c9ad262d131d71a6df8e3f6343b38b9ad170352cdb293837411412fd20715db2dbe5806d6b281663492e11514590
SSDEEP 98304:vy5112gYy5azzVvt69nLKnhZPD527BWG:iLIHEWhdVQBWG
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f045584e0dd539549f443b1faa64d0b4ecc6cbeb016ddd4e130091e7a21bd533
MD5 50dee7c51758771b79b4967c5ac38c69
SHA1 92be71db10c2cf922f414a5ed1ce186978f95138
SHA512 c862f899fc4ce110a53d5cad921579ac3d72c051e0703aea2d1bacaf604a43621572973370b556b7eab0f2d4524ba142f2686173947b11025169ec1c43557990
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEDmg27RnWGj:Wu6Jmdxd2dED527BWG
TLSH
T18ED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 457bf2c6aa6c166693ed7d5e26cb9f92ae57a6916bc8e6459a17e2edab3a5a5e
MD5 6af13948a94c8e666bb65d066182cf88
SHA1 96655128e864afb1314e6e51c6a0839f142c6599
SHA512 4727b30ceebba7a2d52985ff4e7b59cd9b5f08882b927add74dc0d30e2fad47d58272be320bd5b67971b7a698c5080ccb31b1b61489c88912b0839aabfc7b8e8
SSDEEP 49152:r1hpsNoJpF1A63U44CwH7R4xoDmg27RnWGj:rmifPWRVD527BWG
TLSH
T131B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2c66a532a9da132ae88835760d6e629d97c0d7b080b6043a88e3b306a8595c59
MD5 5e393fa311ced7caaab0e30c0faec26f
SHA1 7e51fbbab24d31aa2d54e6d1bb515603c66ac259
SHA512 c176e619a33d452f5c53730ece93d98a08fcf17d3a200689d9bb87076918854d66a6063aafa794ba6e2674f38d741cad97fe70cb9d3c82e70f24c838ddd89ee7
SSDEEP 49152:KSuZQIY0Be2KcRVtOnks6NMHqLDmg27RnWGj:U5dKii61LD527BWG
TLSH
T1B1C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 48a5cb685869067fb480e8b3741fc985f97b6f3fe4ea8911a1ce16ab21981522
MD5 d0d79976dbc7e0f668a9b1435ee8e2d0
SHA1 5341fed82afccee20c4ab2cb7ac61361e35bf24d
SHA512 ce00c9ddf4e891aed6b7dbc581fc2c12c80f9b527fd91e59e896f563bf3128c20ec36ef19bedbe9c906036ad303ea6d3c6b597dc0f61b16f2f06946ce1a433c6
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5wUDmg27RnWGj:hX2imphJD527BWG
TLSH
T16F95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f7a228ca71a74749e2034b7c477d826bed5a7ed112812dba43de302012f77b78
MD5 b3bc27e064b2d94417cdeed976e07131
SHA1 1f8fc1dbcc7535ca839d678a4128c19da95fdb27
SHA512 edc2d01dc43ff6250c37f04a8800d09bfb33e8bf2722d07406d07c880c186b9d42024f7f0a84ac7a97801936bed8403965698f3302b82a7d9b7629096fbb6a9f
SSDEEP 12288:JDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BF965C41CBE52644B5C3E5F10DAC073E5BE92004937A677CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ba93f539f38f81a19fb3a18517340c5126bc36d6bb1c8d940cefec764f9616d8
MD5 bcb0186a4dbaedd3418358eb531a8353
SHA1 287df57cf236f2dd4af16faecbb4292829a424e6
SHA512 68f7b65dec90830b2e6adabb1aa31feb219afa25a2055a839334903724d27767c632090a1527088fafe447911add2fb00e4cc98d44eea8b0ddb2588655fc2f35
SSDEEP 12288:aGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BF965C41CBE52644B5C3E5F10DAC073E5BE92004937AAB7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9459370ccfed75e840bc5f04ce7e7b09fbcd6eb119463021d01af62b10a89516
MD5 d13c35b2e4239701e5259e32fffecee2
SHA1 ea294aa7ad9331c5e530678e73a1710662a2a931
SHA512 7990c46192addb4c76c87f5be1eea45ef085dfcc35f3658f90d1c8f991b028c6363aa6d8ae60ca378e34d4899f307787d68736919e2d3e979a95d1894e21d792
SSDEEP 12288:qEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a4d1b066425bd0e8d185e6bab76a7509756019ef5fbc1617e9fcacf152370361
MD5 ea6876193a7238ded50fa4052221544b
SHA1 8b1eee049676c3cbfc7a93dd01bb6d30f509139c
SHA512 c1f6c401c163aef61903d0d2b84fc360fddc2831e0105f0a2185ba4377c8900369f941e4cf9e2100aad6320e8ecc56acd15377cef286db7426123ec124abc92d
SSDEEP 12288:eVBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A345236F675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 252f0fb155679e3c9fa10d079f6086b76c2174777e74d38e53156f7bee421578
MD5 aa5825bcdf972b2e357a42cb2f463fd3
SHA1 a93c23821677f5e14f6944598fb6e0cd4ff48c81
SHA512 45f6049d0912dd210472e7650e7acd016d619b802dee7bd84271d0aa635824bb992c7b1ff2eaf5ae8bc1655b8455901b3fbc8c8108b7774707d11e30f8ccaa49
SSDEEP 12288:a5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BE965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 33cbb130fe52eb9278f658bc9a479992f2920c142760ebd2b1624fb1bf7123b8
MD5 615991e1aaa98fbb726d2d6ac460fa80
SHA1 e08d9b5cf037d7e6482c9be9c1676bcdf28cd4c1
SHA512 66873daab6d2e0e0d2ed7f7c453423a6605527fe120d5b4faa3f825e082a47143a1b0b411cd8be23b476355e0eba75616e1164ae06fadfb70031e58b2af78a6a
SSDEEP 12288:EiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EisqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BE965C41CBE52644B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2db33f4a6a5524c1b4f7214120f394eab31101d7ba22a18b2ccaa1b795111ffb
MD5 2253e1b08f90f90bbd15ffb1a6ad7672
SHA1 bd4417c79701b2d1c0102f282a0f639145c1050f
SHA512 0dc4653e25d7cce85cee4c00ed42ddbfe561fed9549a3da4ccf5a5154824cf31cbb8a93ecaddff867f552fe7e38dc4d6e93d7a3e86ccbb6a707652718e43e144
SSDEEP 12288:t+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BE965C41CBE52604B5C3E5F11DAC073E5BE92004937A6BBCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4896f8cc88eeb5b4f7b0e722d278fb3323aabfe908e8e330c28f91c0e4258825
MD5 30e6ea00cc57a447bd89553339cd3ff8
SHA1 209abd466b9aaaeacfa7a374c4aa0253da064046
SHA512 4d5dc349ef68252a866071564d8af5843af5a53bf09d392b7e86411bf977535898b5afedcef52dde8abbc7aefac25854759093f3e844a00bea0bc9fffeb8a83b
SSDEEP 24576:SZMRzFVSOmsqjnhMgeiCl7G0nehbGZpbD:SZMRzf2Dmg27RnWGj
TLSH
T1EA6501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ae9104548baac0cccffe4dae25c7be8da7b058569e22e800f430cd1338f2bb54
MD5 c4e63fb1a70c42eb18db12ba15b6d4fc
SHA1 b8b1a05afeb580bc86bd76db960b410738f26daf
SHA512 bfeb7bd2c1ca33cdfd75223a14483fa98a51ad2bb332d83234555273086eef56bfa88eb2dfb11a62f850bb2a8d43592a8d38a398869ec24989ae74421bcd6fe0
SSDEEP 12288:GHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BF965C41CAE52604B5C3E5F14DAC073E5BE92004937AAB7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a0286a4d1d33200dc0c3bb5ae889979f335d4e840be150f7e9aa43faf02d5b84
MD5 933d87f5363f66ed4ab8a43f5df71783
SHA1 f1e825c579d5ff8d2566e3ccf4ce700813bc6292
SHA512 fd173356c77e1e5fc068b29d690a06042665598ddcaf6b27e825e8bfb80e4bd6f4129a8ad3a63249c9e2a3d925b30ee8e09f8449bea9e2375847848613e63dc4
SSDEEP 12288:srXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:srsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1074523BF965C41CAE52604B5C3E5F10DAC073E5BE92004937A6B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 29030328de38e2e0a20d57426249dd9d9424be3283e92a207cfd53c75d1d66f4
MD5 5c612a4feaca856f9d79346f8882cfc4
SHA1 38718efc4b9e0bc986d02ba4ccc164bcb9c68cb5
SHA512 8bca5d9cb7ed2beea4bbdda2b897bf4aba4d5571692cb7d600e42a17e7a8b122efeba58ea45d25792f19e99482de83c54db550a491eea4604aadf99beeb4cf56
SSDEEP 12288:QyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A55125B73A530F9D1378138C5A29A06F7337C3647204AAF17A516BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a6df40726e418342763e50ea17e3e541441d7dcafd6e8a71e0dcbb6726fba917
MD5 4810ef0d93c50ff20dee3ff206a5c0fa
SHA1 fe39582488e58c9f01503fae3d81a2302d03957b
SHA512 fde978145b221723d2fe8ad2629f89e6338df41fcbaaac77ae7b1c73bc358e7282581ba961c71195be40912c80572e35a49e6f2822e721bd6811122df5baac81
SSDEEP 12288:8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cec3175287dad96431f0ebfea3e855cc0fb8981ccc7c9c2d56f425ccc2effb8d
MD5 894eb8eb76b4aecfd23b4fb5ed96cef6
SHA1 d04e32b68632781976cfb6477161dfb3d995e380
SHA512 ba6ea3f73c9ca5e6ac43249800aa116716ac3e1815487a15a32f396daa5aecfed93e461f2be62659e766890e350c341a065f3927da638c9e5dd46320fb249f3f
SSDEEP 12288:uHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BFA65C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f0da92023096947feb8605417f41b6d2a32fffdfb32d60e19fe18976eac27b92
MD5 c471bc0c8cd08a207b95cbd5b710ad09
SHA1 07e498b1eb1c7e73c2747d3cc72ec5ff7c9823d6
SHA512 17804e5fa1aacbc29035480e69edbdffb12a284f02375bcf0b633d648b313eccd686c14a6239b685d6b25060dd7dff4ea1f4c3ea9ffbc05a74ba9e465af4ddf8
SSDEEP 12288:3yPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6zyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E55125B73A530F9D1378138C5A29A06F7337C3647204AAF17A516BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 20bdfe3f99f2cb5973d2e475a836e900d840155c08ea35e124790c729b085815
MD5 ea51ec6e13b9f8bce95b475b349e185a
SHA1 ec9e1d1591d0a17140d2c4ba81d8c8d54bcd1343
SHA512 05c5fbaf84b67d11068fcec2c9dbacf0e82f26a7b8eed4b208950cd955579a4ebc75a640a098f48b8b073371e32a5ad8327712b9ba13c54ac8eca29fc3a55a1f
SSDEEP 24576:FTDaLl3z0zD0sqjnhMgeiCl7G0nehbGZpbD:FTuLljRDmg27RnWGj
TLSH
T1A46501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 44886603f1b675e9e5a911062bb0cb9507d376aa20704253702b68acee9d24ed
MD5 ad724f6c4145a1c10a85df23527cd548
SHA1 41bc0a298fb26dc710b0eb203ba548e5d34a8f18
SHA512 07fb692a0bac64b1ab654d772d426f8bec4824a9aeecf4c29ac48354071e42aac5e382112e16eacb8f2ddfa48da806978fb847e856b66b321e9767252850b19b
SSDEEP 24576:K3vd9CHKy7GZwsqjnhMgeiCl7G0nehbGZpbD:svd9CHKya2Dmg27RnWGj
TLSH
T16275CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 58d49bd4005cdc0cdb07166ccc584651e3a6c8e58de784e48aeffae41cd3d600
MD5 cd7c3cddd21f9f980f3c3fe76e595568
SHA1 271dd6fb0002872c6bed74281e344b623269a434
SHA512 26bd432116bb507174110afc781bd080ec6d904f1cc2eb7daf5c313f1ddeb34b1e558b2b730b47d317e2a9e08e057859890ba1faa8abb9ec00591b3bc37716a5
SSDEEP 12288:ukXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1074523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e7a3dd6a771e8275cee65be66ceebac73c369caea07135ba908158ed7da3fa40
MD5 98bdba4ba4beb5e9ec1700fda4d6c862
SHA1 797deb90fdaf56cd2f8e85d679d12b53c9f05741
SHA512 df58016c9f45a6127cb0ec629779074e9cc241328403e09547e5d2d1f1b68c75c5b03d63f1733288b2dc4f07b53e8dc52ca9848b0bae8562d8162c4e039d86b7
SSDEEP 12288:eKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BE965C41DBE52604F5C3E9E10DAC073E5BE92004837BA77CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 bca15eee1939add4c1f74995c17315659720a7ddd01a67eca702e16b4e0f3619
MD5 e14fa77cb8f228d554bcb842dd3b8742
SHA1 4e617c81ef0b32ea702296edffc8bf9c52e796df
SHA512 b5cd3b0944546c68ddb2a5082aeef7658fb983887876e69b9e3a17bcabdedb972e0db859d969d6871f6b52299a7c8163148e5a5157ed363171c48afc4ac870a9
SSDEEP 12288:flXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:flsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a604ac9b8b5634a4a62ad0c9ad21f6939fc75814199d9a2d0ad039e7af403a25
MD5 18cd5d6bfb52d93dfcf859e49ebd385f
SHA1 6d8b884a9153b39490197703634f2e0f9d55c0b8
SHA512 17209dcca76fbe9db8906b1ef6b08eda44463cb5f7103d589569a1fa9c4ab8f46c047239b62dd855eb31373643274ba1e0805883ce36879611fa73cc8132ede7
SSDEEP 12288:AHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF965C41CAE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 170601e878a5db730e524d100d8dd5a4ff8ac980e10b619e4a9ac72c06802b59
MD5 ff10ac23e93ed640acb91b364be432b0
SHA1 797ce7658c62e35a447a5b686b3a64ebb470cb46
SHA512 deaec7f556ce45e463ea662c587ab9f94bc93e6428dc5cea89e8b5a57823e0ae04ec51437269033cbfd62d8747c17fe031f94205b94d399c0e9d54276cb547be
SSDEEP 12288:lkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA4523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2efd00bbfdfb6b95d747b444be5774cb7aa82525e97a8e579f9552f5d0985bc9
MD5 34879bef00895f355299d027c30e2d44
SHA1 309e075d9308aa644b306a7c8c860d118fa18e44
SHA512 060a082aedd757c590735f96fb591696c4734c938c58e40d8acae16e9f9b246bfd9bd8c49a41cb2b2246f7adeb8fdb8dbc77cb3b400757de0c6f44c2a245b05f
SSDEEP 12288:n/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BE965C41CAE52648F5C3E5F11DAC073E5BE92004837AA77CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 21dd5fab6376f8ce41015d2f38136a1a605b57c3062abad015e368bbb34e0fcb
MD5 e6d100863ee898465eb66ac2269fd16d
SHA1 f88936dd5eb0b1cb2b4c6cc733cfee688617737c
SHA512 10a5252542afe2b3ce1a9f859d78c1a5c2fdd83af7d11037e3ed34dd20b0a47eb6b70303053a927fb6b76e463cccb81ee4be7291913b6b853b61fd7a0f49e695
SSDEEP 12288:w5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:w5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7364b59725e7e76d3c914804502f15f91c3f23e55df4a7c49d3ee5e72ed471ff
MD5 513d88173d438dbde159d374bd6359dd
SHA1 12d152102e9ba3c92d746015caa1258212ad7659
SHA512 c0481a7de59543c4cc7f7ba93da13f953f0a439904664c1314a5cadcc306f7d98d8426c40e9b80ead5701081d9eaae3db4e145cb2c34dc015d890d919f9cde58
SSDEEP 24576:VfwvUk9RX6wkyAI7sqjnhMgeiCl7G0nehbGZpbD:nMnYIvDmg27RnWGj
TLSH
T11A85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ad814e5b3134fbac0cb49694120190ef8f44329d116b47c7056a8f3e63b01f6c
MD5 44b49d3fe75d1fad06921f578a1c1546
SHA1 632309459b2054ac85e3c12e5c71f3aeaafb6758
SHA512 b0553e884f3e63843a0c9f64a1005c7cb1dc15683db6039fae23315f4ae266fda7082a8b246ca957bce5e9260ef1c9d9ad09b1bac97f8f66c049c23aec13ed10
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Dmg27RnWGj:BySzPsD527BWG
TLSH
T16E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a34cbfe7f8810653eee68601b4460ca13494961c96e5699dea383cfc5e6a5f55
MD5 5e92b6f7b5646cef4d6d4b413e955d47
SHA1 81ea7141f770b3ea351c1c00ba985e5e3da1d88e
SHA512 c700c3562e1d3649b7e2347d34d68b34b37a19e17218a97f01b1225b22698509d444109aa72384d9b9227edab6608bb95557d2a36a6b6dd8a29cd4d87a06aa7b
SSDEEP 24576:o47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY2sqjnhMgeiCl7G0nehbGZpbD:o47JUQjTirIhCnDHUPfF/EDmg27RnWGj
TLSH
T12E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 efc801227da459307e7c4304c97eedf29457b3cd5f8c09ae50c8f98d41f05183
MD5 15b6def51d51e725770c54cb691f2e42
SHA1 8668c54bfe9f0fe0748ef8bda47470a05d2b6766
SHA512 9e2ee3c560379bd70a37679ce307dcfdeeb0cc8476240e6981e44ae8b3310be8d49455730d5760ebe5baba5e89ed9edaa2e5660fff6ed20e8e52f0412292c186
SSDEEP 12288:Tbsf3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fd69584da314f7a6bd9a90877ee34ce3a03ecc4cfd9320b8331cbb0f2e9a2502
MD5 d9e8a4abee0f1af49ae6210c742f6d18
SHA1 ad59dc9c0640cf327141493552c9496ae8f25944
SHA512 8dabd43f60deba749638149c71ca0de2fed270cedc99e5821040698fd95c2c385399fda1cc0a5293b3bad2128be56ff26d5ce43950184c7ca4084a26ab731b48
SSDEEP 6144:9sBC2na2pko5rERnfKDexHp4Zy5l9PTTH+YIT/45pYySe9M/LIHD1F0aG0Q2xhf/:qjSbay5l5TTk45PMLIHBF0aG0Q2jn
TLSH
T1E0351611B66AD75FC5A940325E37D2CCAB707D01EE456B0372C8873FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9f902d42ee8394ba06562692af92f4f439cba9a249c5faaf51d3998e1a074880
MD5 11f13f79940c2faac15e35264ec62931
SHA1 fc7ec55338116934a8479704040dda4ae678c9f9
SHA512 432c7c974643eaee08abc8db75fe4091ccb19d6354c32741c2fd4b08d453a882136c1b3e7e55e5dd4880f63661c1152bfb5dae8d59fd275fa3951345fee8c6ff
SSDEEP 6144:pJjT2TE/PIfInAfqZ5m4sBmKDexHiamKDexHogXFoAwB7P9sN6s049:PT2TE/NOda9gc/W9
TLSH
T12865F841A537B39FD1F76031032A6A8DEB74EC02B7056F2667C8453AD86A725A0FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fb25ba26b302daec800b07894e9cc788123cbb6c8eb6d8a87cf98f079bba416a
MD5 ddf0032e506e2ee3d2f4e12a3f0ee627
SHA1 2e9a770b4f07400fabebf9bfb872987937d814e3
SHA512 502f3565c832d2b3e8446ed7edd69a8fede65911228c155c008d3435dec5e3dfc6cb325ac5a17eaf74688077c6b08a5a1e92ac2d6fdfc975dc8fdd3b807a0adc
SSDEEP 12288:a07vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13045237B935C518AF83605B482EAE12D681B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ace8f3a21773baeac9537bab4418c71e6bb148cdb0e8a458c3d72ea7fbc8f630
MD5 43962752311e998fb61d14cef2677c02
SHA1 ded50d95e92375a0f10acf3a52efd2f052848233
SHA512 1d36689958049c818cf03f97e1e48e461f16d48e1d731ce5e26a1d50c927e948163ed2c25d0dbd8e09a1f614cad8c452e17b8fced0329cc6f24d3573f10edff6
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYtsqjnhMgeiCl7G0nehbGZpbD:Cgb4mBIBhGF6Dmg27RnWGj
TLSH
T1CB659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a16491c95eb7f9297ce9a3a7679cefa0e7a3d05c3c850576755ac3ea837b8842
MD5 170e6c11f77b3a86a4bcf3b1ae11e921
SHA1 694aa40652c70dcca6af1eec3161db844fd0b1f9
SHA512 51415a7713da1a409bdaaeab02fea863fd6edd64cbd02e2b9b9150ab499aa5af473ddc0cb9f16a5c074e0a1de1df42be33e28f4c8a064fd1c420c5d879aac4e4
SSDEEP 24576:RG88u8FpJqH1bzria7/mmsqjnhMgeiCl7G0nehbGZpbD:07ZFPqVea7/5Dmg27RnWGj
TLSH
T16785016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8968863f185d09ef3aa6664fcdb2818f5b07353c3f7865ef8c1fc25df03a9a1a
MD5 dc18e37f904407031841a7e1ff17d938
SHA1 74f64ddf897d02b13cd7e514e30270b71de648ed
SHA512 69d05dc73b500aab2bd77a1f35a03a0188edb6eb011be82179fcc5ce781e82486fddd85380c134f3d45b16a561c08d704c4171c962df5b4faff1094b6c8fa683
SSDEEP 12288:0HvUrBFrEjwaQyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:0PUr+NQysqjnhMgeiCl7G0nehbGZpbD
TLSH
T15365F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 be502fdda9a74331506202ebb7a0c3230890df545a394d6b61211c3b3cb2c996
MD5 a8830191bfcc841feb81860f4acfd8f5
SHA1 0b9319bb9a0b9492a0b824e8509b1609fa50bf4b
SHA512 aa94cb97a268b825c20d0a584202d7a79be236f84bf706b00a6d1be2a4d9b9b80ec2f86a9b54d3a70055f794afe3f8a8f37a4e8f662e4b577d344c4ef389b39c
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmDmg27RnWGj:tG05lO43bXD527BWG
TLSH
T1C7D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4a982b687c081589eb2ff2d7de1b9fffedcaf20e3f5c23f06d36842b44fbfb7f
MD5 cb0aa2a3c47325c8aab206890689f36d
SHA1 700ecfe5423fc2e47f8ba0a70a248678f59ae97f
SHA512 aca91391bb5113ca1cb880e1644b9e5ce77d017fa9df296fda74a1dab51f0a34d34f4a3babd36b774e8e84550547c1e9cafb3c7d6d15ccc2b3e7153643fce1bf
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnIsqjnhMgeiCl7G0nehbGZpbD:Sa5POZ3BJt2pasx2+meDmg27RnWGj
TLSH
T1CC65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fea70c8906a5e1335a9b023197b2a54b3f975449148548087e98f06c4896d154
MD5 6d361196bdf7c5d1f69ce43031add510
SHA1 9890acae8853ad845393f6ff3205d8d27c46df80
SHA512 4e262a474139f0f327e198eb6efed1e2976a19121c43bae6894fb0fe8e7a51925a7fafc589e2eb5985109fdf8ad747713032ccb35d6ae5ab250dbfddbc057f1c
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkusqjnhMgeiCl7G0nehbGZpbD:qNc/zEOVHFZDmg27RnWGj
TLSH
T12A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 14abe140159f48760dbccaa69d2113d3620a586a63283db22eefc2daafedad98
MD5 1e87c199db579db9ceba6fd3b0e25561
SHA1 e705a7725ab92a00f5b69e0f8ebb6d901f6ccfc9
SHA512 37da7d095dd6ae2c28c2627d8000478fef04a79e7ea74a53024905910bc314f4cda91ab87099f37bf96023be937ff4bd138cd64938f394c4c9d2f790feba84a5
SSDEEP 24576:TTkNvNnaFeYhJNtmZBmssqjnhMgeiCl7G0nehbGZpbD:TTMwBtOmYDmg27RnWGj
TLSH
T1B355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4f8651afc2255b4d3f346b5cbd5beb6fe085b8da0f491925b7a58bd7d2c2c300
MD5 93c3e0c578bbd85f00362964003c73f6
SHA1 08fcb4c30eb4b69239bb3c435738b7a3b96062de
SHA512 d2a2e68e2fa8d1366c130621cbdcd30b6454d0f619f6f4be42142fa7bee984da5fd5a57fc8c8ea319490867eac81c610e491eecbd5c3feb2a1c5f202bd8bd39f
SSDEEP 24576:ZD3FHshBIYQgAjsqjnhMgeiCl7G0nehbGZpbD:ZDVHeBIAAnDmg27RnWGj
TLSH
T15A75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-324-0x0000025D0B2B0000-0x0000025D0B930000-memory.dmp

Download

memory/548-394-0x0000025D0B2B0000-0x0000025D0B930000-memory.dmp

Download

memory/1872-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1872-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1872-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1872-70-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2028-275-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2028-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2028-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2028-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2348-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2348-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2892-309-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2892-103-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2892-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2892-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2892-97-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2892-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3340-83-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3340-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3340-8-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3340-0-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3340-7-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3712-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3712-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3712-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3712-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4112-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-26-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4112-18-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4112-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4464-49-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/4464-53-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/4464-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4464-43-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/4464-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5108-85-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5108-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5108-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5108-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5280-124-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5280-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5280-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5280-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5280-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5832-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5832-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5832-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5832-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5832-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5912-117-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5912-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5912-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download