287471bea9812e51f9a69b3bf1627e37b15396604c209f411225104ce06a8ea3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.2MB
Sample260804-dze4lsvtfv
SHA256 287471bea9812e51f9a69b3bf1627e37b15396604c209f411225104ce06a8ea3
MD5 1157baa211b23a89cf8daa155c378f1f
SHA1 42afcd90bae40607434941cf318459a626002ea1
SHA512 77d8b7398b42d9eaea8e09aff88a07834b23aab28a2ceb03651aac4af018c783d233dfc6c7fe1a8577d4306a6a3a1c7b48fb62772732a0507bf13b9cd9ae4709
SSDEEP 24576:6FlGpYoWd4yiHNbnnKs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0lfd4pNbKsLNiXicJFFRGNzj3
TLSH
T14045D056B3D012F9D0B7D13ACA568A61FBB2B8054720A7C703E45A592F277E14F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5156	elevation_service.exe
4772	elevation_service.exe
2764	maintenanceservice.exe
3032	OSE.EXE
5912	PerceptionSimulationService.exe
2372	perfhost.exe
3636	ReFsDedupSvc.exe
1432	SensorDataService.exe
1108	ssh-agent.exe
5476	AgentService.exe
4836	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\56069015209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032931a20c123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000679b291dc123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de966320c123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d9f5b2dc123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d54d8520c123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004498931cc123dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b62d9358c123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ca2df1fc123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5476	AgentService.exe
Token: SeBackupPrivilege	3636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3636	ReFsDedupSvc.exe
Token: 33	4836	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4836	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4836	SearchIndexer.exe
Token: SeDebugPrivilege	2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2912	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5156	elevation_service.exe
Token: SeDebugPrivilege	5156	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4252	4836	SearchIndexer.exe	101
PID 4836 wrote to memory of 4492	4836	SearchIndexer.exe	102
PID 4836 wrote to memory of 5264	4836	SearchIndexer.exe	103
PID 4836 wrote to memory of 4672	4836	SearchIndexer.exe	104
PID 4836 wrote to memory of 6108	4836	SearchIndexer.exe	109
PID 4836 wrote to memory of 1728	4836	SearchIndexer.exe	110
PID 4836 wrote to memory of 2200	4836	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4772

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2764

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f5a694c7b6e99ec6c1bae192fb0c577170e0ff51c4e394fc963175dbc9e99758
MD5 ac28338a5ce359b5cb93f8a5911574ce
SHA1 81f4967130af4c7478d3ffe9067c7aa060952a88
SHA512 8dbdfb789f4e580980c2f47ad53d6566fcee15e95208cfb5ba68068853bad92b1058fedd968d810c1d0f690b530d960833b7438ec290795b229e47042eb2ab79
SSDEEP 49152:qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnILNiXicJFFRGNzj3:c3q6mjBL7wRGpj3
TLSH
T149D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a60328efa711231c0ffe4e8dc9d206ed08fd1e0b4dc95313e41534379cb2c514
MD5 d800a832103e72505f7212d6f5933c7e
SHA1 945391cb0fb8f3fa94a40c1361028194c70ba255
SHA512 841b5dfb09c969e6862cda438fcb86493483ebd42c3da94927b22f7a97bc2d58c430df2646c794f88da9592939a9cfb3aa3a3a61d9820392402da7eeea71fcc5
SSDEEP 24576:NXYfDtczAP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YtciLNiXicJFFRGNzj3
TLSH
T17975012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 72d006d9b26424e495cca4f62458ebe921a769426a8d933b2485d944ba1e2bdc
MD5 8f0bf5da92d2ca26e4a3b7dee925a078
SHA1 4e1eb3c092c045d22d69fb566096b85ff3b0cf85
SHA512 78ee624d65d67b6fe750ca2df6b9d2518f1f0ff4ca5734ebe92696d57461a4aa1c45c04976c5faa74d79d7ee7dfe551c0c7bbd9f2458c631f988b457afc98947
SSDEEP 24576:J0Le5ji0hmxhrMQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JPji0AzFLNiXicJFFRGNzj3
TLSH
T101859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 58eabe92e23a165bfba7e52e4e2da95510a95b16c41aea52167a157b0cab2886
MD5 2087aa2b4fffad929b8017f8b0897b65
SHA1 cc4a764e29a66e932142bc1de3e4060207e0f5ca
SHA512 cc49db20b10e5e0b4a2ed019b040ec992b580470c9448f291c5251af85159c30442310e326cfc0589326c96ac0445665e6b9e97c9118166c50f7956dacc0d5fa
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWj6q8wyuy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r/ezSC6vUzPv+HjyZLNiXicJFFRGNzj3
TLSH
T155756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a4e7023c32bd78eb747c502ae0336885e0bc2715863f3f68c062e91a4fb16d6e
MD5 fb14d870b33a0236b61fd8a4f244d096
SHA1 fa025d53b62a85dc02f0ac471436bbad9848f06b
SHA512 8dead73362ba550aba899fdc9cf0ac1f73eb02374e5cd6f483daffea49cf850062b3519e66d5ad4bbe71ff54da153e37fa89e4b6b2ce56c0e6cef8f3c903095d
SSDEEP 24576:GVbqPb88hv/l+Bb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GVO88hXl+lLNiXicJFFRGNzj3
TLSH
T139559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 06186c0f1a6946c2883289c971e59a9d4efcdf56503b2b1c1c373c13a59ac19f
MD5 fc54e0ffdd9ad6274a5a90f3c6d580e8
SHA1 ffe176af30654bb96fd53791aaf7f6b842e7cb8a
SHA512 8dde2238a64603f19c75808ca5b9fbf7fcdc00c42053658f4cde567880cbeeacb57a9cf5fa0ebfb5028b917224064b4ec34ef237157b68e52d2d891af1c736e8
SSDEEP 24576:IGs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4LNiXicJFFRGNzj3
TLSH
T1355523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4ea86bdb74a0e0226425773257f4cb790c7931dd5614e15b1501b45db3c1b7fc
MD5 c37a23761a25efb6938baa4d15f68d5b
SHA1 7ab0f70737febab4d20e6666eb43dde40a38b737
SHA512 9afafb564b7ce53cdd1054349d35aedeacdf4fac9ea89424c1e88da6ed2cc74257a00bde490a2ddc4f4c8d224146d52ab7083102a6d2fdf3c4a92c6d620ef4ee
SSDEEP 24576:kJIUj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kJIUjLNiXicJFFRGNzj3
TLSH
T14675CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 45f46116a2bc4c41aeab850bc01e8d244692cc675b1402ac4a1476bccc628145
MD5 9d1b06a8faca7aac04e7cf041c9296ab
SHA1 170660538eb68f03680d0f22e394c691fb7143af
SHA512 17fe6945a501d3d4caa71075b02908a1e3e638b7041d5cfc3d731c378912391b233301e58e51d4a92af5bb3623b2a5f394923d4abbf4b483339aa70bef2320c8
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:EQvGAdlCEL8c/WRNw5CC7wRGpj3
TLSH
T1BC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e089ba83829d18b71631a003e4b3f00796bf13004325db3d9a656c09c0186438
MD5 0c477ef421078e0c9fba6f7d315beaa7
SHA1 1e9c44926f5947d57fa0fa2d86c8da893a97485b
SHA512 3228599528f06f41f28592c19162e02988e76f4a1c6a9e82f651c1aa5f7f8b87c6264a4eebebb2e685be55df0c13280cb180620626c804f8d9d684bc425986cb
SSDEEP 24576:mfewsAjV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UljVLNiXicJFFRGNzj3
TLSH
T14D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4934bce7162576dd0a655591f911d3ac210d6ce0e11fde8e339da32309c1cd03
MD5 173b1c8054c1782c29c910d63c9f961e
SHA1 b5a5831207f51d340aec94adccaca1069b4b2e1c
SHA512 39b679c0c4e611b1e9362d9d82d3567e7437ea3fae51f9b7eabd3d7292f9e30e931aa08e7001a923ded017a9d9befeacca7955dfd60335850714e2625fcadc6a
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRF9:mUEtQevvqc2W1cpV20I32H9
TLSH
T165474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b967eefe63cffeba42fa2ef57d90dfb09025fdbe43f7b26d2411173a8159afdb
MD5 14ae02228f191d6090928c3939a8879e
SHA1 6b8ecd54a5e2564b61c0e394e850810a985de479
SHA512 d4698497eef621dc9292acc855513669c901e1a69acc02f7e419de30c4733aa83d29e989f0e0614c002f0a57c5d2bff8f47676e0cd7707df635478339fcfabc1
SSDEEP 49152:iCbRquA/m2yL5zLfFiV+XenmE3/z1LNiXicJFFRGNzj3:noq2VjnmG7wRGpj3
TLSH
T1BAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b277224dc1aa62de5bfba29cd58ee024dc242846f5c29dfd92289d0d05323549
MD5 effb774c94cb88c89464daecbcf45ff2
SHA1 8d1c3016624f2ff669fbfd50307b1215ce8d8fbc
SHA512 11d748ca7f914abf2d10c2b78f28b2d52a7701185858c62cb02a7a2bd1b1b54fa9301bfb2e683ee52f73fab5fe5f4913e9eb5a36978cb928bbabe0a5ece37cb0
SSDEEP 24576:GAhGL6IFoiwtA5l7S53m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GAM5Foiq5WLNiXicJFFRGNzj3
TLSH
T159359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 215777344da501c3ae1351067da7b6a415193c1a73606e532113b913f597a5ee
MD5 369c5c81d02c38cf058dc4294367bd54
SHA1 c670bfcedbf4c9516a638640982aee569cd3ea94
SHA512 278ac54757b8f80de57e8035a592ec5d0febb27faed7e78826d80fe25d6c0c4401ce9b6f6d9e9afc06a7a9c91e50f81f699f8626328e4394bc6e9e2a8c3de5ea
SSDEEP 24576:bwuROW5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bwSO6LNiXicJFFRGNzj3
TLSH
T15865F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 744eb6484b5c20bc4b9a4ef839638d55636aadad1998abbcbad2de27d4835854
MD5 778734ee2f7c8932bedc69122105caf0
SHA1 eb5870628aba5a6816679b16fc2090182696f630
SHA512 15869d9692906e03367d96015222596447eb4e55d9a5baf677b7402b610bfa438d1c2877eefabce0bbe7819f7e2688c62b80a9103bbf4c20cee22c764032ce72
SSDEEP 24576:OZuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
TLSH
T17555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 905454afd1eb3a67c5091e566a62aec9900b83e4e75f870903cc32f9cd6dc9e3
MD5 59bfff00be49a86737cb37e4c59f45d5
SHA1 a831651e8d9f06b98c66e6e1f2d5512f0b74fec5
SHA512 577b99d4600dc420c1be0293f6de7abd908e52fe2a0482fb3b1f010cc5f396fcaaf35d07c745187b22965d2ad3eefb2c6b7530282a27b5272cc347a4fb2275e5
SSDEEP 98304:YQRQyi36YOcPDLvw2gAf+PN3X7wRGpj3:PQyiKanX+PNbF9
TLSH
T118667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c095c31e704de12abfa6abaccc223c433134d8fefb188fd2d59f538e2099b6ec
MD5 88295c5147d4bdc5fb1bd0ffd9f644da
SHA1 4c176a9408e4689d80b0827c58da37167e0a4ba5
SHA512 c36d049de7ca64f65dd569213587dca193a0bb1e267d2a3bc8fbfec25066fb94359a6941637f502de50953f615d2a03d5ac4e8cb2bc7b6ab4c30874bf279401a
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3X7wRGpj3:BQyiKanX+PNbF9
TLSH
T1F4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 87735f6a13742de9cd64da8b82617ec3f41bd52429afbd66298a988e7d219ae3
MD5 46ab6027059cba066ce8ad6c5ef6896a
SHA1 53bf8cd5049d60dfa496d866cab46ab92721c3d0
SHA512 9986d68bf45b7478218f25b69d6ba381f5903162cd9d79ac55787ac10393d3a8b15a7fbc07163fa71fb2c11e3772c8a4c8c59ecf918d2c7745f6cdb1ee3719fd
SSDEEP 49152:x68Qg55nhkeWu7PNU3/FLNiXicJFFRGNzj3:vthTRc/F7wRGpj3
TLSH
T1FCB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4b49c88738b965c876bb9ba404a13383a8480e211776fb3038edbdcf68eb51f0
MD5 b8012eccef88a16f090e9fe85ebab334
SHA1 c5566b681dc9fd8572de43ca5a27ec96386af1b8
SHA512 785415cd3116082505fb534aa7ee7a4ce95913c3ca37b3cdb239d79b796f91fa507060ee4e4ae12662fdbd61a18e244bee2181ff154a2ebace0316845fe5a4a2
SSDEEP 98304:Ky5112gYy5azzVvU69nLKnhZs7wRGpj3:zLIHRWhSF9
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9a78367103283a9e766bc4677bae2077c70b4e314781f87a707a548e7d331932
MD5 6829feac6981ec723abdd95f96402693
SHA1 ea4db7ec8820b21b66e44d0962ba69f6f267639a
SHA512 4f013e54d21a87f273b2e9bc6a6e4226ef353d66756c48f194f4394d18c582b9a82457f643dda1710a83a11f48ef4e28843c2d2f5d4f94751267a67ace88f62c
SSDEEP 49152:4B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl/LNiXicJFFRGNzj3:Su6JmIxd2d/7wRGpj3
TLSH
T1BAD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e1aa5be1c18ea5e22726bacbca04206713d942cc90bc335e9e3c25e736d976cf
MD5 a0d3e235e3be91a018e321275bbe6239
SHA1 8db6babd179186e423470199a94fb72b4dd5f63d
SHA512 8bfb980daae73e5e9f5a16bde7bea98a040e9c4ad1b67a9117aa64e3956c76b538463922bf6d934777aa10551b921cd427a019c61492980b043b69db5c02d829
SSDEEP 49152:U1hpsNoJpF1A67U44CwH7R4xDLNiXicJFFRGNzj3:UmifPqRG7wRGpj3
TLSH
T1ECB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5415b0a0ffe3ae5551d7ba71ac91513ce92f3c18b7760f84d9429b2aea8db936
MD5 4b9124db5c0950c2e91af0c39f59c73c
SHA1 6279a39dac4966f3d098261f2f1c451234805c0a
SHA512 27e2ef782c80a7ba4534a63230ffd6561540a9ea9978363b7b62c5d5877d75b32aa839e2b7ce1fca83716772b76441652bc1ffbc8106aa42a8507b87f1f6a36d
SSDEEP 49152:4SuZQIY0Be2KkRVtOnks6NMHqYLNiXicJFFRGNzj3:i5dKqi61Y7wRGpj3
TLSH
T17DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8c097586e0e8606788ff12e5814d938c3b2c1c8f1dd3ffef75ca15c9b794758d
MD5 0f6c549bc1f282474f86a8ae6165b8e0
SHA1 4e348d259a5103abf24e6c15447f913e24adf180
SHA512 2d9a9cb05e857782cf27977f8e5079d8819e1109ae0d7d60b20e04922392abcd9f345fbe67abbdc0995c1836d917dcf6d3e1d0290f7d6a975375bea68599b692
SSDEEP 49152:7htSn8EApI0figjgiDn0AP5wPLNiXicJFFRGNzj3:aX2iWpha7wRGpj3
TLSH
T1AF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 92ca2c506cad2638bc17bb1e60e2b5b10bd3c2f8b93ea85eec3d4ec8463f6bbb
MD5 0a799ac3fa1aeb20cf93390ec06cc818
SHA1 d4e9206c167fcd96d86415358cdf5cf37cb24fea
SHA512 fd23e6f4942cfdf8787639e8392ae8f5e9c57d8c1cbde3ffa5a1aec688063fa7d3beed972a918e955b256836a4166c728d32b51ac25619a75d183b9aa323a48e
SSDEEP 12288:gSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 06addd7bc26db47cb889c9f65ac4d3735b1072d4edbc0f025a627d3ad21a2295
MD5 6d06fe7cbdc471d1998dc559f2d788ce
SHA1 cd29f0e214b5c714c4d661feb87ef04c4e296fab
SHA512 664bc389e22fa788e8c97500b4b72772a76cc80e39785a0f857b9ccc1b3f0b5e0113bbbdbb5a1c250b86d56478eeb42459d8be3904d9bc9b188f74b4924aa3f8
SSDEEP 12288:DtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3548955B1FABC003986754428F5882E2DEB5619E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c28e3b5483a1b922c58c8837ff9f0cf8d847f643ef3c2f837eabf00dba39f4fd
MD5 b519d52376ce5654f6fa80657472082d
SHA1 76540ef6e6b8443fe9651f1c3587f0535b4490c7
SHA512 c5b987600bf44c895c4fbd7b58bd8616b450b067f534d48b50d8cb7feb594339e6eaef83ce822652805db0a8cba6221d8018c1538e7fc64b3f92f4b756a275d2
SSDEEP 12288:8/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a0e6544516eb20d2b169b4b419a3e7f1e554071f025bf877b01bcce556cd1bcf
MD5 339a0c64709325fb021bad18c215a7a5
SHA1 f7f608e48cc5aa66cd38642c5e50a9e85d08f173
SHA512 42d4f5f38813797bbbe752549cc2a324a244631f8e4abf69d108c3a2ff00c8ca364bab5fbf3e65361406b7b65ee3cbbf441fa2b908d39a655d757e866bed32cb
SSDEEP 12288:kV8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A9552393168900F1E9B98039C6764424F2A47D6CD7325AEBD3003D1E5A75BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 695ae60c6714a1700f2222bb5c571e6c334a07b926bf653c17b0eff578e3dd05
MD5 afeb31b366878c6d6b8b7e592471d5d9
SHA1 238ba939a892caa501f529ad25a27f85998a195e
SHA512 82fa867449a833749d5ec191aba074939801d569d1102818a84dca98ef37701d990f0f7ce99846529badf9fec90a2824e2ca00a2701c3be94e32727e19c28442
SSDEEP 12288:LUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A95523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 34b8304b33f803a010c2e91a83edaefc4b815b92720217a1e4ee4b654ffa8070
MD5 6649a72d4f29e4aa723c14b3970a09ad
SHA1 a784c6bc299ec7a5daecaa2532493583e7512c59
SHA512 a567900641a6764f5ba0bb522134fc4f15fa34b7195ce16c5b77bfadb8eb4c60ec2e53cdd8e15561b755470f1e4081bfbfe08aea69d7f2aa68e4eb67e52d26a3
SSDEEP 12288:cxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 95bce31927e0c8d0c07132b911b7733c864d66fe3c14edc394f132d6247625b2
MD5 b46959f0cb2747ea3d4e95b2f994f536
SHA1 809029a296616c1451c635fc2895addf76db8457
SHA512 0664b9fdcfb665dc94949959ab2bbedf8701fff5f7e3f1365e1caa1e57e59bc1557ebd736474d9fedfd1996d0b2b5d25d666104aced837fc8e55a6ffd8e8423b
SSDEEP 12288:FliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1365523D3548955B1FABC003986754428F5882E2DDB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1cd707a6b19084ac4d234332f9a04ec104dab93c5d16aab2dd3e1adff360d86f
MD5 b17e5c59016d241858c19106a23a324c
SHA1 6e4ced7d4a1ba79a5057cc702cfa0830fcc0ec8b
SHA512 63fd8aeb1884de92ca5a1c8dfd305e9258e5592b0f0e2e53dcc5878d39df91be7fe99bcc497dca4288ff40c408a2bc91073f1cf46b54c964ea1eb9a8945cd561
SSDEEP 24576:xZM3zFVSOR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xZM3zfNLNiXicJFFRGNzj3
TLSH
T14F750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e29ec3eddb2b29783c3b68761969d398e5a31178616858bc496d2025696b4a21
MD5 9654f19b194bd694c5ab8daaa3a9d4f1
SHA1 a57ad3cac2601c800bd8b9ad24ae43f41345f0e6
SHA512 ceb4d6f3600915f91ff9918da5665a1112a2f6c8722bbb9e564b766a3df97cec12a00db765ac14c631b271f3d3019ffb683ce4eb29563b6939dd8de26dd50827
SSDEEP 12288:YeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3558955B1FAFC003DC6754428F5882E2DEB5619E3E2083D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 59c86fd1b65a70820ea22da61add975c09973fda7d51dee140c9b8a35caadf9b
MD5 b31162feedeafea49b9f16d8cdadf6da
SHA1 96162aa556c2db72da730579ee9dd260addfc223
SHA512 50d6076e155a2483ee9d044e2b2fb26524bc779492264d010937d27f90d00fe2f3cb68bb9ce764279244342e4b47c0037a0ac148ea2da7794bb9d2b65588700c
SSDEEP 12288:CaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 df69019774f62f365816eca1ee8512c4fdf1bb444bcd228423d980356b87054a
MD5 605b648b92dd3148c03936cf338b28de
SHA1 370020512ad81aba29684c817034b410f2201aed
SHA512 1648b07e9b840a8617eecc8be3f96c6a0a4ecc8de08a825bde20024dff64c9c9527d6ae190c131dca3b210724eac8f0fb93fc7bdeb1dfb546bdb1cee85e138e6
SSDEEP 24576:2zyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2aLNiXicJFFRGNzj3
TLSH
T127650247629530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d59ed401ccd50a2eb1117bb6207e866513f86ee525d363e899a17147440b514c
MD5 1fae85feb48d7e3968c57f0111d2b52f
SHA1 d5c14cc78a7e79509adfe3b65d48752e8dd85071
SHA512 f6b3e44e2421158b1e17eea0f698a598fad6f3b9171a53faaf6d7b6acd513af607cfc12098e507e89d76decfc90d2847bda882ca215def1bb68bdf7c536abf81
SSDEEP 12288:YeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2083D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bac9dc16efb804b3e843734d5f9814aafe3efb4362788600b607e203fa6ef629
MD5 5a472a8486c4e88d611ad7861e9cde4e
SHA1 9947dbee58a5250b37fe66c29152e8b3ea5ca6a3
SHA512 f4aa045b5060faa5f1ad3bc14b109d52ad35bb850647e5d626f349b18eab55f4470758ef0597871025257eb1f6ba4b59d9460d908705b97780395daaebb5bc8c
SSDEEP 12288:6eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B5523D3548955B1FAFC003DC6754428F5886E2DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0a08dd3fab8f28e78c7f1577665419ad0eebe82322b8f993c0ce0fa2bdfeb2e2
MD5 a64ac3dd08e02743ca74e5acd2b4b0d7
SHA1 85335f973707061eddd09d1967a09650dacd53ef
SHA512 cb0511cfa60b8de5ce03f4a273aeaf4224ed4e5ff7325139ab20e651673fa97a78da2cbbaefa62756fbfe61b79c16bf8f5130f35b61947724834cf84fcb43bf4
SSDEEP 24576:Ezyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EaLNiXicJFFRGNzj3
TLSH
T1AC650247729530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a7e61efbc0057a604144cae8ae77beaebc2056ac2cb64d70af2fdb2705e1516d
MD5 395b650ef8365366d4697996bde2c3a4
SHA1 c3a0de7abf08f45bd60c286c468172454357e756
SHA512 9d62044e090d78cb16356bdde18cd5b9c1487463a29d62ea90158f74b01fb3e1945eaf201ddba0b19702d03816b5438a9785185b59619ed21dee1f037c7bf949
SSDEEP 24576:HT8aLl3z0zD7/TwSfVcYG3K/cJHlnFR+IGNe8j3Izf:HT7LljyLNiXicJFFRGNzj3s
TLSH
T1447502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 3515ee4581ebea17e4e4d01c76b50558f47c4add375d20fecefcbe0bb6f9ad5a
MD5 20338aecaf5286c3a246098519f6b3de
SHA1 342d48c851f23290cee174620ec2461e16598192
SHA512 af2f5abcb4bc4031ba0bbba9724b7fc8c16b449c69fcf47d088354536151410b0666116653b04fbe77d3ec286b9684eb8153d245259c9b76b728e1a66f4c1219
SSDEEP 24576:s3rd9CHKy7GZ3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Wrd9CHKyaNLNiXicJFFRGNzj3
TLSH
T12185CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 db10e8a0f84e7773bc5691bc7e297b00b24e303b8cf9b422214a8bcebb209a24
MD5 c389620fb8ebea37ec4d9bf866387d2c
SHA1 8cf724158ae3be317ea75f82433e064d3771e66f
SHA512 162fd5421d170774724bd16c0faed8111e0c21fbc11c3dc51289a7b32e7a2ce86a71310b60ffa95230f9a800e292fdedfef4d666dfcdd34b0cec9d5222cef4b7
SSDEEP 12288:GfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B5523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2380835fbddca83d314406ba41d312eee4cbfcf1e323dcb2a24273bb8ea797b6
MD5 9e2044a3b9caa0cb7c57ccdd5c460ecb
SHA1 ed1dc563994aba04ca05326b6346bb97a2f38437
SHA512 d722bfa1ac35198641cb12b0307c17f915d8fc285f8d24163831083fecf275a804c03a2b2c8f014d6f08ef2c37b545a9fa262d43f50918f6f8e18d41fe2250a3
SSDEEP 12288:jZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17A5523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fbb5e6df480000dd6eaecb6065853e1abb6da3010bd04dce530aa9f770b52124
MD5 3afaa2364795012e6b78a96595a7128f
SHA1 05dd78ca5215f4fb851ad53dc0f5a50eaf686d83
SHA512 977d0f75600552977420ac529fb640ef7ec5d80cf7237a364ed134c4e3928a41dc24447a577d4825a0bb3229862086ad2d583f31990493673cc3164b220b4fa8
SSDEEP 12288:GYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 822e9ce8efeb4699b0c32e960de7d524b55372a2ff39603b54a53ad9e9107311
MD5 0e5911e4a666619f5d08326be5de23fc
SHA1 00ca762fe10b6d87d28376c4b6771b7f2cf28963
SHA512 7493d6b35f089d189039f7fc9d3593b178cf65aa455343aac19c4f7ca1575685f394c1732aa85eec1ff8ee1865062763c9a473487e95ea11b5c172479ab1c3c5
SSDEEP 12288:LeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fdbb83c0af6870e04ed623881f5ab3e0f96ae0eb118be770d82a7c64637e8c63
MD5 5a4a111bd9a04e600129a4bda0c64d46
SHA1 e42f1e9f4144d5ab44b66191d107ac4a450d19b8
SHA512 240500fa66aa603d95a1b70003224b110e3bb0dcdd230499be7aa89a4053aa83270c36f9c26a5926603362043952ec9177c9760f39e03925423a01a9aa7cea3e
SSDEEP 12288:ifiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ir/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a420967930e16ede0ca84297dcb92fa2e590281ecf879d8102857e9e5e56c34e
MD5 a962f207cc31d159308f7239fce5ee86
SHA1 c73b825ffbde4bff0adf9e8e5309a5596948b864
SHA512 d7a27a36c18b299e147768b48b548d95924755be62c7ed9172541c0352d6389607ee2c4686a166d0ead1853154c8e048c92b3896561b564e1f85d763ed651663
SSDEEP 12288:d2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 319caa4c2637b6ce64cb39019ded32be531660492ec35aa26e1edaba7531103e
MD5 607605609bc2618b32f3fafe64454fc0
SHA1 a81d35ab75f70b5183225c9f2bfc89009be3a668
SHA512 a6abc3e8b6e2f7243f086b85b063f3b7aaf83d36f85b3553a6f6156ac82fd5598c1a25c4d949db676585b39c41c286b7ceb6593858f7ec65fe020938bfca8564
SSDEEP 12288:yUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:y+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1565523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 60969ce5d9fefb137d17f3123f6b8bb871cc030744bc792781228915b1a725d7
MD5 5f43591c27194687e5c2713756ca6c8e
SHA1 ef034dd9f29a0ca4cec9bf75d333eebb6e972070
SHA512 8571aed28cea3f73871336670279bd8aca3a2663fdc8c1bfb5869670664954b95b22110cce07426e8657882c93af4c12abd33cb0891ea1469da84c2e86ed093b
SSDEEP 12288:LHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c9df5b7d9e7f93596ef14d952720fdbf82ce02b0926ed8d0455a770f3b624725
MD5 9c344c8d3efb37c51ae9cc9fa450c8f1
SHA1 b9e1af6f6a3fc816969e330fc0aebb7ddfe7cb64
SHA512 10feccb01ad384b26c0e84bb7cb94ce0d2796f994adcd49d46487fbe5230963098d02bd594072c53dba18733e939c530514958715ce34cea16e3b87f6f216cea
SSDEEP 24576:sfwvzk9RX6wkyAIM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3MnYIMLNiXicJFFRGNzj3
TLSH
T1CF85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b356d4395ba44ff17942b18a5b5e3c63816c29ed9bfb60805e8094861ef4e238
MD5 1ddc73717687d945b91160a3d07ef2a1
SHA1 2e20672e54e1fac4b85bf0a9262db239b08b7600
SHA512 343274580204c3621f36e5c3bbcacc6ffb075e12f719d5c4e373770f19491a7bc6d4ec109076cfb761a34e8cf4055fd53594bd51441ca748f563f27577e6dfca
SSDEEP 49152:VYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vLNiXicJFFRGN:EySzP37wRGpj3
TLSH
T1CF066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c83fb8742c39a41c41e3d8ef5156ba865c15c49e19e6043ba8cd2f8ea85e6d32
MD5 682ce5f29ff2cf985ec2d07883d82501
SHA1 a3b036810f2291127809087636291525eacb0757
SHA512 511183d8534c634fbfe0c42dffee57d98a01708b512897189b146b5c397cdc82f98f1017c095408751375e2a004b3228d1d67baf1fa9988a3fd678d5924abd10
SSDEEP 24576:c47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c47JUQjqirIhCnDHUPfF//LNiXicJFFS
TLSH
T1ED65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9a9423cc6bb8e4006ed99bf5ba3ed39a45e1e4b3e8119ca797fbd23a2999128b
MD5 7932c5536fee03654567bdcd2655f1fc
SHA1 57dd7efd4d3781c626ffa34b9bab55fb795d665d
SHA512 ca7e0543ee98a3a4fb12c9a05661bcd0827e938d8a6aa8180d6f02da1902e8df2995ca3bbb2d7f9bffa6e73a14d26e73e5c1dd8b22c24b3aac7b9ad4e9d39674
SSDEEP 12288:DpsfuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14665F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 67be1d53a0d6b9cb2b2a8f621a7a3f943621cb8f181881ed068c8eff44676865
MD5 49f20ee8769ade259dd6c285241d29d7
SHA1 de8ab7c1266a382cb21797730e9a077ef32365b2
SHA512 d73a6915459b94361a9b158a38c00b11edd3c41c10c776a4bb7cc114a0e6b61b9065453aed601fee4e095547701f441573f4e12c16c59d7429e6c06e87e8bdd5
SSDEEP 12288:Wxq9ktU3fJHPUtqt+729r0/Z8f9Kbk7YXfOhZ/HMIoaGO:39UUPRstqt+7248fMbk8XfsZ/HToaGO
TLSH
T13A352850766AC75FC6A940325E32C6CCA7707D41FE05AF0373C8873F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 116b07389d8c380c96df4d8b4310c71521a88a20d1da53473403cb7164f1e221
MD5 52bb66eb9d4eb6eae8ff5e7d626c81f9
SHA1 66cc041977d2498dd8e031bc2d0d8605da8f2084
SHA512 a4fabc5f75ef36c6b59f89bba97646e0597396c586cbd190669e4394860bb8cbd05b0c75218600f8e97253a022ee73b0b8fd32cce9a3bc74b25875755ea7f99b
SSDEEP 12288:nzDj4qt+723qt+72D0UkjU+pJX9+184u9J8OZf/+kJaZ:nzDj4qt+723qt+720jU7Z
TLSH
T19765E9819137E38FC5FB603207365B4CABA4EC06B7496F227388453AD866765B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a6d4f87913ece8885aa19d7d69f8b81e52ca61bf49bcb857f231811a2652d76e
MD5 233453b7d0037e0636d2083126ba3f69
SHA1 440eec2bdb5d6d1f88ff36175b439831f173df39
SHA512 6a14fb44d85287d7a997ea8d633eb3fa37568369b1237cb4fe423a315351807d67a7dab1caec67ec803063cf82167707d3aa08de3694999b0995650000b7b1be
SSDEEP 12288:2F7GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523A3468D59B1FAFD0039857A8434B5497E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 96440b79bb8184c9afaf8c2ea92841c8e768edcb8fb7904774c199a3fc95b154
MD5 41512240045c89a0b878de442f65a0ae
SHA1 31c08b56b6750ef89f3d75fe96be1298d6898d8a
SHA512 51bc894fb005d08965f6d8e590ef7cfc142a0609b29bc47369c61c956d17ec8588dfa975a727bb547820bf268ab2a65f53470446105357552e8167bcad5d8154
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dgb4mBIBhGFhLNiXicJFFRGNzj3
TLSH
T18065AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 bea42150f37e01848c571d0fc46620ec37e06c0264df770961373b7fa3232e31
MD5 f8634924dabf76a4ed1dd1409acd1f77
SHA1 c6b0d9e6ae44226bdd9c44a772ade2545261d74d
SHA512 bfc7c277c9bad8dd56ba37ecdb40f4022eb66cf5fae55a2a886c40b183b932cc9907db92d7a8b7e3da623b4d5074ab6e73251c0b8fcccd3879e503270b53e27b
SSDEEP 24576:uG88u8FpJqH1vzria7/mR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l7ZFPqVya7/KLNiXicJFFRGNzj3
TLSH
T10D85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9708053ba6cabe2a70cbf9ac7e92896560ecf1d7d5bcaf9d1639e979cd02899f
MD5 9a8d00e8bc1da43c919fda8387cd7e77
SHA1 bfe86384cd88ff18463158fa0148807f565f659a
SHA512 bc123b0605345d271570d0eab7c60cd8a9888e2282689555242bcc3217a4839cb2c841b03c746cb2eeb9bc4c43f169b62e17b499d130eb39d77783f41b5517eb
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9LNiXicJFFRGNzj3:bG05lO43bE7wRGpj3
TLSH
T118D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6490c1f17e99c918f1d1dcd4b8e3a21154a7397d5f02a06143ae47c8dc95404c
MD5 c19d877e7821aeeae34e394d9936d0b5
SHA1 64e19e8f3d721a4855fc2b3ecb875a47ba518dd6
SHA512 2a55b6ca7aa9717945351fd356759106fd10f191b9910a7ff82c4fbe916ea06b57a538a14bb1cb45b3735ea79774674649d7f00da40d094f786986c8081ec499
SSDEEP 24576:Lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnv/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ta5POZ3lJt2pasx2+mFLNiXicJFFRGNf
TLSH
T1F165BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a5990371e1c260840c418c520b80127d884f23f4bebf8aae7ab93724b60e3a3a
MD5 2700ba078a83b68bcdb1c4b8cb643f93
SHA1 d52211c1452cafde061cb385485aa1e9312a9568
SHA512 f4e99bcb52174e63291b59c38e1559b8266f1382f78efef0fc20fbe1a6d128a4a6ed3ea727458fed30123752ccc4fd39bd97ff0e6f28b50a6cbbd49deac2726c
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/Nc/zEOVHFqLNiXicJFFRGNzj3
TLSH
T19B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 11a15f99c85c55c76531d7bdc02f94e738a646d10e958db9d10d1bc27459fc08
MD5 aeb7eeddb744b211967d86476d391786
SHA1 0f412a728fac8a5d2ec2084298c4fecab5844a99
SHA512 d0c01f216f05619ff5c5e664bca7b2c625d3f6793b6ee0e5e3798cff60a63fad3b7730b0af7ec3e9a0ac124ec01adfb259b3ca1601a8093b138084dc0340b5d9
SSDEEP 24576:7PUr+NQN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7JQNLNiXicJFFRGNzj3
TLSH
T1FD65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b4ddf7ed46b0c31568e8baddfc1b0522771cb7e01e8ae668a520dd0ec47c5afe
MD5 31485f3b06994bab1d4e06a45ac4c28b
SHA1 9229135dc8d42ee992a2a8051fa3e675f5e57fca
SHA512 fb1a5b740ec96e664f6a86cbe9c872c2ef8c05feda8e521d11ed0ba0e5100c6b8fc9d5288d2f95d8540c85d404f4f14c183d5aefb4a7edb33eea0c261ee3df4a
SSDEEP 24576:ZD3FHshBIYQgAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZDVHeBIAAULNiXicJFFRGNzj3
TLSH
T1A475E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-116-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1108-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1108-122-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1108-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1432-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1432-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1432-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1432-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1432-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1432-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2372-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2372-79-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/2372-84-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/2372-295-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2764-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2764-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2764-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2764-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2764-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2764-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2912-0-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2912-1-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2912-8-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2912-77-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2912-7-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3032-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3032-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3032-270-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3032-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3636-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3636-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3636-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3636-320-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3636-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3636-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4672-319-0x000001DD90EE0000-0x000001DD9116B000-memory.dmp

Download

memory/4772-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4772-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4772-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4772-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4772-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4836-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4836-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4836-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4836-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5156-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5156-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5156-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5156-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5476-136-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-134-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5912-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5912-67-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5912-73-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5912-285-0x0000000140000000-0x0000000140222000-memory.dmp

Download