0e6fdba76419c2dccc69bfbc24f707493ceee14d9d9385be05f56016b1702e55

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260809-akmncsxbjc
SHA256 0e6fdba76419c2dccc69bfbc24f707493ceee14d9d9385be05f56016b1702e55
MD5 58b367e5aa00bbff857f34caba4b3c91
SHA1 cf3aad436861800ff9afe6e1e777a28d76f59790
SHA512 df75c0c1a1f6dec50852988bd4755e304a183eacfb7436ea2d148338b336c71429f2be4781b2e095e709e8b09761379406220470f352639eaf92d470cb241422
SSDEEP 24576:fXWSDSG0qIwDE1X6MgXe4i7ojhsP5Lgrk1TWb4AN5:fVDaue30jaNf1TWbdz
TLSH
T1B545E116B7D002F9D0B7D179CA568B71FAB2BC49072097CB03E496962F276A15F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5692	elevation_service.exe
3296	elevation_service.exe
3848	maintenanceservice.exe
2000	OSE.EXE
908	PerceptionSimulationService.exe
4124	perfhost.exe
2960	ReFsDedupSvc.exe
2736	SensorDataService.exe
2288	ssh-agent.exe
2724	AgentService.exe
1352	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f6c9e4508f8562d1.bin	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cb3d4639427dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009084f0649427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e727a9639427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4b8ee639427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd5f16679427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071deaca09427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e34afa659427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c98cb29f9427dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006cbcd639427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2724	AgentService.exe
Token: 33	1352	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1352	SearchIndexer.exe
Token: SeBackupPrivilege	2960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2960	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5512	2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5692	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1552	1352	SearchIndexer.exe	101
PID 1352 wrote to memory of 3728	1352	SearchIndexer.exe	102
PID 1352 wrote to memory of 1112	1352	SearchIndexer.exe	103
PID 1352 wrote to memory of 4672	1352	SearchIndexer.exe	104
PID 1352 wrote to memory of 2340	1352	SearchIndexer.exe	109
PID 1352 wrote to memory of 1384	1352	SearchIndexer.exe	110
PID 1352 wrote to memory of 408	1352	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_58b367e5aa00bbff857f34caba4b3c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6b17fe8865052397bed5b901d5dea847ece64404446c982788fc70077ec76034
MD5 53f809f1041bcb5c45c86d88d10320a9
SHA1 d49b49872766469aa24ed5b296f86c7c6f534258
SHA512 698d867ea33b7c9d7b29b283d94e781d8f7cd39cbd994545c6be204ac18675c0cf84bf77b92cf462e13f8d47bde6f8b2127208ce4c6f13c6b89a0146ebb44ddd
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMe30jaNf1TWbdz:f3q6HjBhU023W
TLSH
T1E5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6f4ceeed9c35a708b250d65fd4997014614232b0ec42816512444675615a4987
MD5 cbd2a48fc4f99994b9b526ae9b11519e
SHA1 76f1a38f4cf62e4a96f63df6b04b97df824dc773
SHA512 10f1bcbfc9a20d05fe40bf89344263cb7eeac55639aecdcf300d777e4884d103d7837c380f747c16ca50af979c928ed3d6b5a422f01b6caba3f916e5063f3434
SSDEEP 24576:mXYfDtczAqgXe4i7ojhsP5Lgrk1TWb4AN5:FtcGe30jaNf1TWbdz
TLSH
T1D785F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 f881e19ddf07766c83b609f3958902c30bcbc5ca73519e0909ab3eb4a811095a
MD5 47647fbfd8b1c128963e81d111a8f91a
SHA1 20d059caa9c28ccd4a4a8a950ae9c20526e7e61b
SHA512 863c4b33271e1326e935b432924c5dc5eece4718f1e25789c82db8344f3610b68fff409f55b5a42ceb2e1d36abee9b5718669ab028a3384ddc7a01b3c308634f
SSDEEP 24576:L0Le5ji0hmxYrMZgXe4i7ojhsP5Lgrk1TWb4AN5:LPji0A2re30jaNf1TWbdz
TLSH
T18895AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2ce590d98eeaa403fec4918a87faf6e81d3e615c8061cf55f9d82c81e4f39832
MD5 818e426d9cd3d06f73ebd46a37f04a20
SHA1 0e756749f75cfee74a0aff7890c1ac2ba9684ab8
SHA512 1f1d91d60482c09fec1849bbc3effe722a04c3aeb968b4862f768cd0c2661f27df9ef304cc33babff05eee9c4bbac10134a05cd68eca521202040135bc7ed4ac
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyufgXe4i7ojhsP5Lgrk1TWb4AN5:D/ezSC6vUzPvxHjyXe30jaNf1TWbdz
TLSH
T13E756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6aaed1088626ce9929c3cd0cadbc1c441f0bf60af2d711707cc7d4ef0d13630d
MD5 a6619c7a15ed52214b6a6edc25969c0d
SHA1 dcd1f6c3da4bd0ecf5033d139f934af782f002f8
SHA512 cdc4d1d448f186756213a55ddda8371624c48e5ca7ca20c9e99aab8678aeb677ed842359a996bff0a4240a1ed28c8577cb05479ed785c04d6d31e7421100e654
SSDEEP 24576:qVbqPb88hv/l+6+gXe4i7ojhsP5Lgrk1TWb4AN5:qVO88hXl+we30jaNf1TWbdz
TLSH
T179559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 153d2c1cc8f3d3e7a90b12f248dec36ea3021666389677b4935bd72a4d7a8b3d
MD5 f5b19560122170cbb97ca3a21b0b3651
SHA1 66bef4f0b1d094917506c58e4054271b8fdd2d77
SHA512 64fad0d528249f1063395ed215ea5adc4ed37e604df22f080cc08bd8229387cc0d66f237d2628b78b8496348c3fc2dc0643270561c66354428d9753fb8bf2dec
SSDEEP 12288:gHc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gHdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1206523A29F5409C6F38FC3F4A0F7CBD1E9E11EC065448D6B47E0BA9318BC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f4ed9815b55cf1c93ac896a299e2162f4370bce1110ab5dc6e058973234e9624
MD5 bae6aedfda1226bb6a391058846df634
SHA1 38665c3e66fbffb257302b20d882bbb4719d0b78
SHA512 e916677111eebf3238861c705a25256e87ee7bc3ce742a37d0574e0d9936a9e01ad3c27853fcc1f73db3cdec4492a8e3788c879aac81e2b4a6e9691d4f731f44
SSDEEP 12288:MeBNUbTVO86UZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MJIUGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13185CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8455c54d82becc9c0e8e43e68c9033322f4dde9c92605e91cd5c4fff5373ba5b
MD5 ce26ccf5bae102a5bf315dee88362359
SHA1 deaef02224c0abbbaa9a0c12ba9e2f15de9a868a
SHA512 777e3cebc7b5ac69316101abe25a8eb2554e48e1e23aff3c471f47b2400600ff424ea80da31d322891a804e83e0ad54c78cbdaeee2cba17e87f9686613b2c04b
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:vQvGAdlCEL8c/yRNw5CmU023W
TLSH
T16A267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4d7cbb432f3c0c4b6b087fb4c3130941b7719458dacaf30baccceee806c96aa5
MD5 9b84c9698978bbd51b4d5977a0a5181a
SHA1 8ba9da1d694c5af4d9d2c6b26a382e957a672985
SHA512 64afc07b07465b7188a9f5844f8832529ae95544189f6827a383e181080abb4d484265235b2c6b91d53b2f2c1a480010e3d3b224ffb89cd85b2650f0c893a747
SSDEEP 24576:17ewsAjUgXe4i7ojhsP5Lgrk1TWb4AN5:dljbe30jaNf1TWbdz
TLSH
T13185E031FE74E036C3BF0DB21B76C712586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5d59da7930f14e0a974bbaf85130fde65ffaa1613c5599cf29f069192ac7c36f
MD5 55a0f67e51276a5bfedeb7d1d648c8b4
SHA1 10a101da5accd6fc3177f031bc1d6d5f88c8b399
SHA512 36ad475e0c3cf617c9d4894dc6178614ecdbc646d0799665ce9effbf5e9042ef29280a92ef331ca42bdb82a6fdfd5b476c48a5eb6d8dc282ee76a316280dcd5a
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHDp4W:4UEtQevvqc2W1cpV2EI32F4W
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3fe4fa8198e73abc170306ba2f88723ec1cf76e2a9235d2483d601179a2d57c3
MD5 4e4365956017304a77c441e45d03476a
SHA1 8d8c64debe38c4120e8d25dee4ca4943c2f3a50f
SHA512 74592fa404611e098a4bb0bb5e3a90db368a338188003316d04161ba3362f584816fe749562f663d535dd85c94a34de9d7045f40b7414537b9ccc91a782ead1a
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/z7e30jaNf1TWbdz:SoqtVjnmCU023W
TLSH
T152D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 26669e01ac11fb753cc38e54952fee08f987c9e533bf834086d444ccf0c52bfe
MD5 2624636cac51ad110b9bec88c987f537
SHA1 0cc9abd7b58600d82ef6b40d545868dae2958e09
SHA512 60a44ed4dd64789a3e39a7800fa8672cf5ce298b26e39e02d3d3e49b8aaeb9e8fb3b9b4536a3ca8b963e6cd1e44a87eb9b5529028ae823ac99e4d1c9c4654aee
SSDEEP 24576:EAhGLJIFoiwtA5l7S537gXe4i7ojhsP5Lgrk1TWb4AN5:EAMyFoiq5ye30jaNf1TWbdz
TLSH
T1E4359E81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b60dee5cbde613af12aeb9a5f673647402ef05c7586a955377d5254ccaedf67e
MD5 37a3806343db2ddf11c4007caed62dce
SHA1 41124ddfacd90f700c3d0bf5ff23931a78e3c6f3
SHA512 a5c296f650ec364769cad5bb7e405868f7aab0de4cc077107d528cbc8e71b71e6e9c5b1d53458c60e4bf0927793af215188240f80f09e55fb167bcd87e8eca98
SSDEEP 12288:imw5HEjsChNzBFgl0WDm+Cm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:7wuSOWQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17085E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6e9a1f180dcc8eb964ccb796398f57e7c14e828fe6c4bb4ff88108a6c11d6fec
MD5 dd2a9b294d1f10f3594d724fec1bbe92
SHA1 68ae584cd22d4602cc71f3e57a5a89916c0dbecf
SHA512 739dc7df840a77612d5a5756bb7ba57f935ebd52e3ab6eb995995e3dae860efa7fa5e11a7efe3bab5ca2d91101d3bd226c9ff9fe5f53fa14def9b79da30a9913
SSDEEP 12288:rjZ1Iy30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XZuBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D675129637D420F9E2978278D4F68741E7B23892233147CF02A096A71F76ED65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e6f214cf8e043a9dd1de1bbf10a701669e99f33d06807c7a112f3af9c3428216
MD5 f584498b965f22ac24ebea49270fc8a2
SHA1 cc8a6275617d4eb1027d67309badf14088fa8a0b
SHA512 bfb7b498dbf0bc32350eafaaf5acc43ffaf8e3f17d4dca0147b62267d86ee1847bcba68e312c5d0457a48ced9698f3ff4b789bde54a606c1d29b715b007fc3a1
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:uQRQyi36YOcPQLvw2gAf+PN3lU023W
TLSH
T1DA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5a34626b2f9ebca829a911ec9f56652189e67237c8a6a72096d4b97c8a787ffc
MD5 de4882f359b6540754cead1dae6d7b4b
SHA1 b5aaa4c6e0cb0d171a67c61642b42a660b18ee1f
SHA512 1dd7dd652acf9bbe0675ee8dace34e40d6492bba75cc8aec8186ff343bf04d5bb85aebd9dfbae79a9b72ad3c2cbd8431c603508d064baba317142a369167bd78
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:uQRQyi36YOcPQLvw2gAf+PN3lU023W
TLSH
T145667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 02d01d57bfcf2728739a46001e7215c68f3a7898b1cded17f7f49f39fac5efbd
MD5 52fc6fd405f232aff067c350a56fde6d
SHA1 540e2490335544518ddf6fb182a3b2ecb713025a
SHA512 f6a46a406647acbb5af65297907c43857abca42e97dd9ac06f473212f2bcd22e778c72bee7a659fa8145a7c2268453149a39641d916c6512781a06cedfa4ea11
SSDEEP 49152:E68Qg55nhheWu7PNU3/re30jaNf1TWbdz:uthWRc/rU023W
TLSH
T1E9B55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ffe179e03bdfc1544bf3924d27c46b8222aa0697d288f0f78fafdbd8ae9eb907
MD5 11ad9eae641f8ab11ad84f7e98bcaafe
SHA1 81cc32394f073cd5ccfac4f39d0fb5f784d05385
SHA512 42fc7c2735fdfdea8266376381430148086df7cb7bfe059c065894342799dd495f49d6026227f9b3377b80cbbd90c2bebaeb2d8d8990474951c3fb9de2d70f99
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:zy5112gYy5azzVvL69nLKnhZ4U023W
TLSH
T1E9168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f19627700267588f48a4856c8872bb0ca6f36b75ba0934c2a0d04d9181b6e68b
MD5 5b7ce4ba7a62347d5cdae000178a0199
SHA1 abc2fbd9608bdfb839bada2f200dd473b0d760b3
SHA512 dda29c3d77977337b96333fc82b7b6ae2fb129aac8a10ba8342fdfd9ca5084a57c915abf4e35345fe7c035d8b1ce5a6ef8b1091cebe1b8c618fbf64b836ee25d
SSDEEP 49152:UB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glde30jaNf1TWbdz:Ou6JmVxd2ddU023W
TLSH
T1E1D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 30d43e276f771c5a562ec27e8639f7e17f2496affa1ea69dc2f6e0a75d1ababe
MD5 f4ac8839fbea180ed97b23af735fc12d
SHA1 91ccc76ce8488ec949983d3e270dfc5e1fda289d
SHA512 65bef73f5e116fba51311ab85caa6462eec37d568a749e1b25254b4db3660cfc738c941bfb7990056e9c4a617791fe7a79ba35106659fad18b71da1b8ceeded3
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4xpe30jaNf1TWbdz:imifPbRCU023W
TLSH
T122B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5e522a84de2b22c5f0d462fcb4d315d2c7e1f29b5a5ea75c392c31fe50af518a
MD5 4ea96a780b2329a0973eb61324f9689c
SHA1 cc0560734061f32adab0de2cf18d4bd2b4a1f21e
SHA512 ba29560462cbdba6a1b47d4ee41259ee14df313966c6c96f386f2098b9bba56987f583ca5f83422c498239a430df3c9b79e9eb76bc225b0909c1942252c453cd
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHq8e30jaNf1TWbdz:Q5dKTi618U023W
TLSH
T137C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 845a8f49bb5ca4fbdaee4c01834e9b75c150f1dc72bc4cc4bea1351774523c63
MD5 f5ef4afe8f13820783191bbe15edbcb6
SHA1 f0eb1656bafccb6fc0f05c97c2defb933b76f19a
SHA512 812a688eabbdd80567ec9849614ba6f10a6036435f75afab2fcc3f181a88703ba9776c099f0a7682c5d78e6fed89274511966c8ce176bd6aa67f8dab032dff58
SSDEEP 49152:0htSn8EApI0figngiDn0AP5wNe30jaNf1TWbdz:VX2iyphOU023W
TLSH
T1E795BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
Size 1.5MB
SHA256 2c831d23aaba7212986ede46e56ca781f547966377e70c40ed3077962b246895
MD5 b24dbae684631e61477bbb4f24b0b154
SHA1 a0822f0842625a9a88a95019f5c1769b1a3b4af1
SHA512 50051add9ff315cc36f6bb6d32258cd0a7df1d6def05692a67e2b3be0ece7ad08bdaa217f6c11d6e0ac41da5ac8d0b1f47d345b8ccdfe3bcbb9705744d38c8d7
SSDEEP 12288:gVC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E86523926F5905C6E18BC3F4C0F38791E6F13DC173118BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
Size 1.4MB
SHA256 76635a176963f939aa7a493e132b20496405d4739a3f102f8caf169524db5aec
MD5 0614fb0d4510d2b08fead8f4c3f7b5e1
SHA1 b499c8e79b38c27521ef2bd043014fc81c2200f1
SHA512 bd9ad26528bbf525e298a6d3ad5bd8138948b56ff0588873e55628395864bed22db0d439c2ceea5e7983427f4aadb784348862d96764626ee8ca42990240207b
SSDEEP 12288:5j0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5AgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D56523A1AE5509CAE34FC3F0D0E787D1E9E01FC672404E6B57E0F5531ABCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 1.7MB
SHA256 45070fe6fd4bf1dd685248ca5e5fd729713bca18fd6b7f02659bfe8147ee25a4
MD5 1875c215d80d9dcdb8c1b6c8ff89f795
SHA1 cf4111476470732c141fb9fa4b8314039f482694
SHA512 9345e34d0aad35ac38c933dddd7220a4ef70f407575cb46332d2bc75c9849d061883c6f34545d6c0871500f282b97eb7f763f500ad009bec3c085d51b6b959ff
SSDEEP 24576:HZMEzFVSOogXe4i7ojhsP5Lgrk1TWb4AN5:HZMEzfje30jaNf1TWbdz
TLSH
T1DA850295B3500CF8ED67827EC8A68A02D6B27C561760CA1F03E436671F773A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 1.5MB
SHA256 72f676615b57896eabde63c4c923323c667132c6144e51aa3204212a543482bb
MD5 16bf20c0e68c3d97892a4f035666a448
SHA1 596a9f0f7c75115e779d3866146af8b312a0d947
SHA512 fd3ce793e995885670648d6008942ee0b60d16efaceff12d30b4199616f023e1605e4f56ada0a79c3e0e1a590eebed7e74eb0b4468610a06bbb23b8337c5762a
SSDEEP 12288:Hgh3vvs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Hw3tgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14D7512A1B3D814C4F177CBB2D4F6CA21D8B27D995B60CE4F02D0750A0A76BE19578F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 1.7MB
SHA256 c23fb232145c14613fffc4bf02ff3408231fda4c84887dbd4465b7cb0d62f199
MD5 331a786d8ef521e4acc7e068319c8aa0
SHA1 90297ab22c22c42b809592dd2fc48a59ceeac223
SHA512 ff25147125a4eb17c0eed73194ef230f74ee686b8cb0cd644f152d4d8957834433426056a04061172a8a5dc3d240cca2af63467c0f225ef335c7af5690968179
SSDEEP 24576:kTdaLl3z0zDegXe4i7ojhsP5Lgrk1TWb4AN5:kTwLlj2e30jaNf1TWbdz
TLSH
T1ED8502A5B3501CF8ED67827EC8A68A02D6F27C560760CA1F03E436675F373A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 1.9MB
SHA256 5f35f661311a72ecf18fc2b7d517ade0120b5d581ead686afec8e8b696dc94a0
MD5 1ff2547a868681f010cbbff36afb55c9
SHA1 b95fd537bd608383f30c39f3c0856d015c25e39d
SHA512 2e2a7baacbe48482be40e05de36823ec1d59773584adc02aa9db6ceebd45e430c8624b2e25349788276213cd3d9b90eee4ca240b20b843e5c4a2a6b5ea84c2e2
SSDEEP 24576:b35d9CHKy7GZSgXe4i7ojhsP5Lgrk1TWb4AN5:75d9CHKyaje30jaNf1TWbdz
TLSH
T11195CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 1.4MB
SHA256 f3ed3187756a1593c01217dd144f4799356826d2c2e5e2744ce8000969e65896
MD5 b5703446a629ce1a272689ea1ae232f4
SHA1 5aa3e78809136415a19d1a3ffc0487c8e189f3f1
SHA512 1dde74603a3fce9654d52b92cb6314dd587771188038b1197ecdc7c3d4dded3a37ce4b2b85f80eff2adff07f426cac305b7367a990af461ce0406646c45b4ec9
SSDEEP 12288:+a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+zgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16A6523A1AE5509CAE24FC3F0D0E787D1E9E01EC672404E6F57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 1.6MB
SHA256 b1820298b5a6b0ebe69a786706e9ec87774aa37f0b4a30babd4e5fd9492ecf83
MD5 79e11fbf866acd8401fddfd3db8c39a7
SHA1 3de7c2c2195551a83907e8f18b21dc74f9c78cee
SHA512 98d22d43181c096fd890f005d006e4ea55efa04c15741ca6f9adff51d9491e986d9dee31a47de0c3cb5522cc108e59c41a2b194b9cadd3f004d4a7d9bac206f1
SSDEEP 12288:Nnc3DBHdBdE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8HdfFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10A75014137E800D8F077D67988A18641E7B27E9227119FAF53D075670F7AAE1AE3CE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ae015f60edfcb007f000426c5c8b9dba7dd9bed56e84e5ae69060f73265c902d
MD5 99edb4d30529b7e974cb17102bdf79fe
SHA1 d39b702dc98e794a8b6c4cca5cee104679c5a7f8
SHA512 ae06231379307ccd12a17a82c77664c664e5ae182379209e39ee09409d49d1cfc65e9ca4e9906e3232e5b2ac68f88e42953cdb076f333eae6ea2a6e0a13bf9e4
SSDEEP 12288:dVC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E36523926F5905C6E18BC3F4C0F38791E6F13DC173118BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 93f165815193f3e0c01cc8b325be5cc84bd5370367a281a4f5c98efd536c331a
MD5 c07fb45a412810684b5b12429dd14397
SHA1 55e3fd18b607bb1241b7bdabec7180873769a418
SHA512 bc53ba73f63728ee8f5da7796af260a83a0d059380320f7baf7d03e6365d770ce85bc8d3e7a1d97bdafbebdc0075875db383f087e0e442234a2b240ff2acf519
SSDEEP 12288:4j0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4AgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18E6523A5AE5509CAE34BC3F0D0E787D1E9E01FC672404E6F57E0F5531ABCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 1.7MB
SHA256 d2a4b4306403b26aeddabe11123833da2635746f5775d6d38781d42ca71e78c8
MD5 96b27b87922e04d1f4147079b2ec3f1b
SHA1 95c666c4a884f6f0da6d5bb5787738d4938cc60e
SHA512 d24db6ab7cafcdbb87d0a33502b7c89d2c4e68b49fadcfe850324e2a254e26321a91abd69084c0f1da5ad6b3df966caf24759a90bc2bc6a994530c7f6655b110
SSDEEP 24576:NZMEzFVSOogXe4i7ojhsP5Lgrk1TWb4AN5:NZMEzfje30jaNf1TWbdz
TLSH
T1DB850295B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F773A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 1.5MB
SHA256 2bd9450efe8fa9d9e8954ed78e9bd520f6a3afa8c5dadd084bdea0664f4b31a1
MD5 4b83c552cf4dbb6185d0c84a23c55f97
SHA1 dc2d9043c2501b76ed7ef58ca1f7359bfcfb5b73
SHA512 cd49d6cd1cea755986436468c3b4cfab26bce9b1a1843c8e7f3753489400418e2578703e2729da6411c7943d223286d05c74c940c4e7fe454bfb9fdc631fe03b
SSDEEP 12288:ggh3vvs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gw3tgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1747512A1B3D814C4F177CBB2D4F68A21D8B27D895B60CE4F12D0750A0A76BE19578F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 1.7MB
SHA256 aa6c96a7445d33cb7f208cae02d9a543bc1ace41ddd3a5284e47517072d38c72
MD5 ae28e94f86dda07df177245c6ba5d042
SHA1 fe9790d18b1613b527ef519887b80e57ccc6f214
SHA512 4e6f92a7465163a175d509c3871ae8645b68f00ac93d7014b04507840fd07794e3c6aed1cae5789df8fcad96a7db886ad27d0662a89aaa9bb4f05168898685ff
SSDEEP 24576:iTdaLl3z0zDegXe4i7ojhsP5Lgrk1TWb4AN5:iTwLlj2e30jaNf1TWbdz
TLSH
T1458502A5B3500CF8ED67827EC8A68A02D6F27C560760CA1F03E436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 1.9MB
SHA256 1fe284349981e36f1e67bd301923ad29504e6e280a4fcb5e0539ce8f7ffbb749
MD5 c86fa19f2f06e353757f5eafaac78f66
SHA1 f1a8a99e12632ff8bcada5ac0f562bf7771b7431
SHA512 e5e84e2aab4a9263e32f73daec4ce0edd75ba61942094d798cef32d3c0a493c9ace8d8af28ff96f0d2e0a96aa2280400fe9b205e174bd40b80254c67f6190dbb
SSDEEP 24576:J35d9CHKy7GZSgXe4i7ojhsP5Lgrk1TWb4AN5:Z5d9CHKyaje30jaNf1TWbdz
TLSH
T17595CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e2e2aeb3641621902c31be9725ebbc1f018e2c4e65885610cf0da27fa2e86132
MD5 9898ad35a897f373003fd999d873d0be
SHA1 5509683cc1e8b656f83c818a0c2f3d091fb106af
SHA512 cc3a4d3cc575ac749f5dfc84e169c36ab2f53bff23310480795f32339e4e4626e613bd6be057297ca7042e820e98eaebe087eb788998a5f99d727984d5ed6a3c
SSDEEP 12288:6a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6zgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F46523A1AE5509CAE34BC3F0D0E787D1E9E01EC672404E6B57E0B5631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 1.6MB
SHA256 434648d562c57e3426fceaa4ed9ca2e825033e318731ac45e0a445eae698ff47
MD5 09c8d36f0c097ccda1d464261d4e7d5c
SHA1 30d95a5fe5f7a3181586437ddadd7a02c2cd4145
SHA512 3d599948465205e834361a73ba3a59090030552816190e5643d4046c3c35f65796b7b47a9ab92ddb79c34edec8ffbbd1fb4a5ee01daebdd18d553c6d38fcc475
SSDEEP 12288:Tnc3DBHdBdE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:iHdfFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17B75014137E800D8F077D67988A18641E7B27E9227119FAF53D075670F7AAE1AE3CE21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
Size 1.4MB
SHA256 305b36736d2cac01dcbdfdc4c205cac87e23710f9a3eb9804d1200e60efbb7ac
MD5 39bd4da72b104eb55f8419c81c00871e
SHA1 44b523ca1d07d58869f96f4f89401427be46410b
SHA512 71f103f984fdf529151024631057046d811d174bd86a7c1f30b1e37f233970821c56d7b1dd5390bc7e2ade5b47d5ebf87d3729124e048b7341de600d66cc5aa8
SSDEEP 12288:3M0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3tgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1306523A1AE5509CAE34BC3F0D0E787D1E9E01FC672404E6B57E0F9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 1.4MB
SHA256 f7669656e4fc0600d88c710cc853772e9aa5bc2061e140c8ccc9dbb91567ee96
MD5 eca0a2e9f3c1953b18e294df38a4779f
SHA1 f0616e5981abf8bcbea3f3497943a409ad8adb7a
SHA512 9b8cd3e20e0f59ad8e700eb8dd5fd4024e3f5c0dd04e33eebb171f12b936a9a483ab56f39fbf21b1e74861111c80d9f876778eae3cea347cefcee5af500644d6
SSDEEP 12288:9w0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9RgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T186652391AE5509CAE34BC3F0D0F787D1E9E01EC672404E6F57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jre-1.8\bin\klist.exe
Size 1.4MB
SHA256 feb4345f0d1877367adfc01bb57a247f42eb42f16d14050bc960590c453e385a
MD5 2ddca027546362fb533a4faa978d0948
SHA1 c760b6f9a2b61ac0a1409faa2926bb7a0261559f
SHA512 4c29a9b3def4800c6b01cda6c64b3186dac21c538b46fa9a81ecaffcde83aff8f988dc4446a13465e097912cef6d760220fcfc110ef83311876e74bd087b26b0
SSDEEP 12288:Jw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T104652391AE5509CAE34BC3F0D0F787D1E9E01EC672404E6B57E0B5631DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 1.4MB
SHA256 0fbda660a79492a21afae38ff0897dcbee76c4644bfc587cf415e934acad3691
MD5 25962ac22c481485c6a80579f8507356
SHA1 3630ea450ab346c1e028aff7b78c6c950b887aa1
SHA512 d02f4d97358b87517dc8fd4a06587d1bb6585e1c75520c88fe320080b63df67c4146f23ea8f705cdd58d8d4a2176bfd2ac7250519db3e9a6965949e65daaabd2
SSDEEP 12288:qR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T110652391AE5509CAE34BC3F0D0F787D1E9E01FC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
Size 1.4MB
SHA256 6099c949d3cc82c949951205d73c7038148281a3feb5dfa6a3576f14ba8e9665
MD5 5a184cf255a611341c6c6cb55c65dbe5
SHA1 6d878d4781511bb7d60fe6a4c4ae10b3dd1df6a6
SHA512 af31eb8dd1b8ad20d949125a4686bede78b93eb83736c847dec649d6790db2cce93185fd0af9692abd094cad5810bad1a04812ba3072839e0540ca3ed0ad91c6
SSDEEP 12288:I9Y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:I9ZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1976523A1AE5509CAE34BC3F0D0E787D1E9E01FC672414E6B57E0B9531EBCC9A5AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
Size 1.4MB
SHA256 59ce39e85c04dab86e921454cc6f43371df517736520197332c862294d78c6c0
MD5 105603d6738056bbcecb0951ff79f38c
SHA1 06a9005b6945f465f4da5d4d74aa50ee56b706e6
SHA512 5b447c5e7a2717dad5f4efc44b602e134bed7fd152238b3d7615361e59e5e02fdb70b1269176ee57ad64c94f7c943c51f76b043b42ea79160da584a8d9183f97
SSDEEP 12288:3M0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3tgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1466523A1AE5509CAE34BC3F0D0E7C7D1E9A01FC672404E6B57E0F9531EBCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
Size 1.4MB
SHA256 ccf0bd4c9c28ad586f8a5c0906d2c8cf35b526c2f94a8b7ba8da6223cb547aa7
MD5 ca94eba39b84332431342ade78981893
SHA1 f5dd17b3484521d3eda6f1f271f7d6fe01c11626
SHA512 881fbcb3ec68b1023be1fe2eabf1db3d1a3402138ea7ba253573cb403b4296cd3cb95d69c1fafabb8b7ed82ae49ff70095d5fa5f6e1fbe3c36296da57a520a94
SSDEEP 12288:fm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:f/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11A6523A1AE5509CAE34BC3F0D0E787D1E9E01FC272404E6B57E0B5531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 07dc0f4158985b7bda0df3e78e46b8038ba1f40b3fcf0eea78335505606a8ab7
MD5 be3bc7ca95a41e0f214e2c7e4d49c46d
SHA1 b1380cba68041e04b862f3a212516b2c2221b1a9
SHA512 e66a75752ef946de95490b51691f9d4ebd1d2a4f60d43a2070fbba23da2e280db04868463ba8adf82dad9742c77f774d267b5b428872b82bf34a5c77cd4dba40
SSDEEP 24576:Dfwv+k9RX6wkyAI9gXe4i7ojhsP5Lgrk1TWb4AN5:rMnYIYe30jaNf1TWbdz
TLSH
T1A295DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 10ed47992fa76069747e507baa42438a7f8aa0044ae8a09b6135e701cc7650c8
MD5 cc31d502461bad81f065bc27395faeb0
SHA1 1f1239dcfa74a3ebe49857da9a6d34142d9bffe7
SHA512 20759cf52da6529400bf97cbe92b096cb12b70120697763b5093ec2a04ed25966e2a9b638b74c081a7a8a6ab0477fb5d38e3dadd633cf9d2c9e39d36a56f63f3
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0te30jaNf1TWbp:PySzPFU023W
TLSH
T1BC067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f2340f6651c5ca24bbd5c1faa18128f139152a106d52d7d958dd1bbbfb47d97b
MD5 7953c060b81b0dc6b1d3e1bd6684a56c
SHA1 589e3a866abf6208271357e0407dad60fd537b3b
SHA512 4145e409541cc78130e0cfab319d2d39b1cfdd80513ce4fa58ba3a55573193a29b1a62c5ac197efd059167c54024f0636e9c76320bcc292ce99ffe6c2f1e4a30
SSDEEP 24576:S47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4gXe4i7ojhsP5Lgrk1TWb4AN5:S47JUQj1irIhCnDHUPfF/de30jaNf1Te
TLSH
T14165AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 962536c527941922cbac9baed2e91ae6c335fbc27023077692a1cf61951effca
MD5 ae5040026a382633432967074c64e61b
SHA1 2f21630c3446a0eb3f28e3eb62e5bd0840e59553
SHA512 989d319b6e9cf095b52e41e744a012d3fab679f1c1f5b272ac3f295b4ef27ea6e99cee867706b1d416929814cd60de80b82514b3bcff995a28df54046335ec63
SSDEEP 12288:vzsfA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11475F05AD29802D8C05E92B5C3968A81F3733C9193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9df9a2f4b3084daa91904d4a0f9a21872efb79301f3a3cac726b28f966ebde54
MD5 d124072e05be259462d8025a0883ce23
SHA1 c94063ad603477d318136680f86a373f2ddc01f9
SHA512 252405d0fc741394bddc069bfdfc765495599203275bd7c5f3cb9297c4e66805e7130aedfaf89457ec0888781feac77f1fb95dc0ff24c739d38629cb6a45040f
SSDEEP 6144:8sBC2naQFX9izW3x+SmotMx/mzbU3fcktB2aQ+6v1nI1dPH+Peg9af/rDYae5Kec:Vg0TU3fFB16NsPH+grze5C9/vATEWqL
TLSH
T1933518407666C64FC66D50325E33D2CCAB707D01EE45AF0773C88B3F9576A58BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4e8107e0418343a4bdd4da09ebcec273436525853b3ddca5f4960d93a6fa398f
MD5 52493b250e06a098e2f984a29e31248e
SHA1 48f8cb447cc40c5471a59bfd83d39f8c073bd590
SHA512 7cb084d9f7a7f8547593275b397975b8ec4d0401410b3cc4b78ab73ce96db75bcc1e5c14c3a377f492855378750fe3d043227335404ddf6b2853534c62b5019c
SSDEEP 12288:C4gMZLb3GxMYbidhzW61aHOjqRHb2urgjiGGut5KA1gb6tsb0/PnWqhSkDCpiNO:9eVP
TLSH
T18D65FA406537E38FD1BB603207265B8C7B64EC16B7496F22B3C8443AD86BA15A5F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 39b64a856f6091403b0050584913bfbb46084d95dcceadc267804bf88bc37890
MD5 693ca224c90ff2bb9aa9110b8e327324
SHA1 9ef1641c3b1ca26222cceebf03fda588b5847e63
SHA512 c67fecb8a7849758e17a941aba38f80e13b93e36190ddde21e624593c4c4f6ffa20a3f4cd77147278eb76c723c834222540bbc8394f4ae670a859a0f17926034
SSDEEP 12288:o+740DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C56523629F580DC6F29FC3F090EBC760F5A53EC1270089EB96D0B69319B8CC99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9a9f977bb538b8394ce0e1109a7045a4d94cc28c89f9b42e85ccc0e65cf556ac
MD5 ed6370a8c5e47e1817b7bd7fda70395d
SHA1 686e9c757126073e8bc0924a37537f56c13cf8f3
SHA512 650e91a0526ff25b108427b44fcf518216019f98ce322b3d60fca479343361a6385eb6e8ea2c18c2a6bde483fe8825e2da02353e408177e931451ed1d056eeeb
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYfgXe4i7ojhsP5Lgrk1TWb4AN5:Kgb4mBIBhGFPe30jaNf1TWbdz
TLSH
T12665AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 ae4410f17b83b0368287aed6747795543bb2e89139bfd0609f6c2957f5ffa130
MD5 407729e8f6419520deec7fc209618da7
SHA1 563fb2cde24be28daaf2fffd99d9ed472c10a826
SHA512 c072b38b8cbb0d49b423617a52ad12e0fc384bbbc5249b00231976340c6b89e6d26fa705ac0f269783d8d1a878a1ae95d85c9ba7add0aaafebee4d62c888ea00
SSDEEP 24576:yG88u8FpJqH1hzria7/mogXe4i7ojhsP5Lgrk1TWb4AN5:p7ZFPqVoa7/ee30jaNf1TWbdz
TLSH
T19595F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b34df1aac15b7e71ef897ec7083e71e366ec109f6cc596e605e9cf905841a7be
MD5 9d95298c05528ce2db7c3c47e6aad021
SHA1 e427145086ddd29ada8a653c2fa4b297eb6d849f
SHA512 c1d29444f9c5028ed0d3f67d6887fbd319bdfb82616f573ed0720b05383a54519446b6e9d3d5ff128570e24edb818698b17a1247b7f10ed5461f36dd7114f32a
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjze30jaNf1TWbdz:ZG05lO43bgU023W
TLSH
T116D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 33adafaa8b0d4b3f149c4522700b65272788e37b9aba958c22ea46e087187bb2
MD5 86d680effcd8a5f0bcd48eae0bbbf396
SHA1 0ac2e2f6635d687eca466e42ee8a8c8dead94934
SHA512 3bd2826e325c6a729c0647b1ab52b2064b844d0f29b23974946b2fb9a7d746ec3d3df366560a1630abe397072fce300a8ab7f00a5f428de54ec35c72d9aa474b
SSDEEP 24576:Cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnKgXe4i7ojhsP5Lgrk1TWb4AN5:Ka5POZ3+Jt2pasx2+mre30jaNf1TWbdz
TLSH
T15065AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8391caf7dfd293a27ab5c8c3abf4b0d52baa8e67633289b7362150054829c3b6
MD5 f559c22c77578ce787cad0adbb660749
SHA1 11c963576e2aef9026fe7e3bb631853d61b23155
SHA512 53198496ac9098e6b4b0cccfa9914239cbd88b3b7dd2418a3ab49db15e8f4c8e5c022128bdea150edea857b449863bb15d6f00fde130b20c5a2111aca5a8037b
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkwgXe4i7ojhsP5Lgrk1TWb4AN5:tNc/zEOVHF+e30jaNf1TWbdz
TLSH
T136858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0478e7d7fbfbf37e706f0a27daa658a56c4089feae9267c219066e0f655aef5d
MD5 d0f4b8d46286ebfc3ff9f7c4ca32b248
SHA1 b5d5cee49330afbefab84c65a9ace1e4739545a4
SHA512 5c1a8b162a69eee96f91d22a144891230f342c3d9de6433c9ea4e07a56844ca00e886898b0cad2a7921ce419f3c58b8b0e5fa0beec4a42c10921a6d607edbf4b
SSDEEP 24576:18kNvNnaFeYhJNtmZBmWgXe4i7ojhsP5Lgrk1TWb4AN5:18MwBtOm5e30jaNf1TWbdz
TLSH
T18655AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 88e453c2f6d7aff781c9ea84d953131c79720e8989984b1f1d6d9d0452f42584
MD5 364d23a23295cb0d468d57492fb428e1
SHA1 3475013bf066d50128a78794bfc2712bb9b584f4
SHA512 7c1341fb167ce7342871e769a2fb7760ae06d8fa65f892ea5b3c5be286f6a20ed7fe4f7d26fc0fe2d712161b8618c76da31d74fb8960f90a97d22cd792b3af93
SSDEEP 24576:dPUr+NQsgXe4i7ojhsP5Lgrk1TWb4AN5:dJQje30jaNf1TWbdz
TLSH
T18E85E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 78d2eaf3f21f2d60bcc8df3b3fb9fb279bd3f0f3972841032a401e8f3347c995
MD5 6ca235f280a3ce3937af8f580168475c
SHA1 00f83c03cae9e36b7337d2af3ea346085827cbbf
SHA512 5b91a5c86eb7a91db258722fa7e9c49728ce4f50425960a00311e9413cefa085f44fed81e58a69a8f352f3ce1f1f6c7aea628b4b520c4b7193b02f98e37a75c7
SSDEEP 24576:fD3FHshBIYQgAFgXe4i7ojhsP5Lgrk1TWb4AN5:fDVHeBIAAQe30jaNf1TWbdz
TLSH
T13995E17DEA5C04E4E57BC2BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-179-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/908-69-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/908-67-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/908-75-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1352-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1352-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1352-254-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1352-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2000-55-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2000-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2000-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2000-159-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2288-250-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2288-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2288-123-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2288-115-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2724-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2724-129-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2724-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2724-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2724-139-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2736-251-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2736-253-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2736-109-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2736-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2736-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2736-249-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2960-257-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2960-259-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2960-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2960-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2960-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2960-234-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3296-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3296-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3296-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3296-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3296-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3848-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3848-53-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3848-51-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3848-46-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3848-47-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3848-40-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4124-81-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/4124-80-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4124-86-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/4124-218-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5512-66-0x0000000140000000-0x000000014012B000-memory.dmp

Download

memory/5512-0-0x0000000140000000-0x000000014012B000-memory.dmp

Download

memory/5512-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5512-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5512-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5692-79-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5692-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5692-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5692-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5692-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download