6626c40d8abb35b035e9e2ee0996fb5022164bc09f72a21b3c5de2b7f2746bee

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260810-pfd8ragr7w
SHA256 6626c40d8abb35b035e9e2ee0996fb5022164bc09f72a21b3c5de2b7f2746bee
MD5 42beca1095374a9f5b0ac9078d5f8856
SHA1 e25ee4c5ed91473404faf0fee226df8491fa0f7e
SHA512 cc8c37734122c5d54cded943670aadb4678e4891c115e0f7ad9c3e40f157c85086d093b29fd981fbbd7537478ff182258580088a5c7e21e3fb0f20c5ac08ce28
SSDEEP 24576:K0/C6CTH79Us2PtOsybpSdu/EE+4hMDOlrUYb:K0/ssaQJE+4hkORUYb
TLSH
T19D45D016B7E401F9D077D179CA458A76F7B3B80A0720A7CB03E496562F276A14F3E326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2040	elevation_service.exe
4984	elevation_service.exe
2720	maintenanceservice.exe
5996	OSE.EXE
2320	PerceptionSimulationService.exe
5696	perfhost.exe
4224	ReFsDedupSvc.exe
5336	SensorDataService.exe
5648	ssh-agent.exe
2660	AgentService.exe
5852	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\65c2279923e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b549417c228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8ca534ec228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a1359c16c228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccc0b34ec228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b008ab12c228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2660	AgentService.exe
Token: 33	5852	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5852	SearchIndexer.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4712	2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2040	elevation_service.exe
Token: SeDebugPrivilege	4984	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 1004	5852	SearchIndexer.exe	100
PID 5852 wrote to memory of 3716	5852	SearchIndexer.exe	101
PID 5852 wrote to memory of 2792	5852	SearchIndexer.exe	105
PID 5852 wrote to memory of 6068	5852	SearchIndexer.exe	106
PID 5852 wrote to memory of 3900	5852	SearchIndexer.exe	108
PID 5852 wrote to memory of 5440	5852	SearchIndexer.exe	109
PID 5852 wrote to memory of 5192	5852	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_42beca1095374a9f5b0ac9078d5f8856_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2720

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9c74577fd11366be96e13d47f8f3886b7a0f9b42db98918fc002020824c373ec
MD5 81f5d44c976bbc5ba5976d981cbad11d
SHA1 9cba491e56e1db6afae431c806d862310c36aec0
SHA512 4dfcef8f1d2f473749bf14b08325a9a676cf0e57e0f82948dbbb80bf998f2972700767a49639b0144aa606386aceb462da3a18bead907c1eaef9f3f54066d577
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyJE+4hkORUYb:73q6HjB/YBb
TLSH
T14BD58D03F2D900E9D06AD178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1465860fd401cde2d3cef15e19b80d90517f80f1772bdc057faaa716cdcef52a
MD5 47cde885579eeb4efe244126565b9892
SHA1 d4412d6dfc1b629b645ad3b42200ce982b0e9bf5
SHA512 2e1d44988c8487cab6081f1d98e6ad647d17b5d07856b714d6f795c7f3897407643ca4803f0d865724ae29703e9c4facdc9751eebc5fd230b9f7175fd78b8de9
SSDEEP 12288:O1XLsswWkxy2lRq2czA0HSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:8XYfDtczAJdu/EE+4hMDOlrUYb
TLSH
T18965012867E408F9DD27817CC8A18412EB73785547A0F79B07B49A261F333D85E3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a412fd94a4f5b35692286eb8d0f271af9dc7998b9b88e84cbdcac160b9d03ac9
MD5 f06e07fdf58436a6ec25bbfae9646d6e
SHA1 30b0aab877e35e1bf511384ac7e5221628e99fbc
SHA512 fb3040cd99898150530619c0b9a168c9d5f95ef0d8c69319d96eb02e691e3a70d705e2656481d0303f44589b0d2774814abfec5fe11332f7ec87c63b5a67e7dd
SSDEEP 12288:2XZNYVLeyUji0h90ZD0wxpGZIVuLrHsfHSd+/zd/stqOE+4UdiJ92RBk1h44nZKk:60Le5ji0hmx8rMKdu/EE+4hMDOlrUYb
TLSH
T15985AE15F6748371D073C0B9C5D2A69EEA7230861B308ACB4296D77C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f9c18e3861900aaddbdf9d42995f669b8da41a54fe43e1f6df86fb9354624e33
MD5 c968f9272ea515be32fad8144f17826d
SHA1 d400614cef786d136b8f337bbb989b330036760a
SHA512 24b1407ec7557e3b5ebd3a3f417d8ae4da7e8ece7eca12902543d766a6a722150b734f2b69991f0ed71f61a926a040ce7bd8011a92c174ff604b5896ce8bf5e6
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyuUdu/EE+4hMDOlrUYb:m/ezSC6vUzPvxHjyDJE+4hkORUYb
TLSH
T1C8755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 67e48a818433948d36cc81c9809115cbe80db5b52eaeace114af4b4c150195a2
MD5 626999f3a22b2ce23a1e5cc69241e7bb
SHA1 f0c03e2b18ee54c646756dc48c0c1596b9b3fd35
SHA512 f90459f59d57c18a977778cef7f29df1fed785faa3be96ff53cb3e265afa68c77f003e24849469bf8687592d4db90b4a41bd3e98ff95c30f788015f41239b8d7
SSDEEP 12288:tVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98oHSd+/zd/stqOE+4UdiJ92RBk1Z:tVbqPb88hv/l+69du/EE+4hMDOlrUYb
TLSH
T154559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 da79ac5abde2a126bd3fc3b075031621639c6449a758bc7bbf0e3d399efac970
MD5 a088bcc7c6c7952a74edc3d4eb4db798
SHA1 ae341b779a1c5cc83ed304710c1e498896ab47a2
SHA512 fecd5b8a1ae2bcec7cc3da15ac1ffeb64d31054231552cc2716ae5b3fac2c36954c9696cb1e48499789c4c29396011ecfa8a49651218e170672cbdc898a95ece
SSDEEP 12288:HjTHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:Hjudu/EE+4hMDOlrUYb
TLSH
T120452390879C08F2CB3B90B1B50420BB77B74D5A79A4B91A9E75BF274DB81D9C64C08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9c9c55206cc1ccc29ad5500b27471b7e900c30c64aa828aa76cb532f86121bd4
MD5 39f8486eb20657fd3c943bb6f07bb850
SHA1 624b91f34b8ed4698ce1b72dec6aa617c05d4843
SHA512 e2100c7603efa5318b33d8cd588fc2ab9b7f3fa5ff3c3a13417fb8ed43a1109d910b054aa4d95c108f0c2518051616cd0728316d44368a9b606462102bb01de7
SSDEEP 12288:geBNUbTVO86UgHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:gJIUVdu/EE+4hMDOlrUYb
TLSH
T1ED65CF7BEE28FCE2C27A8DB856518640A77278314F61A3CBD175830EDE235E14E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ffecbaddbabc6af76e31cbbe111194de4d9eadb0dd70f6e0fb826495d25996f1
MD5 2a5581d1cb5b1ab5ca02b6d7fadc210b
SHA1 0f866b13e3c3e4d74e59a81d4d0f179f0971f6d4
SHA512 1d81f700c83c5f2d55aaf666614c5e129f49b4cca54ca17095a03ca94ca8069fa4f0eacbf1df4a6575cb2e14bd4d9e6c212ff31aabcf973073285ad399d46380
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:AQvGAdlCEL8c/yRNw5CGYBb
TLSH
T123267C656BF880F5E0B7E174897A85B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b4c346bd74089da06f21f25bccb57123c4f975b1e684bd619997d2ca802dd7c7
MD5 7a44cd2871eeed7da1d78881efbc656b
SHA1 6b0f1612fcb4c08b144d46c477365ec3575bde5d
SHA512 7729cd187761085a13343c1bed8d62f1f1a4bab979993444d1d83eb4f304adc2833065b704696c13cf5c5729262eb9121920a9aa3be8890be005575ab4ad95a0
SSDEEP 12288:3AwSfxL/2Dc3ODLLmt0LDQewsAjWHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGv:QHewsAj3du/EE+4hMDOlrUYb
TLSH
T17975E031FF74E432C77B0DB21B25D716247D69204B612AC3E3B88E9E59742D22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 65fd3295c88d5459d5dee389e4185839e4312850adf21c388ee1001191d67065
MD5 fd130bfa444e28b5d0c128c72349980e
SHA1 eae55f5ac9ee36505dd830d060c55e8fca16b233
SHA512 e109e5dc2f24545afecb9201c794ec1c0559ad53ee37012d5f1d5a4c90db5e5e8e6e5de600639c4d66e71e9d876b28c148dc1a76d0d31c8be732a87add65b108
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxYBb:jUEtQevvqc2W1cpV2EI32xYBb
TLSH
T1BC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 77ec63b18fb94aecb9865b2fcc65543abc48155f1d6bea122ee5a95e64c4356d
MD5 af24522e11a3559a4a1e364d9127cc36
SHA1 7c5e14cd8c98b1aa9ff1ad7e03f0d5ec7734e3a3
SHA512 bf2512be948ed4b4853f1eddda024efb678c201a7f35721d2dca7fc31d965dac606201e4dd704a26de3fda941de1baa8044b6bb4d6f4a4f0f6c22ed914619edc
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zXJE+4hkORUYb:GoquVjnmyYBb
TLSH
T165D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 200a9147186eebf6b2a3215ef33f1bd9392ded84fdceb0872431cc84607009a0
MD5 d11e981f16bbba34a5dac3bc9a3169e1
SHA1 18eca5b6889c0c1a233909d36b13f15c45ded22d
SHA512 d33501ac291a9afb683de3511d4d080bb13ccf65fc2f79e59cc9fb9952f6d56e8b4b36546e4ce6e184e5b7de3d20297fec9c717241820077a704c42914f41ee3
SSDEEP 24576:MAhGLJIFoiwtA5l7S53gdu/EE+4hMDOlrUYb:MAMyFoiq5QJE+4hkORUYb
TLSH
T14E359E80E7F955D4F5B3AAB899B69171EA76BCA65E30D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 24c8052ad50d35b12d9c65151e0fd08ecfde34424dee3d37c869f77554a2b73b
MD5 69b176b0b37a28d49d40dd7afa98a485
SHA1 6cf0e79da767aa20d53eb3c6ea12b8a049b8ee00
SHA512 efdd41e80b9f8deb2579efa18776734f8b2f414bd89c21c47b0c893c29dae7c423e8aff3939959564e11c50dff49e371b4941afe8562a21d974be9553ce9e777
SSDEEP 12288:gmw5HEjsChNXBFgl0WDm+C9HSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:9wuuOWjdu/EE+4hMDOlrUYb
TLSH
T1D065F14567A80CF9E9678139C5578036F7F3B8122A24DB1F1B70CA5B5F37261AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 132074da80e6634c72fdd8fc577c905249b66dca7c80104f08e2f2418c4924c8
MD5 09e0d3e2891386dce43d894de447736a
SHA1 bd20bf319126c9657cae538e2fd8967f0b0d08fa
SHA512 46d7d67b143f61f658c1aae3fd2a6955f6301f3576d033f10e97088329433dd0566f14bc4ac2a998516f5c76fc066fb3fad323697a8f3fefdbe5b3fb18fac897
SSDEEP 12288:yHZ1IyGHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:aZuCdu/EE+4hMDOlrUYb
TLSH
T19055129913E820F6C2779178D9A0155AE3B23867377453CF1A344B2A1F77AC28E3D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 34f4055cd181a2eedd7b791999c980b9e2824c6246e9b3486339bb8b446c535c
MD5 e08e4e70948ced260d4c46895f76b75d
SHA1 bcef248ebb636e7406f3e05af7d6b314dbcee21f
SHA512 041c917599c4239cca284e6468860bd5195385901e5d4cec7de05e9986d7134730b5f2e51e8aa299bb30ea9890081a67bc0d7903f15b0def44b21fd83ee37e20
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:MQRQyi36YOcPQLvw2gAf+PN3TYBb
TLSH
T117667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ff7188026f427ca6f89f5a378f6ae7d004bf79179204cbd160e3f8fd91b2bc10
MD5 1afe83ce69a007f319a34642a90a966c
SHA1 f306ec47c2a268586c6fde86d9203b1214c86733
SHA512 41520937490f6dfd715357c072bc7deb5e59c7213a00f319b8c1c7589fae922e3f42f9d65d37b08551c7d898b00c9380f349b11329402e08acfcafd566ab416a
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:cQRQyi36YOcPQLvw2gAf+PN3TYBb
TLSH
T197667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5ef1832674d0f19567487b79e95ecbff86248f3440209f5d9692f24b76facf10
MD5 bd4a8eb950aa417099a9ee57cecf659c
SHA1 1db51a4687f881b157298b7958e631bceb6e2c85
SHA512 bd79a506dcf73bee3c1db28d486450296636840e075b8cf056e72bc16c0236e5903563858787f0135fe05b24a62aecd508b09d4672b1d38a455250869a30cf35
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ydu/EE+4hMDOlrj:H68Qg55nhheWu7PNU3/nJE+4hkORUYb
TLSH
T1CAB54A33B2F600A9C44DE1769F46873196E27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2f0f773deb4e1085b9630619f81e5820d561a9fe6b24c13d87b5bdc79706523f
MD5 8bcb2214c3c0be1a8cd1b28e99b528cb
SHA1 35bf9ce30f25eddbb7216d04faa4537481a05ea0
SHA512 3225957d5b711674c560ee22ffcc0a907705510d8db2350c52bb84709dfa19af5a208a0879cb783e5d47f4435e973e6031c7bf9d51432635742af338edade34a
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:Ay5112gYy5azzVvL69nLKnhZAYBb
TLSH
T178167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a9930daa8045071c1ce81e44807f4a0309ab547d97111eb2f05c00717eefcf6e
MD5 39b98f72be2f580a2cac5fd21f818aee
SHA1 905fc41f5bec006b0bd5225d617a9fc090918314
SHA512 59b3ec38dbf89962c86209fce67f705caddc9013c65abcf2a5942543245256867e445cacf7e2dd9904763aee47adf121d292a687b8b965488c143677068b3c30
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5JE+4hkORUYb:uu6JmVxd2d7YBb
TLSH
T151D59D13F2D901E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 791e091171349527b499bc75b6e9a7545762773001b311ad8812603fbdf05b4a
MD5 73ba2a5ae1ff3f773d76925c473fcbbe
SHA1 e76405d9a618fe5a1f3466c0c9343411d7e4c83d
SHA512 729361ed82487b1f7389326ab72f60b9d2cf78792df43a00621c32ec8bee9034df9d4b370d358faa35565996e3f1cdb0b6803243608d902272410ad5da0a575e
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4x1JE+4hkORUYb:PmifPbRyYBb
TLSH
T125B5AD13F2D900E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BAE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 81b58858e4534111c28fad720c4adc8c07b34661bc5ccf4bb7ebe416ace2451f
MD5 53e38b28e8556117b6a6b85dbecfa1ab
SHA1 95ff523c4c6aa24d0195c0da72378eb6ae35a191
SHA512 7d27fb18ede4672d4920ee843283f2545997fb4b814b4f1db0ea55e144f41c6a3862a3d3d7ed7e6b5d025347adba9914943f494a1f6e5dc8807e5fb61c619c55
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqCJE+4hkORUYb:R5dKTi610YBb
TLSH
T1F4C5BE13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a8d6513ec96d9534bf2b5d22e3e4a18e45ba36f65d3865e00181e3d514c4972d
MD5 36e0c56765e0ce02f689d1e2a8240fff
SHA1 7e4fcfaa8956db3e0ad1eaf3f749d4b6685dea80
SHA512 bc91a908b03647e0a6a179912722e1529d84389c53ccb0ed80fc96add20bf8f770c63dad78c27a72fed04924a911bac978587b380fb47c6952809cb96742e57c
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wJJE+4hkORUYb:zX2iyph+YBb
TLSH
T1E595BE13F2D900E8D06ED174C7468632EA62BC160B35B6EF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 89b2f643d2ea5589157358a47b833bdc162baa0bbeb2886fcfe15c1098aa0afa
MD5 0126a4ede4a9e5171bb2f36033d16619
SHA1 b0df77605a53cba8cc21e3242695742cc101c26e
SHA512 7c31eb023fd277d90ec9841243313a24b7830bdb8b67d75305629c23710691fad7a2544ef0ddc0bcfa8179b97569ddbba7e8c500e447b8fc023704d09a5bc3ca
SSDEEP 12288:SrHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:Smdu/EE+4hMDOlrUYb
TLSH
T1FB452394879D0CF3C63790B1E50020ABB3BB095B7AA4715BAE796E135EB91D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 80cdd9f6751a3928d686b92e30259b6be73e5e8a4c19da87cd10925ce7afd8f3
MD5 52e1f286a224467a7111cc57eb3075ab
SHA1 21de81d4c4f9deeb0762b853e024278389237eca
SHA512 feb5114e0202564ef8bffda892c91396ebb6cde094b729e02fe121af1373409742d392b392205cf228b5ce625fd28b5e2472ed518124ec9d3ec5f810f78dab44
SSDEEP 12288:RKHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:RLdu/EE+4hMDOlrUYb
TLSH
T18A452394879D0CF3C63790B1E50020BBB7BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4f56f871e6510123a206a1727175cc789c7a435953f80775c38663765e316d8c
MD5 6608b52a3b70e5dbd92d7f9db97d4b00
SHA1 82b609fe182c71727c299aaa2de654287ecc956a
SHA512 2bed0725a986a33f279eba0f52e439a7d9d1af703b76633bf8e7982ef11192d0d7f480135866f1f1f2551ea2389f0c09692734fbbb5e479b86cfc4730486dbea
SSDEEP 12288:v4HSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:vtdu/EE+4hMDOlrUYb
TLSH
T1B9452394879D0CF3C63790B1E50020BBB7BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2926f5b520b5d7fcb2176148d299d76ba98ac74b3ddac62350590bd45b765099
MD5 454758c9215b94fb574b3252ef8a9720
SHA1 7e06b96024b1b946e30e94d689012bd810dd5b50
SHA512 ce745f0d416b06e37ff39bfb7e7428cbc767a99a5a935ee800681827186e01f93b56405133fb5def6632a76be40a3e8e56f1377c13af0da3b17bfb6c2e2a6483
SSDEEP 12288:kV5HSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:Rdu/EE+4hMDOlrUYb
TLSH
T1CD45235447AD08F2CA37D1B5D510106BF3F67C9A7B70629F9F201E170EB53D48A28A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b7dd8aed73457090e0ab74e1f4736bdd15b87a4b39a9bc55bf56f7232155e7cf
MD5 5841566f2129e2f28c92ce9b3c51dff2
SHA1 d8c0a40e63bcb8774dad4ed308060dbabf5d67c3
SHA512 4bd542bb97fc3cbfcfe16e6291fb165dcdf2799e47dce3aa33a529071a749affddafd0939daaba659ee0fe1d0bc6113acd141c157ee4d014465a83bcffbea568
SSDEEP 12288:mBHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:mIdu/EE+4hMDOlrUYb
TLSH
T1DA452394879D0CF3C63790B1E50020BBB7BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 aee9da48c01a6359079514c7d70ce1ac0367ee669acc3f28ce0cd63df807dfd7
MD5 10027c16b0a2ec977dc199c09ddcc3c5
SHA1 8398c0533666479b85cfdfe39c1ea2feb70df76c
SHA512 32f850636a4cb585b7f904d3d2d6e98c63af81d32d203de03d5c04f090fd504cfea8c86a6c3acbef38f27f3df1fa84c93d539f82ed9112f5bfdeb8c44570de3c
SSDEEP 12288:AOHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:APdu/EE+4hMDOlrUYb
TLSH
T1F8452394879D0CF3C63790B1E50020BBB7BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3c2d47b99550cbf25900a8c06d50804d8fe59421fbe266195d804029c04649a2
MD5 fe99c376c51c4581e95d833c4d03babc
SHA1 fcea99499556d5cda84d3818b62e9f101faccf25
SHA512 c5bad6521527e6a5b24ddf07c16184465e4b5fb98873530c52ee6ead982a754e6fd3de45253633751b612d014734df4e2e1a26fc531d5490594bfcdbc08a293c
SSDEEP 12288:NyHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:NTdu/EE+4hMDOlrUYb
TLSH
T164452394879D0CF3C63790B1E60420BB77BB095B79A4715BAE79AE135EB81D9870C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 94fba887bc1d558684645a57c589e66b22f54562dd20dbc427ddcc94a5f6e510
MD5 fbbfd2d30c572ac8c9a5f4526eb16242
SHA1 ee0eeddbfc96c5993478f01c8bddcb6557956108
SHA512 b5c8c35f3dbedf6c4778c311582e77824735faf160b7c3e909e6b45e544fe424de5ae333c84363b4b44b0bfb4df8c5ca5c6ebd9266d4e2b411aa931439fb94cf
SSDEEP 12288:KiZwbAzzFEoS2cPvyqHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:tZMozFVSOrdu/EE+4hMDOlrUYb
TLSH
T1356501A4B3941CF4DD67813EC9159816E2B27C5A1B70C61F07B43A275F733A10D2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bd262ecc8febe5b2a99f377080e9dc5951cc7581976f1b9c43c7dd9ab0b4be48
MD5 387bc05b1458a9e67feb743b48a5e491
SHA1 12557a283d9727bc7c9521061c34cff22bbba8d1
SHA512 299eace65ce1a8531edf39d5e7e385d26e8c7d49dc272d9a067d52f0955305775b5f21d6e6109df8fd7cb44d1d44b5dc4a715d05e7cad26cff957a411a2d42a9
SSDEEP 12288:YHHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:YSdu/EE+4hMDOlrUYb
TLSH
T121452394879D0CF2C73790B1E60020BB77BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 17eb22815f3c0e3f2252ce3f784ba0b73fc1bea4d0e0ada5bb11440ee8388df4
MD5 c1a2f6327e93d4a9ea4053535f9bc8b9
SHA1 bf8c09c5fffd0fc507f5b981be9961503c618901
SHA512 4d52ee2497ba5f3c681df091bf61d621ea00708f09f6110cf4967d2b057449f848c417859ccfc2d7c33fe1c7a0738b9962c96441a894e3dec4e7ed7f6f697466
SSDEEP 12288:HDHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:H+du/EE+4hMDOlrUYb
TLSH
T1C0452394879C0CF3C73790B1E60420BB77BA095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c9beec26ac7a3172012184904b66052ca1bf6aad6c41d3de42eb027b0255ebcf
MD5 f8f0678188d43e225211f6ad8ea59d7b
SHA1 817fbe2b119fcc02fee8751f7f7c604448a7e16e
SHA512 b51be59dc0f9e2df5e6ee1a24508970f276e4a473e22ff517dc682d8a58f0096324953abcae52de4fa116f529a9115c9cf23a0592da587db987ac5cc7642556c
SSDEEP 12288:dyPz5L8GHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:UzyHdu/EE+4hMDOlrUYb
TLSH
T10155124763A520F9C1379238C9511916F3B278361B309AAF5BA44B372F772D18E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 184c0e2fe76e4bb2ac0c3c115f6a31c201a38836533d1c947002794ce0ad562c
MD5 e3bec1c0f5a557f29256bc6e1dc8cdbf
SHA1 45951ef2ca2c187a6271aee5155130615691cfb9
SHA512 aac651127b96360dc71b20be17d284987b85d4ac3e1db86356875b501810afddabe9e5772b84c93c7cf96ebecca747e78b07e7a323cefe7f00707e7b1ad2c720
SSDEEP 12288:9HHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:9Sdu/EE+4hMDOlrUYb
TLSH
T10D452394879C0CF3C63790B1E50420BBB7BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e06a9f4bc4030d7a8241c2138844939d264a0f09a8fa1ffefa763b776ac1bf75
MD5 78bc32d48c2da66212f3427303cf5a81
SHA1 9581ebee78e0b48fa01386e117e64e4cb1266962
SHA512 1f603a5ada0e4edf661330c057236f1f03b42b8961111caa10bb57be3fecedef557412ecd32ffcabfae86a274931beb3b417d96a466bd335a8c8c7e981336ee9
SSDEEP 12288:/HHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:/Sdu/EE+4hMDOlrUYb
TLSH
T1E2452394879C0CF3C63790B1E60420BB77BA095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 26bd64f5c332c9073013120cb4e607df4d5d62013b50a1727fb2c03a7d6a1e4f
MD5 d29a00ab3faf378d04d4494690c7581b
SHA1 77fc0496b45559a2c4f0ad3a74810345db155730
SHA512 4bd6bcc2b7202ac74d7912163a37220bd7e7119c8e2da4438ff25daffef86b11deaf5d02be0ef67f81945d35fd751c3c4505be57759bdcf6e8b51fd2d476a9bb
SSDEEP 12288:fyPz5L8GHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:SzyHdu/EE+4hMDOlrUYb
TLSH
T12B55124763A520F9C1379238C8511916F3B278361B309AAF5BA44B372F772D18E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 5d45337cd2f3e01605a0066dd1f1f6edf5f3c323be87401f9ac78d4bc6bfceb5
MD5 48183cf01259761f75e6ae91c9ec4384
SHA1 550c60cfbf0a13fdc62e2e3084ba4e2240294b3c
SHA512 428a9702d2de75b9521408ad08b376802e207369c7adba643738848b6e659c209b9d9bb962d5facf4d9d67e42c08d2e3aee0813b3b33e1a58b4e5fa527ac7268
SSDEEP 12288:KCd9gWYoaLHF3z0z04PDvhIHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:7TZaLl3z0zDddu/EE+4hMDOlrUYb
TLSH
T1D76501A4B3901CF9DD67813EC9158816E2B27C5A1B70C61F07B83A275F733A14D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b14df4c249f5533eae87ea4defca47e13aada0f2704d48de205aa66eeddc777b
MD5 85856e169e7042235c49ce7e50900051
SHA1 85ddc9d7776943b7620e072979c5fededc91af6a
SHA512 43f6c218cd1ca9130e727aff9bf2cb278cc49b2fc1018b0679f5463795b7a7ea6f75e3bc7c00df8588c2a32c672041d45c7475571805abb1c05dd2e4e7be7267
SSDEEP 12288:Ai4e78RdTfgwCHKy7GLbbdIvFHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:A3ld9CHKy7GZBdu/EE+4hMDOlrUYb
TLSH
T19875CF90F3E814E4F1B79A35C9765512DAB67C5A1B30DA8F03A4261A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5c7de5e19d6096c8c926baab74f1387f2784c66bdd4a4f8e4ce814ef2fc04402
MD5 36544dd68e5f03d5f27cac6b4c79157c
SHA1 434646e5b8747bed614458cd3918931cc9c47339
SHA512 11ab3cec4c09a301cc90e6ae5181a4082de382947a562003854c010082d4ec72198342016a1b2b0e1d66f8a3621c48a914fb45e0d17e956929cda43bcc7ad7dc
SSDEEP 12288:xYHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:xNdu/EE+4hMDOlrUYb
TLSH
T1DB452394879D0CF3C63790B1E50420BBB7BB095B7AA4715BAE796E134EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6d5fafc8dc1f88ed5ad2b618df222319a116df21220d8ae8442b61735e4a4732
MD5 0826d1e62de2c647956f2901c36365f2
SHA1 a579e14a108084539512e429c7e4b418fe500264
SHA512 a414e3acc2e527377dad66c735892dd9a6dabf5d3026a16e17ad4d1c175919cd56b34486c177d48c39ec40f8f982aca8a0d2c9542e27d3300c16536bff1f7c5b
SSDEEP 12288:AmHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:Andu/EE+4hMDOlrUYb
TLSH
T1EB452394879C0CF3C63B90B1E50420BB77BA095B79A4715BAF796E134EB91D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 028d1288d16f1bf5228155a438349c305b906cf4c96c12b92f5646eb2ea028b0
MD5 04cd06f312660e75410ac0feb0cb5d0d
SHA1 5ac64b711b6d447e36375bba9f7d444bdf8c8cf1
SHA512 7f49e342a51ec3e0c71fac10569be59b4ff9840fcfcbe4423940276c513701a452ecb5bcc2f46b9579adc525fa6162c8b01329f485687acd687e45ed193d6743
SSDEEP 12288:kFHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:k8du/EE+4hMDOlrUYb
TLSH
T13B452394879D0CF3C63790B1E60420BB77BB095B79A4715BAE796E135EB81D9870C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fd8cad17041d4e7d1dd6199726914d1f9b43d6ae33425427dcdc4446d8e79d1a
MD5 0da12044348346811c2a1efaa90008dc
SHA1 99b8ffec868b1eb08804941212afb3dea4c34b0f
SHA512 6cea91ffaa76e734a2ed61fd0b71144793e0a6628da7b17edcd76f87e365b814681cfd3fb7fe4a22d2d2499f4dec718a5f54cc6c951f50e8a4217e03af8274a8
SSDEEP 12288:bHHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:bSdu/EE+4hMDOlrUYb
TLSH
T19F452394879D0CF2C73790B1E60420BB77BB095B7AA4715BAE796E135EB81D9870C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 21b17da892d5cc5d98738e5ce4f5a7dfbb2305b80664da6f5479db95d50b86bf
MD5 3bfc4a798850653e861831dfeb57b2bc
SHA1 c0b3884a8f5033a385d644d95d09ec79d851ed03
SHA512 35cc5cc62d6713c28a6cb0dd0c0e312742917f1f8afc0002728bede28e4ff5e1aab0b7116490bb21305e2c54934f76b6a75fbc8ff4f7e9fa493ffde4148bd4b4
SSDEEP 12288:CYHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:CNdu/EE+4hMDOlrUYb
TLSH
T1A2452394879D0CF3C63790B1E50020BBB7BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c5e1e3326ffbbe95c3d5f3e634b3dc191360f457cb30124e159f5401f0447154
MD5 b40e4179e25d0478912b0d815481e273
SHA1 4cbf76694102d50bba960290cda92ca221991931
SHA512 692f744299262a6392413efeec6859f3265800a1a8e26ea4c9a4e9e77a648829ce427895b1c4bd2bf4c6e4d367f7720ce23ee8fbad1b406a6ed36545d345b2db
SSDEEP 12288:UvHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:U6du/EE+4hMDOlrUYb
TLSH
T1724523948B9D0CF3C63790B1E60020BB77BA0D5B79A4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8b59da12fc9f76ddb198fc880d91c4dacf2710650995f6bf9dcc96f4228fb3ef
MD5 a5068e0b1b665c249c89053763c49a16
SHA1 daca0b14af5142572f7325e04ce490a9fac20dd3
SHA512 5c9a8f807623d4974702142aba1a9f9eae4cc4f143dcee2010fd47b7005eb0c772d625a29f3344e8897a1be7ce423573af02e0f8f972ab96bf143f24cfeacaa8
SSDEEP 12288:zBHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:zIdu/EE+4hMDOlrUYb
TLSH
T12F452394879D0CF3C63790B1E50020BBB7BB095B7AA4715BAE796E135EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 d02cf5a8d0f02d632633bdc3b0a7c8865c00947824276f12e55edef44375f1c9
MD5 d994b0d6e6a5c2936222b04037e0876e
SHA1 58f06c79185194e0fe04c5602823646f502ed704
SHA512 ff0dfeba9575351c5c7ad4addb1751eaca4bf8babb6433e2e2ef15a122ab9239c3907406f6da307bffbfad4a047af8d438764a9fa7f0c427be9480ab7741ed81
SSDEEP 12288:dQHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:dldu/EE+4hMDOlrUYb
TLSH
T1A34523948B9D0CF2C63790B1E60420BB77BA0D5B79A4715BAF796E134EB81D9874C0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7ee74af2e29ae2981484acfb05ff60cbd8102ea2aba4187b30ac241b73ead0f2
MD5 bf6dd30e7418d6985792f87bc3ae314e
SHA1 904c52099ad9fc060102487006ec9392c6d5f821
SHA512 0f3a8ffa0f8d3887656e887c17c4ee0397142979c8c4c51c6f4924e098d25c9a992fbcf016bfd1f5648087e42fe3e2e22aa74a874b5b8bbdffc202fb530777b1
SSDEEP 24576:0fwv6k9RX6wkyAIOdu/EE+4hMDOlrUYb:uMnYIOJE+4hkORUYb
TLSH
T1AB85D029EBDC08E5E177913C99B3460AF6B178691B31C2CF069A536E0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6fe1f5febd7a3104ecb23ba7c0816a93012d1c2ac7658e5f8f7c879c180a770c
MD5 24365cfaa59f17196c3b40d1f8f8800b
SHA1 22d8b800904fafc06340de7cd9ff5b8babc2a634
SHA512 a31fe92ec42dd57376b0ef5686d5b71395caff1ed1369d5015afe3fefc0664c17316828384fd6682ce3c8fead3e8281a230c82dfc5271abf7ca09d12dadc7bab
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pJE+4hkORUYb:XySzPzYBb
TLSH
T165066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c8ae88777679daed8a89c9e5f917d1f39a0d6c9bd23ed43110fe9ddb20834536
MD5 71327e5c2c5133275e4c3118ec2b07a7
SHA1 eeed712e383eb339ca8966b8d80df2c7054892a7
SHA512 1dc4bce7c5ab9e1e69fdc2b1c53fc6048865c029ca7777d241dcfbd69d12ed2030a555a29b60fe5924970f469978b558682d249a88c80ef817b683f0fc345781
SSDEEP 24576:e47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY7du/EE+4hMDOlrUYb:e47JUQj1irIhCnDHUPfF/5JE+4hkORUG
TLSH
T1BE65AE1DA3EC01E5E1BA927885154A5AEA71742E2F31DACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e8006559979315020ab87684202217558eff62820c45efd3c2a8867409556ee3
MD5 be16fce9db79166fba5adbaaed140b3e
SHA1 f119495401384944f472e0fb91bf42a492b569e9
SHA512 bb39a62c9cf66a25e6e38ba02847ad4bfb33f701adefb3d98a12be3e256cc994c2e6d2dc35b40f0d41d7d831b7cdf3dce365a32ca166592acdcc4dc3bd8c9192
SSDEEP 12288:7HsfXHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:qCdu/EE+4hMDOlrUYb
TLSH
T1D855F059C29801E9C02FA175C7455542B3733C66A7E0E3CB5AE0FA3E0F7A2D08EE9647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 465cbe00652ea2fdf7d6a28b68bc857e5cc17edef90214e2bc4440099e7f577e
MD5 a69713fa19260511a69f3d76592db037
SHA1 a9aac8a4fa98477e17f6298faa15008de5af6d89
SHA512 cdfbac2a256e37314371e7675366b4a703915b7fa5539f1fb6b405e6b56ebf26d8c1a7240d990a83cd544111e247b1ca815de9eb732d08fd16ed5a1aee9d5771
SSDEEP 12288:76kAU3fzhz5fe3d+7PGnIFrzOL+WKbSaRMfwXiaf4crsmFqPadn:76VUPzrU+WGSaRMfwyafPrsOqA
TLSH
T1E73527417666C74FC66D40361E32D6CCABB07D01EE04AF0373C99B3F95B6658BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 5efa837431a184b331a6a58066df14c1fe2771c16eb6dfdefff553d278a4e311
MD5 e46ec239e82eb1348181e45a5585e021
SHA1 9f4df4ab56127bc77003d75886c1114519b2ec94
SHA512 3c9d9e72607b98d0705d4457f8c4cc05789cb02f40505cea20da88d02bb40df4bf5182ee74a77c090f56627a36bc0745026f09596cb6c4e8de88d53a5782f826
SSDEEP 12288:TeiJbiU2ae3d+7PGy+IFd+7PG83XMhIFX+7PGo5guvIFZgd+7ZGI5NIFWgf+IFFg:TBLOCg5
TLSH
T1F3750C81A436D38FC1BA60720325AB8D77B4EC06B7456F26B3C8593AD866715B1FD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3acdaf156dbd9a59ecb0552930acbf5d3cb06fe9bcea325d208c55e38ca7a105
MD5 60711b1507897af0ac56d2d0a6c62540
SHA1 14ea99b6706353a9c9043f2c9215d2606a2fa18a
SHA512 82bee4394e2396f47a3ec66a5e70e0b286ad1b25726ba6e95eec2403392a48ab3c71ca625e9dde0c6f89e2ca567535eaeab12928d4bb91b0f8a674e2ae6f4649
SSDEEP 12288:5S7/HSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:4qdu/EE+4hMDOlrUYb
TLSH
T1F6452350879C0CF2CA3B90B0A5085037737B696A3F64A1DBEE256F175DB86C58F6818F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f99a07c15cd53ba85c26fa213f304c5aae7b682122597e4318b76a7d315e32e8
MD5 bbc7fb7a7bdd7b44ee399c3c67d65452
SHA1 e0433fd84297f91f30cd0ca45a1252f44de99fdb
SHA512 df19a05b88963d137a7cde355b15d05b85f75140b3fa89668c46d5c20602be4228ccb13f1ad6f63dc2ca7cb5270cea1ced637114dea856ca2e5c2cd36914ecf1
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYUdu/EE+4hMDOlrUYb:pgb4mBIBhGF7JE+4hkORUYb
TLSH
T1A465AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6f0b71e22ddc1b1082e8a03c6be0f3d8d08128b9caeb31cb238820d2735b750a
MD5 8d50d92035636f074fd377dffcfd4b5f
SHA1 c1afc50664dc6d596c52ee55eca9be7f1ffdcae2
SHA512 561a156266d71baab6494329d433ae208bd43d167fa042ff7291d8e7e4c65051f295b919f221a5aa05a0d404f54b1b587e78b59b1f9ebecfb51514e8e8481c81
SSDEEP 24576:7G88u8FpJqH1dzria7/mrdu/EE+4hMDOlrUYb:a7ZFPqVEa7/cJE+4hkORUYb
TLSH
T1DB85F16567E401F1C47BD1388A424663F6B2B4251364FFDF0BA88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 973c5b89e318520fabf2f8a08556b40ea7a3a057df449d44f8302900a6a5da6f
MD5 f34beade9de55251443161f7b036d67a
SHA1 edfc0523d70b7c3054e9dd0f3ac50fc1e1e79378
SHA512 acec028789b9d806bb65e96da8ba75246ee0f66a441153d940e141fcf2289511f8b97b86f09f40d507e72316aac30184e08a9931bb6d50509af3baf08584c416
SSDEEP 12288:oHvUrBFrEjwaQ+HSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:oPUr+NQfdu/EE+4hMDOlrUYb
TLSH
T13B65E12E23EC1CE5E67BE17D85424619F77278621711A2CF06E0813E4F67AE8AD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f0e557b8f348be0aef3a17adab7fb26b4ead9b2cbe4aa119a00728d93134cb1a
MD5 88a47346f6c65c40c2b04905d20e95ac
SHA1 460f2ce5b1452abf32a88cb9f8f965dbe594e720
SHA512 286325bdb4cc0c9f1940830a7bbb4423041c7a0f65d76fa803f4736fa0a5abe28403a5f48828c721ab6dd7377250319117ae7a9d5fd0af99a88ae2789db6981a
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPJE+4hkORUYb:CG05lO43bYYBb
TLSH
T193D5CF6A62EC11F9D1BBD17CDAC6460BEBB23415033456CF02A486A91F27FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b6e00b8f11499f3e9fee04808adf257e646a7d9d1b357b6d4602b7eb1c8eead
MD5 4935e4b5c2539882327f06ddf319f3c1
SHA1 5b9af4a4e20fbbbd0e604c4bb12e8acef8b39487
SHA512 e0e6e3548b214330817958f2871a4b35ab39f13f3f50bfb76b3e35204b6ec1027355fea1dbcafb60308d84ac95f2d8eb0c2d7c26b03d722705bf8847f1f7ab41
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnpdu/EE+4hMDOlrUYb:Qa5POZ3+Jt2pasx2+mnJE+4hkORUYb
TLSH
T18765AE5EA7FC00D5D57AD17DC583461AF5B2342653319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c6077d911b30485a00566194f67a36cd2957f0b64da0c96a359665d065351ac6
MD5 58a4428d50eafc7b1d1e3e0ae142d1da
SHA1 2586849cbf746aef22aa24efd683f60565594d5c
SHA512 3e0f59bf3d990b2baa490fe2aeb42870ed1f3cbc8c470636510142e8d4211b94b3ff3e891d18dc610beafbdcac9603777486074d49b96fa8c470dbf257d0d3d1
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkDdu/EE+4hMDOlrUYb:FNc/zEOVHF8JE+4hkORUYb
TLSH
T198858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 13932518cade8eb70649f3580b403a2df43a70564e934a3f97987748425fe72a
MD5 e64fe7527104e003ea11039bcc6d710e
SHA1 d33786ee873f588526e78aca0e7e45579174598f
SHA512 4ddd3bc85d34910212e46fbe022800cfbba2d92ce28474968e892416145fe7091ff7b2a67e8beed3c56a75700f1da893e1460eeae113658b57cc445de72042ec
SSDEEP 24576:J8kNvNnaFeYhJNtmZBmldu/EE+4hMDOlrUYb:J8MwBtOmlJE+4hkORUYb
TLSH
T13C55AF6EABB805E4D1BEC6B4CD238512F6727461173293CB9290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7fc57ee30db52eb9d778fccf00a45b3ed1eb1827d2df1c9c211c5d8d28f5ce53
MD5 2e13752dbba8bd1533e958c5362deb6c
SHA1 e014317c954691069ef8a0ed6c2aa72b67ef28a0
SHA512 d8f2d3e5aeb15aaa1a869ae383b8464f7bc7fa7460382736185146a540e9311149645659b2427f15605ad9b3c20b1c92071ab13494d2302d1caa1a3102f2a096
SSDEEP 12288:JQcMxWDXN1Dp/fshBItT1IQgALHSd+/zd/stqOE+4UdiJ92RBk1h44nZKCjgGkUb:1D3FHshBIYQgAGdu/EE+4hMDOlrUYb
TLSH
T17575E17DEB9C04E4D57BD1BCDA538506E7B238A9032166CB069481BA1F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2040-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2040-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2040-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2040-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2040-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2320-68-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2320-264-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/2320-74-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2320-66-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/2660-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2660-122-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2660-128-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2660-130-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2660-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2720-51-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2720-47-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2720-46-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2720-40-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2720-53-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2720-39-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4224-283-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4224-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-83-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4224-366-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4224-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4712-78-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4712-0-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4712-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4712-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4712-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4984-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4984-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4984-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4984-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5336-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5336-284-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5336-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5336-288-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5336-286-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5336-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5648-110-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5648-107-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/5648-116-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5648-285-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/5696-277-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5696-79-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5852-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5852-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5852-289-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5852-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5996-242-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/5996-55-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/5996-56-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5996-62-0x00000000007D0000-0x0000000000830000-memory.dmp

Download