92be542440f26cea06a013892af11fabd24c2370debb3aa76c2e68892cd7f140

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.7MB
Sample260813-2xgreszgkh
SHA256 92be542440f26cea06a013892af11fabd24c2370debb3aa76c2e68892cd7f140
MD5 2351dec97bb9d24282b53c28e60be78a
SHA1 7b542667ec48afe29b68623e02df101393f5142a
SHA512 f123e6563f674fa218a5a7438b2df53561ba12d37d3a78467ca2dd97040120ab3d59ffad31698780269c2cc444ed5cfb81d81e8eda7368635efe9570d2be8545
SSDEEP 49152:wlh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fES26HYlGBzNwui0hBdH3Xax4Q:wMgZeD+lBBquTBpnaix8EVy
TLSH
T1A506B006A3FA06ADE0FBD238C956D903E77A7C090270A75F069055A72FBB760DE79311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
568	elevation_service.exe
2992	elevation_service.exe
4072	maintenanceservice.exe
2180	OSE.EXE
3092	PerceptionSimulationService.exe
4912	perfhost.exe
5440	ReFsDedupSvc.exe
5920	SensorDataService.exe
3216	ssh-agent.exe
2780	AgentService.exe
5852	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fed35e27763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_184185254\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1168640549\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1168640549\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_184185254\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_184185254\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1168640549\crs.pb	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_184185254\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1968892118\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1168640549\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1168640549\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_184185254\LICENSE	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c9f63e2c772bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008002912c772bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a77b902b772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000623006f772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22000 = "Desktop"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000798eb2b772bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8a8402e772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077da772c772bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
1348	msedgewebview2.exe
1348	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4544	msedgewebview2.exe
4544	msedgewebview2.exe
4544	msedgewebview2.exe
4544	msedgewebview2.exe
4544	msedgewebview2.exe
4544	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	5440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5440	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2780	AgentService.exe
Token: 33	5852	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5852	SearchIndexer.exe
Token: SeDebugPrivilege	4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	568	elevation_service.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4544	4588	2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	93
PID 4544 wrote to memory of 4784	4544	msedgewebview2.exe	95
PID 4544 wrote to memory of 1252	4544	msedgewebview2.exe	99
PID 4544 wrote to memory of 1252	4544	msedgewebview2.exe	99
PID 4544 wrote to memory of 1252	4544	msedgewebview2.exe	99
PID 4544 wrote to memory of 1252	4544	msedgewebview2.exe	99
PID 4544 wrote to memory of 5288	4544	msedgewebview2.exe	100
PID 4544 wrote to memory of 4712	4544	msedgewebview2.exe	101
PID 4544 wrote to memory of 4712	4544	msedgewebview2.exe	101
PID 4544 wrote to memory of 4712	4544	msedgewebview2.exe	101
PID 4544 wrote to memory of 5880	4544	msedgewebview2.exe	102
PID 4544 wrote to memory of 5880	4544	msedgewebview2.exe	102
PID 4544 wrote to memory of 5880	4544	msedgewebview2.exe	102
PID 4544 wrote to memory of 5880	4544	msedgewebview2.exe	102
PID 4544 wrote to memory of 5880	4544	msedgewebview2.exe	102
PID 5852 wrote to memory of 3172	5852	SearchIndexer.exe	107
PID 5852 wrote to memory of 5732	5852	SearchIndexer.exe	108
PID 5852 wrote to memory of 3488	5852	SearchIndexer.exe	109
PID 4544 wrote to memory of 2844	4544	msedgewebview2.exe	110
PID 4544 wrote to memory of 2844	4544	msedgewebview2.exe	110
PID 4544 wrote to memory of 2844	4544	msedgewebview2.exe	110
PID 4544 wrote to memory of 2844	4544	msedgewebview2.exe	110
PID 4544 wrote to memory of 2844	4544	msedgewebview2.exe	110
PID 5852 wrote to memory of 4252	5852	SearchIndexer.exe	111
PID 4544 wrote to memory of 3176	4544	msedgewebview2.exe	112
PID 4544 wrote to memory of 3176	4544	msedgewebview2.exe	112
PID 4544 wrote to memory of 3176	4544	msedgewebview2.exe	112
PID 4544 wrote to memory of 3176	4544	msedgewebview2.exe	112
PID 4544 wrote to memory of 3176	4544	msedgewebview2.exe	112
PID 4544 wrote to memory of 1360	4544	msedgewebview2.exe	116
PID 4544 wrote to memory of 1360	4544	msedgewebview2.exe	116
PID 4544 wrote to memory of 1360	4544	msedgewebview2.exe	116
PID 4544 wrote to memory of 1360	4544	msedgewebview2.exe	116
PID 4544 wrote to memory of 1360	4544	msedgewebview2.exe	116
PID 4544 wrote to memory of 3456	4544	msedgewebview2.exe	119
PID 4544 wrote to memory of 3456	4544	msedgewebview2.exe	119
PID 4544 wrote to memory of 3456	4544	msedgewebview2.exe	119
PID 4544 wrote to memory of 3456	4544	msedgewebview2.exe	119
PID 4544 wrote to memory of 3456	4544	msedgewebview2.exe	119
PID 4544 wrote to memory of 5936	4544	msedgewebview2.exe	120
PID 4544 wrote to memory of 5936	4544	msedgewebview2.exe	120
PID 4544 wrote to memory of 5936	4544	msedgewebview2.exe	120
PID 4544 wrote to memory of 5092	4544	msedgewebview2.exe	121
PID 4544 wrote to memory of 5092	4544	msedgewebview2.exe	121
PID 4544 wrote to memory of 5092	4544	msedgewebview2.exe	121
PID 4544 wrote to memory of 4512	4544	msedgewebview2.exe	122
PID 4544 wrote to memory of 4512	4544	msedgewebview2.exe	122
PID 4544 wrote to memory of 4512	4544	msedgewebview2.exe	122
PID 4544 wrote to memory of 1348	4544	msedgewebview2.exe	123
PID 5852 wrote to memory of 2640	5852	SearchIndexer.exe	124
PID 5852 wrote to memory of 4272	5852	SearchIndexer.exe	125
PID 5852 wrote to memory of 1232	5852	SearchIndexer.exe	126
PID 4544 wrote to memory of 1988	4544	msedgewebview2.exe	127
PID 4544 wrote to memory of 1988	4544	msedgewebview2.exe	127
PID 4544 wrote to memory of 1988	4544	msedgewebview2.exe	127
PID 4544 wrote to memory of 1988	4544	msedgewebview2.exe	127
PID 4544 wrote to memory of 1988	4544	msedgewebview2.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4588.708.14932042618229962511 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffeeccf5fd8,0x7ffeeccf5fe4,0x7ffeeccf5ff0
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2016 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4068 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4272 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4260 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4256 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=3520 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4268 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4676 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-08-13_2351dec97bb9d24282b53c28e60be78a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2196 --field-trial-handle=1780,i,455300076218808158,2993778914320925034,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:1988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4072

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4912

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5920

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b20a3ec7a5f2d9ead9fa9650cf5de3f08aa319a0370e3d32fb4c5d546cddd4c2
MD5 0f4942a35521b3f405ed999b6e09aa7a
SHA1 ca3ee0732a1e389637ab542f69a5fc88d386080c
SHA512 9460e194ae7e34bd24bcd5b3ade646d2798301dd2d5a5307432d9feca8c8956776b78db61f3ac1c171fdbe48cd1f061de9675405d6f247f8e73ac77be4883a77
SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbx4x8EVep:V3q6HjBMix8EVy
TLSH
T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b2804215af81c258da16de3292f867fb040bc543bf0cffaff1706f54da575ba1
MD5 e57a32a9db52f0da65959167e99695de
SHA1 ad208d3f029dca78ea8367e61e523d748faf478d
SHA512 78f50c7aa2bac06086628bbcb6bf290e14e45b12a1dbd30010b9da5847727696c5ef7eeab1af8bf356987da8c18a5d0fb31c780542fb22b5038145fa0f236772
SSDEEP 12288:s1XLsswWkxy2lRq2czAt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:aXYfDtczAtyxknw4FYnshx8OfVe247
TLSH
T18785F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4952A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 db82490d500ecc88950c45f75950ac4e1afa18e996d4b2d7e39fafd815520655
MD5 ffb992763f906e2bf07b216a299875cb
SHA1 e0bb850829f6a8a8a8a60f47ac0eb16cdee943be
SHA512 fe3db45ebb5745e1b70c32cfb5659fb73506fbf5ba557c4fa198c0ad26ad7617643be55ebed3e343c71dc6655000cace22b3c97a9c50932b533bb86b081f6e4f
SSDEEP 24576:70Le5ji0hmxirMwyxknw4FYnshx8OfVe247:7Pji0AcCx4x8EVep
TLSH
T13EA5AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3c354d4e48c25a729b217812ce98371275393afcad623bdbf1e54fe4dca2f9d2
MD5 8d51511dc727ddff37c64463a0553b81
SHA1 43d19a362c1a5e060e294bfa8fe8d66748ecd9f0
SHA512 922b36d9e1563b8fcce8c597fd18e3599cd084907d94764cd51fe5744136ce38064dfd5b383206302520d5ec601c5d70744956123ca5810370677f14c4431b7b
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyu2yxknw4FYnshx8OfVe247:6/ezSC6vUzPvxHjyux4x8EVep
TLSH
T19D756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 99672c7aee4aa7e9805e11ef78f779657056badc74f965abd7c6ac2663d423a7
MD5 5402b92cec83f8f4af8ce8595a49a1f8
SHA1 00d6d0d84fa9053a5998acd8087efc2fbc2e8e71
SHA512 49bc6bd2b9f92988a03a9c74c1980ab0edbad5691374cb1f15fcccf593df30190f548641e235bf583ceeca39f5e7b972159b57f3d1804594e0b5ffe7d45d6d35
SSDEEP 24576:vVbqPb88hv/l+65yxknw4FYnshx8OfVe247:vVO88hXl+Px4x8EVep
TLSH
T133559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 5aeef9b410b100c92b7651829c6f78a6d72dba7189e8acd7a6aeb2c12b318538
MD5 55ec0355c1c555cd2b360a0b9d6f7b6f
SHA1 d7dd27c1aca684f05f425a9fef65dbbee14459b0
SHA512 2692be13f41b29d24671d396bebb0a02ee99753faba51511a696a4df68c1658a27da1a1ea0fbcfba712216b5bdc57c7a96ce6d98a2c60e57973114f5b6639376
SSDEEP 12288:TR8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TR8yxknw4FYnshx8OfVe247
TLSH
T13675237CA7DDA4E1FA9E14331B7172623616B9A4DA74C11BCB79B14EE0F0C60E06E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 be96d21ccb82b2e0f469b98b6dbeb9a70e7ca39ee51f400b4556106fc5faa174
MD5 3cc5082578caf683453afb1568b4d89d
SHA1 82b409fb6d141f8c191f74c57772c5b3aa945dda
SHA512 a78fe3db60d65fb6a3897ab302c10752b887976770d2fa79c65132756163856745a35765a9b57fd0c5b11a28a65e71f0e0d938fc365058ea29fa06fdf71cf3e2
SSDEEP 12288:ZeBNUbTVO86UR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZJIURyxknw4FYnshx8OfVe247
TLSH
T17185CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0c7151251d5776419292d276b85304945ce745e85748c4f889eed0f963c2cf87
MD5 52f8f29bc1eb510c4580a410a0483807
SHA1 d019a902411209e676a3be8258ac127e9318c6e8
SHA512 c1f51b2167a140cda6b7e454035a84385c50e72f512787a578268a90156d3172e4e3b1057bc93a4abaab4c2e48ea10bdd97740bee57e2e02737a78fb68b6ecf9
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:VQvGAdlCEL8c/yRNw5CZix8EVy
TLSH
T1BA267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 0ccd239f33235fd6fd73ba1dd8ffaee1123b6ece783ccbd0490b9f16e211d8b7
MD5 59ec4d1f7b49bebded7b739658fb6f82
SHA1 e4de4e05cd46d4db552388181911198df23bad74
SHA512 0519db0599c3df05d01a2835625baadef3118b8a254c0514a70073bc0d6315792da46b7fb643e0c42f498baa9c4525cd2c4a861626bf88693a12f0ec9e9ac650
SSDEEP 12288:jAwSfxL/2Dc34DLLmt0LDQewsAjn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:cdewsAjnyxknw4FYnshx8OfVe247
TLSH
T1DD95E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9c9860994cbf20c8cdc6125953e5d0c113a40d60c5de319ac444e1bdfead50c1
MD5 a6d511948002f5d463ebd123dc0d5e3b
SHA1 8e9ae51c6329ad9b264d35342f76a65893030e7a
SHA512 2fb6cf1d67830a079e4e2946408c0034c4bcea29b124e96936f2de62fd9fd8796e030f51903b46e2bcdddc4d2c71f9ca03bcf1f78753ebc18def985c138f8284
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/:uUEtQevvqc2W1cpV2EI32
TLSH
T19F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 870ef61812df610e44f731e0f017d92c00f70d326d31e396d8c2fd0e9d3f77c0
MD5 b655f9ae0a89eb4d523246849f34a6b8
SHA1 04997f11ca98e1c90f02cf691e968dc2ae38c9cc
SHA512 d78dc45532d205eb79b75038cb5e2a71eb2ad60986c0d9a645ed3b9481b6e06bed4a1e1058c3c14c086b38bd6129bab67da27163765872a10aa4ac8c390c8945
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zSx4x8EVep:ZoqtVjnmVix8EVy
TLSH
T171D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 75f3abe7aec066134e080cf2c1fa5457f9b105836b908ebd610a3303b627ddc4
MD5 5b039e8eb5e6da0dfe8123c571eaef6f
SHA1 3d3624900474aa8f78430ccc67b75c69886bd4ce
SHA512 0962e675029478c02c3ce63df0ec9fa1327d15db96afe5a059637d956b92c1c8debaf9797c124e1a1397db2779fe930f09917f07a4e698d255b39f7f9e560c98
SSDEEP 24576:HAhGLJIFoiwtA5l7S53ayxknw4FYnshx8OfVe247:HAMyFoiq5Fx4x8EVep
TLSH
T1D435AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 23b61caa450470dd2396c790024031aa1787ebff5792a980ae53e6a40671e999
MD5 1ec9cc3e00020f9d3b78178b58c4ccad
SHA1 0eafc4e22d5b3bcce0fdb0a83f8123a46aae34b0
SHA512 7f872737e2c34656bf03b70ac91eee6f9285262b8b0236262279239aa512498f651ff71d43bee50c3fde3e1d46b41a8862cec368956a3a2f0307cde3fec79151
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+CW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:6wuoOWryxknw4FYnshx8OfVe247
TLSH
T1F085F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 aab43d914bd602c335c7eb7e016d3b9916646ef8ff8fd1d4e465c265dea17550
MD5 6e2804b3827f705aaf9ff490d55939ad
SHA1 b7f7b6a58ff86c1545abdc8d3be49f2e5474adb0
SHA512 529d0c4fed934618574ee2cc815715b0f6154495f016f69e1723f1ab24a49495606f1c201ecad117684e35253105cb6f9c0d478173491d5860305e4c6e3f5205
SSDEEP 12288:sBZ1IyX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Zuoyxknw4FYnshx8OfVe247
TLSH
T1FA75126C33E860F1E1A7113A89F15205E77274A2677183CF4664A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9ddcd22dcf9360b7efbb6879d5c32e206b2778194cb12078f75b3612db381b7d
MD5 12199ec801d93ee9ddecd6e6a9129722
SHA1 a249158cebc290b7263b57b21d299b08d9373b90
SHA512 650d853322cbc9308870f1386d1a7a3539668a7a1ce3fe78d193e4ba5431413725cdb1323a4ca527796726bf33f05c8deec94898450fe5cdda31aba0bc50110b
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:gQRQyi36YOcPQLvw2gAf+PN3Qix8EVy
TLSH
T1E6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c6f4aef6abc4c10708d64a6042ac73f5812a776016d1887639f942450625bc91
MD5 0ecb1b22e408682c9cacb46bce804f2a
SHA1 8663315db7fe3bb0f2b3f1144647b550aee68ae2
SHA512 cea123679e52a5cdf7b528a89f2b8896b3106ec75c56c9b960d9cd71c10ce879b6c7f5f49a8e1ff2e88da1588316ca3f1076f9850c15f84f2db8cbb5150c7908
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:yQRQyi36YOcPQLvw2gAf+PN3Qix8EVy
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 07fae48328833d952051f0887f96950b690e47709dbf90af9e44e06f2a4255c6
MD5 9fd16ca1f42b0201622a5e6d1c48b774
SHA1 1edc2f22f7cc4222e7e44e4fe03a5f9d7b4f33af
SHA512 75eadac6d7b9f4cfaee911ad70d9866a943ee6028ea8f1b9f824702d038dc8d92be85553ccc309b629e6a308024b9d51c746c0437c873867b3ec315a2b824bb6
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL04yxknw4FYnshx8Z:G68Qg55nhheWu7PNU3/Cx4x8EVep
TLSH
T1EFB55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 977fe4d9fff20ffe40ea6317599e0d98770b19a75fc7ffc0d15abd650a9aa3aa
MD5 648e42a87e3b9768f51bd16dfd889117
SHA1 b44f8bb7b5967cafc517af07231aace4962548ef
SHA512 7976a3c119d9f1c8adcf42eeec36dbed5f766dca2602b6c02a72562258c5dc6c934f50f0e33a0d5c04d761358c3e5476b8836264c6add2159849c7fd55282ddd
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:Ry5112gYy5azzVvL69nLKnhZXix8EVy
TLSH
T11B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5f7b34d8b8f3525aecaf43a16c028de9502aa471c5ebaf6bddc57facbb745ba7
MD5 e70b822da74d447e4e88ac96652ba97a
SHA1 9418dd9fbbcd2eceb7d9e9f008a6b60b8264dbdb
SHA512 71fa9846e7a5ec378fe527223a707b8500ca14fe8d5600088cf2398f67a9d39fe852960d21285dd5f6780ad00627382e0e53c6070302aa6370b00fc2e3a857c9
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glox4x8EVep:qu6JmVxd2doix8EVy
TLSH
T1E8D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e3396b6a0f6dbce65d4487c78df821765db5ea532595bc88eca6ffc9c7b2a42c
MD5 5e9b9cd73d89a88b690be8a09a149b0f
SHA1 308ea68b486feca8fd724282e10bd44dd84c4241
SHA512 4f209295eb1e69f7b0bfe7888523b307190124e26a6d0553cce68c4e4f1082c5ed33523804d763bace9ae96f60d5963a51af5a9010bec0e5e97cd336ac22f188
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4x0x4x8EVep:2mifPbRVix8EVy
TLSH
T1FBB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fc1327e4bf590b47404227356cf7cbe5d236a98562814e8b767d54da6309164e
MD5 f2f4dcee10a064dbb4ab250ec860f368
SHA1 d8041c497b7b67f9de2c7cda211688e4bf6bae4c
SHA512 bddac383e1f2153aa6383947edf97435fce4a9b15fae63a83ad6764e162d0986c995d8242781b1817357295c39dc323ae3cb6ee480eeb08ef06104450c43a128
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqLx4x8EVep:L5dKTi61Lix8EVy
TLSH
T1EEC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 28c9d3e7030e949b75da5088d5f7164b07ff43d971319045956ab92beddd267a
MD5 6f72c6cf9d2db5035bd4368031403332
SHA1 219efe89128c70b6a0d0070151b78f411da37925
SHA512 99a3939b61bc304a6cba13cf6ce757662521a9e86c60291897a8eb9cc7c2a4f0248d3f10a6c59280cb9aa52625b6f25487fe3d894b143b61feea04382590c40c
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wYx4x8EVep:sX2iyphhix8EVy
TLSH
T1AF95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 71f01f7621a4157c3b452b34fab9e8834bd2eb48c77358766e985fd231077e3a
MD5 490c46383e1a0d675f52e7391edb40a0
SHA1 f42cd16e6daf07f8cfb57478a91a2ce55546cd95
SHA512 a587a940c2531a149fdb2847d7cbebac0314a03604de13e4d7cf1aa9f0dfb3a1bf8ea23a41826beb8eaf5349ee879faaae802a564cd09c3dbedbe07630343633
SSDEEP 12288:k0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:k0yxknw4FYnshx8OfVe247
TLSH
T1D875237CBADE95E2F50D11734B717362660AB5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 c89179e524c50091585c2502467f1a8e7a150678ac2023e872d36d0120d17965
MD5 3a8182debe8c19c4b63e9f4a422089b3
SHA1 fa58714e48fcc43146dd1a490cf477153d6fb86c
SHA512 33857aa28754b7cdaf2e9c6bb19e779132ab00b4fb3ead9526a846dbee29aa91b5de9d683d555cb373527367abdfb1cb6b4a6a7d90db07e742746d2c07bdbc30
SSDEEP 12288:wz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wzyxknw4FYnshx8OfVe247
TLSH
T1A475237CBADE95E2E50D10734B7173626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 7229b0a447c8d013d2737a06556a2a64e647d54d606ac777f6b90933309bcab6
MD5 050b90dde847a4335e00aec57876f756
SHA1 4a40966a9a4692d02f0cfefbde91266a0eecd93b
SHA512 72102128bf992d888ad30cb5da1ded7b5eb2aa39b07b5cf9c78834f86c0d076ec431767d19c5547977c1fa68656e6c7567d4f35e9e9b8e49cbd50f4a9bfe328a
SSDEEP 12288:kJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kJyxknw4FYnshx8OfVe247
TLSH
T1FA75237CBBDE95D2E54D10734B7263626509B5A6EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 8e438725e7696e84f2fcd1af80d8e8ce1b20c96d0ae258d682d3770a864a3e56
MD5 a394d647e56081e6b0bb89b152c57222
SHA1 206d6117fe09665362fe4f858e171e4662a55768
SHA512 e688bd7109a8f9677f64a40a57d1c92072717373dbeda056d5d03c8a93ca1af81576c53cdce1f8f069b339f6f7954b37991763e80c1777d38eee1f0359a05939
SSDEEP 12288:mV6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fyxknw4FYnshx8OfVe247
TLSH
T17D75236C77EE50D1E85A51738A726222B365B8E5E731C35FCB64700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 5a1996a9900a107c4f8f4a9a4680f7dc9dee5e439a40ec3ea309438b5cb7e9d5
MD5 f403f8e1ccfd9c09e20b1711d0523646
SHA1 ba63dca84f89ce0d37e67cd98f740cafd5a64205
SHA512 2fb4acf91b681dc0f8efe3a94bb1c2353e39a7ea79577e6f064f97d684a283ebc6bc9d911c1c0ecad3c917656d0891f7198073d63914acd77a136afd0242d5d5
SSDEEP 12288:Li+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Liyxknw4FYnshx8OfVe247
TLSH
T1A475237CBADF95D2F54D10734B7263626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 13b4fcb73c66831fb97fa1d71821f052a4a1c7030e0f4323d2886a0ad9aac007
MD5 ebf3ac4277fbfe094fa97a7714049e9c
SHA1 d3d73a7b901adf2662f0e01227994e0c4247dd0d
SHA512 44a1f7737df89770ef8a0749e636ac4ede5f877a5537fd99d41ed58a6a29954175956d6c89a64e01f0d616d8ac07b16fa2e276f8e73ff757d0cb930331f00e0f
SSDEEP 12288:Qf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Qfyxknw4FYnshx8OfVe247
TLSH
T10A75237CBBDE95E2E50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 4ba05443421cd5f408c4d12d47cc3233a1f17d2288780d081caf90cf9a687abb
MD5 0f1333d767660a4dd41aa7ce5bb2d370
SHA1 a61f90b134810d6a7c4c3393b5cdc564a2c451ee
SHA512 33d1d934ae499d7495ec85327c209e6658eb958d8a2d468e8044f91f1e6584b6614e73531df6aa2725fd8433dca7514b13861504ac588ce43568a61db7c0d7df
SSDEEP 12288:I7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:I7yxknw4FYnshx8OfVe247
TLSH
T17F75237CBBDA95E2E50D10734B7173626609B5A5EAB5821BCB7DF00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 6e12b872f829490060f57e3901bf36bec8421f4153ddf17990031be0f16fcb69
MD5 259e07c1a5468033f4712f066b01ac43
SHA1 2dd8527bbbc85a2457d91999d9e6793aeaba39dd
SHA512 73691dd2be3246fba9928043162660dfdb0f212af6732d5a4605a6e56c031c89e065002fe5e6c1d632d80452f36dc7d8ba030c80d7347df001b015a3394bd26b
SSDEEP 12288:BiZwb6zzFEoS2cPvyT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EZMSzFVSOTyxknw4FYnshx8OfVe247
TLSH
T12A8501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3b08a2ae0a86c6c3c2018c04c89a783d20e9debc39c7111defc3f6d69c14606e
MD5 8792b0fce2dd7416b17764aa5dcaa0e7
SHA1 728879dab7376a83eaa87c837a587f0c1b769090
SHA512 70c9149ae0a323d6a41353dce80399dde5efb35e2464f643329919bb7f7ec4a44f3648eed75b28209472f05fc26750ec6266991fe080f1a23289b85790b513e5
SSDEEP 12288:nY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nYyxknw4FYnshx8OfVe247
TLSH
T14075237CBADEA5D2F54D10734B7163626609B5A5FA72811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 56a1c8921184310c3d3f7c3324836482fb0e9de59a9f1a00eb0c0cea8d5236f3
MD5 2647e568b901dc6ba70df07ccc5c15ad
SHA1 055dac29cdb6312afbef747dd0aacc407a6b666c
SHA512 a11c6ddc997b8cfa91e39c4e0649efe64f33f8b68835a7179b3d213b775e2968c807ff9a51a47bcd66c13c6196129dee38b9e75fd02061525f74d357a2b1e198
SSDEEP 12288:Ps+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Psyxknw4FYnshx8OfVe247
TLSH
T11875237CBADE95D2E50D10734B7173666609B5A5FA72821BCB7DB00EF1F0C60A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 e157a2ad14e997cdb0fda8aa104963622a255a21c81cb3da69a6e7d48e3cbd17
MD5 9b61eb37398a241ec67852e88de1b1ec
SHA1 535b9751645c22306cf59d8413ad81f2d6c4249b
SHA512 56428590e375dba87ef1e269adc7d252c9ca585a4637863190ef2945960fe8fb71acf1a059fbddc09755fa3b1bdad24f8779b0600ba28e7385ce1e2f4b1f7b43
SSDEEP 12288:uyPz5L8X+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zzyXyxknw4FYnshx8OfVe247
TLSH
T15085121B73E530F5E12A4236C9621612F772B872473086AF87A4537E6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 401b3121657afaf0e8c7d8c829d16471f155efb6c8ac5c7b5c66448fc27c5e7f
MD5 a976591109e98442dbc7a9ab9421022b
SHA1 881518ee4665b9bde98e4891e35cc3ac42e43cfc
SHA512 aa3d1c504738300e84ffefdebf63396342ea54e07476fd1f36ddefef3d3e7e6446b44a64b4492dbf512c9a931cf6dc6d8d5ca0cab8cf11f877acc9dc684ba121
SSDEEP 12288:xY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xYyxknw4FYnshx8OfVe247
TLSH
T1F575237CBADEA4D2F54D10734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 531faeb3cc733614251668b3d55355e9697037ddbda93c9ae9494c1f2cd1dd79
MD5 f33de11c519bc7f139319799eed91eea
SHA1 843ed8bb711dbb4eb850ba698f342f470642bef4
SHA512 325614e7431eb8158c93ecd07b560d8a479723b939f112173d9d965720f398f32fc516d37b0645c7ee8bc0493ba9c8edc8e7d1405d0d4761ed5b059de9e64d6f
SSDEEP 12288:QY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QYyxknw4FYnshx8OfVe247
TLSH
T11575237CBBDEA4D2F54D10734B7173666609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 6475a79c752b5094782363e0e3c07d22b96d4caefc9a72f22d10bda1387fde2b
MD5 8a749851635d229adb316bff26e58a93
SHA1 efafa4c2e5836798f4cf7f5c751d3f7bb30fbcbc
SHA512 940b9b188c5c528f912fbd3a9e55c67556e8ca051bc936b6c1410f643079bb55985c8208e23d865161ee4ca683adc73144c4cdd9d012c058e8f81d69b8c499d2
SSDEEP 24576:Yfwvok9RX6wkyAIcyxknw4FYnshx8OfVe247:AMnYI3x4x8EVep
TLSH
T11D95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a31cbb42656b09aa0e8f0a5ef7ba3a534ecdc9041e2620e03e28f31e936f2ccf
MD5 c9d9c4a6f85581a4347494b4b247b3b5
SHA1 0d9b75160826b6c28a36ee221bd75dc1fd141701
SHA512 8bb1bc9ac75f52a38f65995fcf6b443cc28c382efe2c62b9168794143cf2211fd4d9b86ed99e12cfde451c4c66346f3d4dfc4e78c1119d215b64441d15a42c29
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04x4x8EVep:NySzPwix8EVy
TLSH
T151066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8f618f79d298c643ba604f076792ead5d0b32fbf2c565819782a7a8d0c859168
MD5 56a7cf0fe6c39421b08234752edf65f5
SHA1 3513faeb1bb5ec3fc104c5d1a8b76a4fdb5c85f6
SHA512 e157530da81f6e4ba976ae334f4090af1ed84a45eda1439ecc19b19edaf2f95f39b843faf8cc15fc9a11cf07df3e738d04d4edfa0ad8fe0043b351adffa590d3
SSDEEP 24576:s47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYDyxknw4FYnshx8OfVe247:s47JUQj1irIhCnDHUPfF/ox4x8EVep
TLSH
T17D65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d79248c7480af7ec4e75b936b541e8fd41878c2775a4ae76631d59a9a84fdd06
MD5 47b606410600cd8043ce10a50ca1fd76
SHA1 c13ddc912bd844117e6762ef291354f14665f70c
SHA512 2ff453dfaaf6897c9347bc2eeed7f5ad1af7242c5d3307096d2480d085805707697052a95c159d4c5ea9602a59f5a54cefead16012c187e23f8220d986583d38
SSDEEP 12288:hNsfo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:moyxknw4FYnshx8OfVe247
TLSH
T19B75F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 29cad6953b241cd22cac92806c7912e0b9ed06bad8814dad05ef62709c6bd852
MD5 17b8235b74270f46a3248da5a6cd36cc
SHA1 e70e40ef4fc1b1f262da63a0ea46daefd1976df3
SHA512 5003214e8e907a9595d80030176f3c17863fe3ade04357b083b2ab5cb7b229db74966a8b5316a2b1e6e227b3d9f43c780c640ce1f7db09159d305367ac0f328a
SSDEEP 12288:FMEyRgU3fHjMdiRKAyB9p9WqdrUbd4tP2+kwiPZPvE:uDWUPDGa9O9pFxGqP2/wiBHE
TLSH
T15F352851766AD75FC6AD40321E33D2CCAB707D01EE45AF0772C8873FC576668BAA1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e03264bfa02dcc1af228fbba2f7cc41426f52a6f30dea0a97f4b81da1cc69c65
MD5 4cc1303c027fb5f6aadce2af0e9f4d6d
SHA1 3f550b43ddf660883e96c15d3e34d4a38a747765
SHA512 fe812b4ec7445c0736a1d3c5881c3487d407dec6ffea6093cf6459e9d2d30e9d615d0387d660e385648f478be4ad4194d9d41cb6fa8a7b3cc3f00f02455701a0
SSDEEP 6144:t3Ntau+vFI/L67dAsX6VMytMxWfT4wwao69AMytMx4ANs+agDoG:tCvGcZX65QG
TLSH
T19A65E9816137A38FC5F76072072A5F4CA7A4EC06B7095F2673C8453AD82BB65A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 508449ac64f97392a46226cc09c2c96818ca58c769c357c76fd87ec582ae53ff
MD5 cd11019527d5b5df5d32a956b8ee4982
SHA1 12e460b1f953bf627e5840bb41f9937d3b01b135
SHA512 b30024a71fc75c8601c8b2f9a82a64eaf9f46870c2e90d4fb0f30df20031066babf79238ef9a1a146d4ee416b0ae599d576c0e731eacd112a0e2d4b3c596f689
TLSH
T158D0121233414974C010293310C2724C0500C50F440B8300582D991D5F0D4500913441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 adc584883b4da91fd4257398ed02f9525fc37ab215c50a0edb42304d122d2f01
MD5 822252951c2be78ca0c082b2179e415f
SHA1 acfa98ccce7d25816100d61d9ef90f88c170151c
SHA512 d5660e6406bf22c0aaaaf5e84863e17b5dae248135b7b92b65016a4499fe1fd9b64226ae1f1c19354c210ea1ff17f54c64499a0ca5046693e26a217f56f33e8e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9a2e.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a9a2e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 72b4498a6c526bdbae3f94fee06b0c922eabed08076601ed48f2c6997fddb716
MD5 cb552620ae292a5f54da7f2c94a0c2c2
SHA1 a65682b92c0a3a5a51deb6f9f6cd849e316abe6b
SHA512 5beaa9121b6e17e2df8ed9ce499ee371c56688aefd8b23fa050ad2550d757ad39054a729c4708a8806972d2f2ae7904f8b68d28731edf2a0682b93649a3c2e6e
SSDEEP 96:sto/dxRmVEjzGmb9XkQo5h16Zivs7/x+6Mhmuecmje1K+glms28XM1C7K:stM9mypobvsV+FijTHmsG6K
TLSH
T12FD186026E24687B8CCBF559BA297A43D3F5507270E11E98EBFC452C08EB6DD531780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 cb87d8f914b3519aa13c47fab42d95eaa56d57fa3c0865bea03f89e8b02b7361
MD5 ebd6c948b1d7510328a7dc353a4089ab
SHA1 e597bf81d2517a8753be0f2c263ddd95f78342bc
SHA512 8c7ff7416c2bf0c301f6d1b39203b9bd77a629726038b9c2ae91f71c3cfd53a1185d4a0cc4b412070e1af9b1509f5c0ee76b3cfae067f59120a4ed5fa496f551
SSDEEP 96:sto/dxRmVEjcmb9XkQo5h16Zivs7/x+6Mhmuecmje1K+gl528XM1C7K:stM9mkpobvsV+FijTH5G6K
TLSH
T16DC165026E28687B4CCBF519BA257A43E2F9607270D11D98EBF8852C0CEB5DD631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c460.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe59c460.TMP
Size 5KB
SHA256 82f297d28162f41c2b2c68e9db7ee8c0dfc977791f5f4dc201c97c7e95bfca46
MD5 c2dae589f82810e2dd15bbc0e7e5efeb
SHA1 bd69e570f4745a75fcd5516653f6fcfdbb58fd6d
SHA512 1bd3f9d357c345c1c27e8cbe1c3d1d987743fcbe945b6146c9ab7145bdacaed8aa07cf1e2476757f875eef6f270eae58d31cf431fc7df86c5f824b54276d752b
SSDEEP 96:ro/dKRmVEjcmb9Xkqdo616ZZs7/x+6Mhmuecmje1K+gl528XM1C7K:rM4mkvojsV+FijTH5G6K
TLSH
T1B7C196026E28687B4CCAF108BA397A43D3F9507275D51D98EBF8862C0CEB5CD631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 4708abb9b1b8b48cc6c8aa43b5895d48b6f258494312be96e725ff358cb2ca75
MD5 9d64365214bc57cf52a7b095ee37a40f
SHA1 f06c5498206e2453187ada1393dc7e5260126901
SHA512 04bf9da6ace197dfa33597bf3d9436c0c7be6102797fc1a498846149238e6bd8efa6946d36fac7bc073f5ed008e7475e271a378e9900e8f46b727f176b628362
SSDEEP 384:u+aQikB+z/xvxjg/qhEb3NBSNuJQFEzdTAm9zH:5/UxvxjgC+bAcQ2ZsmFH
TLSH
T16C72AF2BA569BD23A9F7F905794D1B4FCBB884B251826EB44EED9F0D06C73950302817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 2c53aac2b7c5240613ab34d76e18059dda6d36f04785ab56e31fece0b8fc70c4
MD5 cb31aa00b836bb94823118c547e24848
SHA1 32c2fed9535f10f998e18f10b38ccf7fbe937a16
SHA512 45c358c2e87f99f025ce9ce1c54408f964fcea7663295b29abe3243f387ee4a912be46e0d6d15e68138351eb5c5ea284f84d8b9acc7248d65cfbc41d3ce94af0
TLSH
T111518433B810AA7789E76649794F3F63CF7980A6AA221F509BDD0B1C05E719D5341C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 3a83e3465db7ddbda6f09cfc7293dc92147047d1986866bfb900fc0c13b62e6f
MD5 648f3b13c4f00074fd64dd2b153c8c48
SHA1 47bc10adb23fefc109c3493567f7e995509f431b
SHA512 c3533d581747e91211c502ed757cbb632ad92daa52e0f13eaadf542346305f446b5f529b42d491eac936b54880bc4622aa5b7bee7932617c79a0eb16c504a17b
TLSH
T1A2717436B970A9378DF7E949B84A3F17ABA44077A5923F95CAEC0F0C05D728D1342827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 c8a5a048aca8a1a4f9894b1837e1742d1f37b02bfbaefb9b7cacc510b06b246b
MD5 ad481f93f121657399cd5a2a423e744c
SHA1 959ca2f5532513cccd6706f46e4efa94e5b00a4f
SHA512 af24b3f1733c995307957ac3c0923902abd887d697198782e997c89fe6aa7d88126c373bfdb911c779f2523beacd124c3b2d26769960d2e0b47136ebf2d64b86
TLSH
T1C1617336B920A9378DF7AA45B88A3B16ABA54077E5913F94CAEC0E0C05D72881341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5972d5.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe5972d5.TMP
Size 1KB
SHA256 813ddcc7097555a53585721c8311497275de6178106a56703c49cab1c671a1c2
MD5 8ba0ef7ecfdaf264be92cc4e4afdfee1
SHA1 f72a9a18e713c1ec8a1f781b43f83dc87902caba
SHA512 2b05b384ef854602c7bd917dbe63fb9edc183e76d039d132b4059e4ea3defb53c83fa1ec27e2adb72160255bf216872e6d3d2c4bb59d896a317747b07c268012
TLSH
T1C12165B2F4616B729CD6728B705F3F979FA140BB51124F409BCE8A1C46F208DD616837
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 ccd599f7722193861bb9b35393f6887f6a7aca52e124dc64e4bc9e3736c507bd
MD5 263bf2c2de4bcdad3293f1b4236b2673
SHA1 3a070b65484980ea32c86964e25c69639d4ee613
SHA512 bb05e690caa8c60792cc1b15ba23a09cf3704bcbe7213f52de1042cec354349cf25d12deb50fc991dd8bc32904ef16939234427e8c6467d777072935f965f542
SSDEEP 12288:BM7Q+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aQyxknw4FYnshx8OfVe247
TLSH
T16875237CA7DE9992F86D11730676A221360AB5B49B70C1DBD728B14EE0B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ecb4e97fd69d34e76e778e69f8d62c9901ab4dc2dd5491d0686efa11f4bb497
MD5 135eda8901035d7064a229e2a52e45eb
SHA1 fb646dabf88e8cb654fe605f7702ac39fb29b489
SHA512 45a4c74056974e110e036f3ad118f01cfbadd670c637e44e335be8d5b9e00c6f022d155969184271ee1bc48274ba3cfb153c232c2c04d1d477cd50f5557331ee
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bY2yxknw4FYnshx8OfVe247:0gb4mBIBhGFGx4x8EVep
TLSH
T1B365AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 1890564fbbe94598786e8fce5ee8b9758fd47d7530d98ca084e6626a78dca3a3
MD5 9e02177c79bb770240fd302314becc2a
SHA1 f282bb74d4c26dfaeb806a1f21177bf3f77b98d7
SHA512 18bf49eea81bdd344d48096101010301109d2a77c539f88d9bcc85c5af78ba241e7c4b035c86c0a680ecd421bda129d0ea9f96a967d7674cc6b1f6e923a72b61
SSDEEP 24576:QG88u8FpJqH1bzria7/mTyxknw4FYnshx8OfVe247:D7ZFPqVea7/xx4x8EVep
TLSH
T1C2A5F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77a099384c9729a6b00e8142f1f7b28cb74325ce8dca2491d4ca924eacf0fa92
MD5 412984395cba65ed45c42f841bc19937
SHA1 bb17329a431c76b0019fe3a782f4ff4179506548
SHA512 3bf8a0bd5f40dea71111c730a25792729e3eb832dd8b71e95d13f921c8e8e64ad53b685092ad07846e291fba7eac135348d791d1dd22c6732d76a294e90b0a17
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKx4x8EVep:wG05lO43b/ix8EVy
TLSH
T1E1D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 03b9dad5eb9cd59232146049cdc3e2070a523eade28f32b64e50624118029e4f
MD5 3d72bebd5c000407e7398c06e5fdf446
SHA1 3960191d689a7d4b4e7e2ab6f278eb0efeb44ba0
SHA512 56aca7c905f96319d17aa576981f7c5f1738418df62455583dd75dae745cb1b17f92ce5299ac6c5f4631d6e8ef20715da944c78c75b6f6b3524e96e2b6633a31
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnNyxknw4FYnshx8OfVe247:ea5POZ3+Jt2pasx2+mCx4x8EVep
TLSH
T15D65AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 76340ec530638e67e890ce25ea22f217ff4c9df3a19f8fe4cfcd453cfd019963
MD5 d391691c8d5dcad8ce4403bf61b825c6
SHA1 4c8b45124122e7cdfebc0edaa10c2a9c493f80d6
SHA512 b0d996efca164fbe786759dbac41835ebd68d64d3178a05872a8566ee0f8d12aaba4a422917b416253a9a23bb409986ada6af5560c041159de6d57ed10a439b9
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkLyxknw4FYnshx8OfVe247:1Nc/zEOVHFRx4x8EVep
TLSH
T1C0857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d21574d39fcecfda195cede54635b50679fdb8ae5ccda7bbfd6e9439be274d28
MD5 919d5c561835e727b6a8076fd7b47307
SHA1 50c35c722d86772b08971eb374dde9c9f3212d86
SHA512 3bed8201330fdc0d59e2a691bc55e61b5e5dff9ff56f740c72108fd1fa941b5d9beb13dbab452f08cf3fbe382e6c8f788568a5b4b453133fff9880b4c644252a
SSDEEP 24576:88kNvNnaFeYhJNtmZBmByxknw4FYnshx8OfVe247:88MwBtOmEx4x8EVep
TLSH
T13F55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f39f2f4bc6b89987e02b77491aa2bf8dd84379b47a5d2e0ccfc0289910a92e0f
MD5 1c162f3cb9e9e540ec115033fccc4e34
SHA1 1a7e621807dde83a2f4786c40d151b7aa0ed1321
SHA512 43ed106556783f18ab632569ca9669d95164fd05dd9fc0a042eb2eb6c94eb1c9d68ff29a1a92b64353938012cf8811604bdaea94c696f43429331f7d611b5560
SSDEEP 12288:rHvUrBFrEjwaQP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rPUr+NQPyxknw4FYnshx8OfVe247
TLSH
T15785F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 c811f9a40d6df5f88db6a7f07f6924ed9dafdc23ae0cf4b22d39ab01537806e7
MD5 cb2b5b40acb33a4ee853b88c484ac35b
SHA1 cec6a2aa1bcfb078fef76baccd8a0190d2012c4b
SHA512 a5b10fcc5578f4d4dc34f1f31dad188ae62ddab4a5abac5b147e1c66657927b22a4c6d71048cad01c6243657672a9adcf3ff4f68f39eb536e72a8726380692b7
SSDEEP 24576:mD3FHshBIYQgAUyxknw4FYnshx8OfVe247:mDVHeBIAAvx4x8EVep
TLSH
T15995E17DE69C04E4E57AC1BC8A638606E77138A9033256CB02D4D1BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-267-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/568-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/568-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/568-16-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/568-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1252-142-0x00007FFF0E770000-0x00007FFF0E771000-memory.dmp

Download

memory/1348-729-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/1348-733-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/1348-724-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/1348-722-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/1348-728-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/1348-730-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/1348-732-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/1348-731-0x000001F184600000-0x000001F184601000-memory.dmp

Download

memory/2180-58-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/2180-394-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/2180-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2180-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2780-306-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2780-294-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2780-295-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2780-301-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2780-308-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2992-269-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2992-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2992-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2992-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3092-448-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/3092-71-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3092-79-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/3092-78-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3216-290-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3216-284-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3216-492-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/3216-283-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/4072-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4072-38-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/4072-51-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/4072-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4072-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4588-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4588-69-0x0000000140000000-0x0000000140400000-memory.dmp

Download

memory/4588-8-0x0000000140000000-0x0000000140400000-memory.dmp

Download

memory/4588-6-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4912-90-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/4912-95-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/4912-466-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/4912-89-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/5440-119-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5440-140-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5440-113-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5440-548-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5440-546-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5440-478-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5852-317-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5852-311-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5852-508-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5852-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5880-197-0x00007FFF0E770000-0x00007FFF0E771000-memory.dmp

Download

memory/5920-277-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5920-479-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5920-502-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5920-504-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5920-270-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5920-271-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5936-579-0x00007FFF0EB10000-0x00007FFF0EB11000-memory.dmp

Download

memory/5936-580-0x00007FFF0E910000-0x00007FFF0E911000-memory.dmp

Download