395ba3066b581d9c82ab82496d83e19cae8be5d720995578bab9a7935c15110e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260815-cwccwaxcjf
SHA256 395ba3066b581d9c82ab82496d83e19cae8be5d720995578bab9a7935c15110e
MD5 6e6abdf8ff584a15e714d843eac42288
SHA1 32689a9d4c08c843b493cb2bbc182a3ac63de0d7
SHA512 ec0d06970f9554ced568a301e567a33977507724aac3d443d5fa625bf46566ab2457003b852ff46966e5623fca8913ee5c3db23593e99ed77eaa574cc194ad4c
SSDEEP 24576:f0/C6CdH79Us2PtOsyJpj6LaRFdGJm0Q3WKVSwdr13Ek0VA:f0/qswx6KFdi2Ga9x3Ek0V
TLSH
T1AE45D017B7A002F9E0B7D179CA558A71FAB2BC49072097CB03E456962F277A15F3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3348	elevation_service.exe
4592	elevation_service.exe
4740	maintenanceservice.exe
5736	OSE.EXE
5076	PerceptionSimulationService.exe
5036	perfhost.exe
4164	ReFsDedupSvc.exe
2240	SensorDataService.exe
2184	ssh-agent.exe
1888	AgentService.exe
2232	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c3d5a9fd24febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000696c029c5d2cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a793b555d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000780af9555d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000281397555d2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000559bf1555d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c49df2565d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3348	elevation_service.exe
3348	elevation_service.exe
3348	elevation_service.exe
3348	elevation_service.exe
3348	elevation_service.exe
3348	elevation_service.exe
3348	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	4164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4164	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1888	AgentService.exe
Token: 33	2232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2232	SearchIndexer.exe
Token: SeDebugPrivilege	5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5584	2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3348	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1456	2232	SearchIndexer.exe	101
PID 2232 wrote to memory of 5692	2232	SearchIndexer.exe	102
PID 2232 wrote to memory of 704	2232	SearchIndexer.exe	103
PID 2232 wrote to memory of 4280	2232	SearchIndexer.exe	104
PID 2232 wrote to memory of 2428	2232	SearchIndexer.exe	106
PID 2232 wrote to memory of 5412	2232	SearchIndexer.exe	107
PID 2232 wrote to memory of 3260	2232	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_6e6abdf8ff584a15e714d843eac42288_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f07ffadbf9022e862953340dda0b12711e67fe54a68e26ddfcc5c19960c7e684
MD5 c2c69975684e292a6e1fc6fc0e50b5f4
SHA1 7e213c35c5ef00aa45a66c4ac7fecddc5f8ef616
SHA512 2216819710bd935f97770869149a1b44ef9748f5e5483f58ff71c238acafe4c61c13d269086536799a2eb190ce229eabe315a7089ddc8b3f90111c94e3b66cdd
SSDEEP 49152:3b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn46KFdi2Ga9x3Ek0V:l3q6sjBNHFdi4VEk0V
TLSH
T189D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4075f4e5108244f6ce004e07c55534d5a6f05623afe8980ea87e0e2e1d7b0d06
MD5 997f86dc1579e21aa8d8a5d05a90295a
SHA1 b7c3b15c83789ac0a5568bf951be471bdaf44456
SHA512 322e6f4a6b2c7d4bec50f08456809749cc606b34c51f173c05d66c180fe6909fd68b98606093d33a1e7ac203cf0a3b217484d3e93560a38cc4a7600435ebfec2
SSDEEP 24576:4XYfDtczA56LaRFdGJm0Q3WKVSwdr13Ek0VA:vtcu6KFdi2Ga9x3Ek0V
TLSH
T116650229779409F9ED678278CCA2C511EA337C944760E78B03E49A660F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ffa065db65e9ebb122a927970f43b20f8b8df0f435e7f3a13826ae17eaa0e70c
MD5 c832b3768e7d8d4774dd57d8965e5b9c
SHA1 e8ce990c65959fa466c6fb434104fc77c0fc442b
SHA512 5196c1259de9d0e50d5eae181c3194d52c433737f3355a0f3fc59cb5087b676c2679268784a61f9f684c7e9048aef626240f488b23f52937c304c8a5400d2645
SSDEEP 24576:g0Le5ji0hmxxrMg6LaRFdGJm0Q3WKVSwdr13Ek0VA:gPji0Aj76KFdi2Ga9x3Ek0V
TLSH
T1B1859E16F6748335D073C0B9C5D2A69AED7230851B308ACB4286D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 da3f834fd857bcfacab07b5d6b0c76d8d5abddefebf5095f5e67ab7672578bd8
MD5 05b1fb7573ff0b8d33b99dcfa88338cf
SHA1 c60910a9dc1c81605b100c2c36afb5122072786e
SHA512 0dd0dc1b7fb02ea364961248cdbe37e1c70f0d466018ab6a0eb6245baa4165458d16c87c66ffada476d0e3573ace708649ae89d2bcf7d79a6b696f94873e3bda
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWn6q8wyue6LaRFdGJm0Q3WKVSwdr13Ek0VA:1/ezSC6vUzPveHjyX6KFdi2Ga9x3Ek0V
TLSH
T157755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7fc1ad29e6449182cdba77c0ad06a1ee41808fc0b37f2fe9620c2ef802cb41d7
MD5 231f564621abaa7a543bbe028ea59616
SHA1 ef0cd20f0d9683b00a0d58871515c21267b862eb
SHA512 28033d23f3ef4c1c0bd5412e81e8fd426ac363cdc679c528618aff696b037b039c2e9766842807b6d24a99c57920ade553dbebb7abf9db9331370a46be8cbe60
SSDEEP 24576:BVbqPb88hv/l+Y96LaRFdGJm0Q3WKVSwdr13Ek0VA:BVO88hXl+26KFdi2Ga9x3Ek0V
TLSH
T172559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C2F67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 14e4a737b161c05f20804de7d5e3d8859f939b3c7e2dc4b0f530d2b151a9422e
MD5 e01242bbc82182d7490b233b7f3223e1
SHA1 c37047a923074d06ba1fa13cb01bfd003c78d97f
SHA512 8990720cc5af4a6154e47518fabb912c2e9bebd107c7099fd0524f94a88130e529cac561924e7d4abfc333763eedec33eeebde98d581574aa56ce0941bef0566
SSDEEP 12288:1LU6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:1LU6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T146452313BA041914E3AE42F1CDD987715A16BFE82C48524A4EA6378A473CFF5EC58BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1e117a7d31fcb0b36a2358fc7e17e2b021cfaa96e6052cf83de43a1ec0a1af65
MD5 6db0399e26b7234e5539ea7c64521939
SHA1 66f663447b725763df28c9fd6642c37b7c4e3588
SHA512 6428a54426ea7bcea561013fbc46c3fd7c86e13e602690f33a6adbe4d05d27c145e7e0b780967712600b92694f20b65158be6c38fc44eed7b1f80413e3d2ebaf
SSDEEP 12288:aeBNUbTVO86Ul6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:aJIUl6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T10965CF3BEE28FCD2C27E8DB95A918700A77278704F51A3CBD165830E9E275E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c24fe4ef5bfdd95f5ed85d6e674aa2498f2c7efb797de089098d7f5804e72446
MD5 3d92ffbe376e97cea5018f41c43ae2ec
SHA1 c598485d77b3201d7ec4f05047aa00b08394575c
SHA512 3e168187adbb637472894caf7f42f39ec6c4152c6603961766c849a353c81ee4178b8bd7b0c14122382a29260967d6705174fc65193fa501784f6cddc29b8a30
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THU:+QvGAdlCEL8c/DRNw5COHFdi4VEk0V
TLSH
T11A267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f29e9bebe5df2c11638014c7727d8c8ae87156b67a1ec33ff6878b25d37fb3aa
MD5 3928425ff11dd7e2a1821a57e327eef8
SHA1 b9477b7e4e09aefae4a468c4879c358d50e74f5b
SHA512 2920de9586cb37ee46768c81953204c48cfc36f894464ec3cf80ad52861533fc34883b6aaa3feb43732eb9767f2dc7d79c705a867e05cde2262720fb005e107e
SSDEEP 24576:a0ewsAjr6LaRFdGJm0Q3WKVSwdr13Ek0VA:7ljr6KFdi2Ga9x3Ek0V
TLSH
T14875E031FE74E436C3BF0DB21B26C716182DBA604B511AC3E3E85E8E59346D22776E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 85ed08f9ee9064d7914f8eedccb3067aa85e61648907a7b9a950ac6610673070
MD5 008eaf40e1760c2a817a09392cffaa19
SHA1 69ebc2954bf2426fe11313305661a3ff0bd7ff17
SHA512 b2201144ce07350c147af3204162f19eb1497ef7d7e44465cce6d4f5e3b93a7156fa15632f2d5b5311939dc107be1ce3b46c80fb5ad6b4a7192edd0584be51dc
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDLiJk0:hUEtQevvqc2W1cpV2tI32DLkk
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f92f7af7b8c6a975fc8a857a90ab02a3091cb8da57e1d63f5342cbf075e1512c
MD5 67251b6114e9497d39ee6456633eea31
SHA1 2413066256f514857035a73ce50314a1c5f3bb16
SHA512 56dc7e40aeb885a5ae4c7b3ebc15f7b08a4a08cf9b91fa854e3acf54c28a0a79be3ad66e6568781305103019781da5c35b3277e5b85fc3c0ebf703ec08d0af96
SSDEEP 49152:uCbRquA/m2yL5zTfFiV+XenmE3/zL6KFdi2Ga9x3Ek0V:DoquVjnmqHFdi4VEk0V
TLSH
T15DD58D0976B882E4D1F6C77886A2C647F37178154B3497EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7beede1f36b12de2acb35e7199d35aade96d66abd47293c33b3360a9a8fb6eb7
MD5 2fc2898e90e98aa5294c5e50184ba9f3
SHA1 357767d2573a2699a0ab11200effe33f292d5944
SHA512 e5ece0b519b841ce3c4c517dfab045351eaed33aba088563ad145eedb0cabfa60cda159111e6ad2975244275a650d574cdcd1720a11ca6729d534f0e90b4580d
SSDEEP 24576:oAhGL3IFoiwtA5l7S53K6LaRFdGJm0Q3WKVSwdr13Ek0VA:oAMUFoiq5a6KFdi2Ga9x3Ek0V
TLSH
T149359D81E7F955D4F5B3AAB89DB68171EA76BCA95E30C20F2150920F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a3f1c4da395902f96627ed6c19d623a43428420bdf1de031df018863b641af4a
MD5 9caf6127ee8c9c8d41b3c1e867c27223
SHA1 4d876216c44ecda4df3975e9b6cd317b46e20e96
SHA512 8c384d2bc60341c7e877c5989dd4c4b920fa202034d8f654237fc970cc38eb63268377ba420c71942e531b4e137287c3889094c421db8d008a4bcd0fdccbceaa
SSDEEP 24576:jwu4OW36LaRFdGJm0Q3WKVSwdr13Ek0VA:jwvOG6KFdi2Ga9x3Ek0V
TLSH
T1F065F14676A40CF9EAA78239C997C132F7B2BC512A24C71F0760C65B5F37361AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 88ecbbe682f91bcb7ce7eaca75382eea9e82a102dfbc55c34e3cc06e470e5b6e
MD5 7874c0beb97ceedd19fb520dba2a496d
SHA1 6b9a47e77439b74ffb1d13931b2824782c3f79fa
SHA512 3972592859d0e5d5c50ad0ad86d51c9734bbf63a4b8822bd2ed41233bdf28ea5edb0005e7299196579785926689c28796c71eb27f0c919fd9ea4499c8405ee4b
SSDEEP 12288:EeZ1Iyb6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:9Zuo6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T10A551257339421B9E3AB42B9CCE18611E77278A5273543CF0A65039A1F3AFE16D38B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 56eaad9ca5825888a438a5450327b89950eb36bb0129985a6fe13bde934b4eb8
MD5 ee1c9b96176e19a2dc1fd5c6caa03963
SHA1 85243554d4abd14ccac5954c76e82257142b03d3
SHA512 8662c7afa78e6a212c250958b987ea7905428d35d61404e690d01a3cdbe999cbac7ceb926a4e50de244c6cb2569c542c58b1206e14a41e22e2ea1c0806928bdb
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3BHFdi4VEk0V:zQyiKa/X+PNRLiJk0
TLSH
T155667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d2d154a19f62cc2cbd0457a30e7ebab682a804d21c9ab5028167aa84f0b8aeda
MD5 ec9ebb7af1a1b8b1e146e08e40998cf4
SHA1 6d8ecda2759bbaf8478ec79f9b841cbd0e4052ed
SHA512 6aa4084ffa33970e1a7d6bb0eadd48d5f0300b205d2d573d80645029ab2379f39c4515e4eab41a463d44a4469b6f59e319d8de36191bf34b7d14e2b6c945cf40
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN3BHFdi4VEk0V:rQyiKa/X+PNRLiJk0
TLSH
T136667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5aef1eac20ed85be1e9088df3ac7f4c14a33e6d9e4cb5077464533b1cecb1888
MD5 d9349ea102059c67ecc3197d20e7119e
SHA1 31be604434efb2b3ecf1afd2b7a56222d5374eef
SHA512 88697837b5d1186b906e1de62735b27ce6ffac7e246297885caa0302c21b15ab6e7c3b4890e24bb5d7b9da15c55e6b13ab04d505d8dc84cecf355025adfacf7f
SSDEEP 49152:Y68Qg55nhceWu7PNU3/76KFdi2Ga9x3Ek0V:ithLRc/7HFdi4VEk0V
TLSH
T10EB54A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2270e69ba4f7851e20141b4add9f8d467fbe11f67b34d888751327bf70998ea2
MD5 2318c9150404c23c62d5f3b8293229c6
SHA1 616974d55d1ca221ab3c273c3532f6c20b1aa030
SHA512 5415ce9ba3fd53ef2ce143a8ebcf734a3a16936f5bd9cbfeb9e62c928a414327d45c238d8648e2d1ca1c504c84e164258ac6f400e6b74c655a9e10b32619a249
SSDEEP 98304:1y5112gYy5azzVvt69nLKnhZUHFdi4VEk0V:YLIHEWhCLiJk0
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 940251a21c508a633c7cc29c78889be2460aa60f24e355cfdd64379ee8f77fe5
MD5 c8ae92874f9be0940f7270c1f667fa31
SHA1 eb856e9df9f79e20aad2eadb57ba5d4613cda5ed
SHA512 47dda3d3d10a1147cddc1ed1e1d03ee09a34b4db65cd0f02cff2034493306bc155039698c75ea1636e0d15ddbb9139979fe8a43f4d44c67a0b9e322e8683a49d
SSDEEP 49152:5B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJ6KFdi2Ga9x3Ek0V:vu6Jmdxd2dJHFdi4VEk0V
TLSH
T17AD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 56503383d850a2122bd90445b13f6d5fb366e863113dcc0689d261c1bcc0b0fd
MD5 fc38cbf873a8ff794b25febee6254121
SHA1 e4f8f296814a0e37bdd8c945d1e4da3d9f9875f0
SHA512 1920c1b1c5ad31617c1863977c1cf4ff855d3cf66ef8802ac067935ac5ad8e7249e1247d7efbfe8725f998ddda991f4c201a7c831ef1c03366d3bd53429478b5
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xF6KFdi2Ga9x3Ek0V:5mifPWRqHFdi4VEk0V
TLSH
T15DB5AD13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6a87723efbb537d823c4cf3bdd2c9110893011d681307837270df86f81ce8cf4
MD5 4f767fc32ab39deaa7bde21c492b7e6e
SHA1 b288f85f9fb6cba807bbd427351bcf661d6dcdb3
SHA512 b8132ba191fc1dd09bcac2ada95823f6dffe62039a6ee6dae889874f16037214cabb899d5069704aa9ed8668ac62da33951517d61e99ec68665ebc621b73b7ed
SSDEEP 49152:vSuZQIY0Be2KcRVtOnks6NMHqo6KFdi2Ga9x3Ek0V:V5dKii61oHFdi4VEk0V
TLSH
T143C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ca882ab6a1f9a5f96e295d4ab477d4ed53fde1999877ea6bb28307254762d129
MD5 4e3eb509db4f2aa97cd76d7b8bda2903
SHA1 106d6930a8b972b4b7e037bbb12d9ed6254a58ef
SHA512 0091334484da9b520df9b58a1c17482fc2aa0abab2b90e7947c75a3d0362c8708fb108575f402fc1e0c26ae07d37d50c482f401cb9179d6da9a0c9c3060e24c1
SSDEEP 49152:shtSn8EApI0fig3giDn0AP5w56KFdi2Ga9x3Ek0V:NX2imphmHFdi4VEk0V
TLSH
T18F95BE13F2D901E8D05ED178C7468632EA62BC150B38A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 95dfb84418ed4b19d4ef30bd5fd4453f2fd7c93e8a7cfdcd073f087c0ae9ec00
MD5 6311064d7247d41b7cae7705ac6831dd
SHA1 f7c540b5ede55839ec4a37fa58750b321b8a5e91
SHA512 5ecdd8c25800b2d10c40df59e93dc3a124a302203926d120e65851dba794da01bbf9592893b8d3bcf2504afab419f161a4584d4102572a4f16c4dc66a5ad81e6
SSDEEP 12288:e86FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:e86LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1EF452313B9080A19E35D42F2CD8583B56A19BFEC7958024A5F9A2346473CFF97C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95d5e86746c411009511e1a134234fd557bbb7de4b041d0520f30388a620fa35
MD5 d378381115f9aa8ddf6dc1418fdc0bc7
SHA1 70341c8589ba4a3781272096d5c74473003f421b
SHA512 e32afea27d196b0bac847ccba8e23ad41bff7686d86fc054fc57f71ae782075f24a84207b0e25d34fa82e53640d8af711f90056f7a157bef5d9adfff9a081890
SSDEEP 12288:6v6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:6v6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T18F452323B9080A19E35D42F2CD8583B56A19BFEC3958024A5F9A2746473CFF97C1CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 66c22f47d28458efdfe35b0cdb11618e25f1c5f4213d6a02215f74ee72c29cc0
MD5 36d24637fa76b5e517a9b5a0e690d693
SHA1 8d25d712dcd652f369e7df0f3d1b0a9cc5b2e5a8
SHA512 6863e5aa89db2d454a838a6de8d95253562851fdb5a3cb48e33be78efabe5853ab41534cdf4a8648074141411eac3fa8d7dc866f406eda1b551e00e8f1b89f7a
SSDEEP 12288:MN6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:MN6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1B5452323B9080A19E35D42F2CD8583B15A19BFEC7D58024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ac14f23ac838def008259bd2445b66977998dcc03ca9cbdb2b93e0c5091fc1de
MD5 c53934d7b35f8df6765cd5c10a732367
SHA1 fb57dfa9f2b9e624e18ce83ab681a33cd754efa8
SHA512 75aca81c13f66c845f7c3599d0f0be86a83bf0b2cfcdf6c04f6af78fadfa712a9fc028d270df8f89f264efe972c0132ad034e3973372f9a939e48c28988b6257
SSDEEP 12288:oVq6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:N6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T14A4523137B180595E36A82F1CD958271AB76BEE86A24538F4F51164A0F39BF47C38FE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e50b988429f8d5604482666f1a7774ad6b3d409f81420c9738565c936943794b
MD5 12ccd961ac18d2ae6ac5abf20227e5ef
SHA1 291a9f10d2784f91b593ecbd5aaace8da3641343
SHA512 14a25bb77eac801d76c11dffa25c923052211a49b384ecb8389f5098cce7dc220b9f7154098745c6f78102b818e257a8259a935ddc86867c96c27fd7da7b9100
SSDEEP 12288:Gi6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Gi6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T19A452313B9080A19E35D42F2CD8583B56A19BFEC7958024A5F9A2346473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9487fbbcd7d7c8e87543c74c296e9f96039dd538749d6d0b9d22867dc990157e
MD5 9939d586a7003a56e6d1821c790d060b
SHA1 e9a760d51da9f4dd7af9a6e321d863322e86baf8
SHA512 a48403f9dd36ad69cd15241d2cc8fb5884083a8ac030f7acebd57f8b0b11ff2277aaf27b39a33d19141fded2e085355637aa0ab17a54b410fdc04bd65ab0e62d
SSDEEP 12288:3z6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:3z6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T17A452323B9080A19E35D42F2CD8583B56A19BFEC7958024A5F9A2346473CFF97C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 aa91846228a20c18b508da6b55f386cf399c04a1be38b4efa454b57e9109f815
MD5 b6c285ddc1e7214cc1949756192cfa3c
SHA1 3ec35270b1dd3b68654850d7f07308187095ed44
SHA512 6587b497f888c580e8ab0cd1bdce23a840bdc97dd027f9641a8b3c83e0fb50c5d3e970f5b37f103e91fcdaa179f23c26720f8f97f3c4b295e18ded6c01211c5e
SSDEEP 12288:QH6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:QH6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T176452323B9080A19E35D42F2CD8583B15A1ABFEC7958024A5F9A2746573CFF97C1CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 70a7e69b564dc0085bdd4ce44dd8e3bc193502e0183be16007ba14e1e3809001
MD5 efd58336e828e918c0558c7ce8d4f1d6
SHA1 390f17ce90f26778011eddb3c5068f69ecdd50ee
SHA512 bc6dc24748e0a6317a4093fb1bc2a6d4ba2f37165a35438cffbad3c1cca72663bd1e0665f0df1c38ae0c3902dbadc0ebac0967ce85e180900eef3db2eb6878d9
SSDEEP 24576:YZMRzFVSOP6LaRFdGJm0Q3WKVSwdr13Ek0VA:YZMRzfj6KFdi2Ga9x3Ek0V
TLSH
T1226501A6B35018F8ED67827ECD558916D6B2BC690B60C60F07A4362B1F373A11C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cd80019f98ac59ecf5aa3ec3932459134d61ec0e6c5e9e41f20f268f7928dfe8
MD5 0f35e006294c051245da6e8bec54ce8d
SHA1 f99fcb558fb3b542beb940d490a857cbd0f1014a
SHA512 53654f48f893d12a6db6f9f53c0de27cfeb4e22e82ab48fb6245ad1d93c447f5c3683a235f3d2c226a43e87b7cac37084d37a812dc08d98885e726d05e73c4b8
SSDEEP 12288:tY6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:tY6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T154452323B9080A19E35D42F2CD8583B55E19BFEC7958024A5F9A2746473CFF96C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1f7983ea086726c01d56320379ecee256560c1f14e7990fe1b64bf56e1ea3ba4
MD5 f13df101b3c9f51b527fc1265e2e805a
SHA1 738ff4229105bd6595ad30f113d2788ca14f855e
SHA512 26e47c1ebfa1531e650be6f7690f6828b0b225922339928930d230cd82d2821c9339ecd47f6ddb195f22c26ef229225be5370d16b5ea5487dcc9374870a190c7
SSDEEP 12288:mE6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:mE6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1A1452323B9080A19E35D42F2CD8583B55A19BFEC7948024A5F9A2746473CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 73191ad270047090b520da22485be0bcfae575591fcaae5de638c8ec35f127c7
MD5 654bd0e404f19b9e4212fed7caa04dd7
SHA1 5a23120c848407115bc1d2b7c18669185aec3389
SHA512 01912049b1017aa2a04013b3e13068cf762cb8fea2ce50500c53950131d1b95574019b9adba2f3d7165eb42c1b44f80200259a67b7ed3615f42c5c46728b90e1
SSDEEP 12288:kyPz5L8b6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:9zyb6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T132550217776421F8D26A8275CC920A12F772BC751B248A9F17A407761F3B7E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 183858e19db9f0a149c6c5051bb6aaa318a577a65740c6ae679e88671a406ec4
MD5 6476e73f0c00d908ba2ec63cd984296e
SHA1 ee0413f7753f752b969337e6bf74d46e2577a3c2
SHA512 31402c4460af4401e072572a121c81adc26cdee746ec5b90f2d4df7dba612ec055edda6e847b82a7e24e705a2dec71fad34bcc8407fc09278bfc02638dfd8d9e
SSDEEP 12288:JY6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:JY6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1FD452323B9080A19E35D42F2CD8583B55A19BFEC7958024A5F9A2746473CFF96C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0d72a2aa784fa3bf57447e62316a86cf39de108f95194d17d0efb14e1ddfaa8b
MD5 a02c8ecf0bd25ffdd4699ca03ecee827
SHA1 000307958404818b8010fa264243e27abbb7a04c
SHA512 3a39e8b1119432345a99a428504c0bdf22ab178b88baed90bfa7d7fa44c7fec1361da65f3ace5176a0064969ee5883e59a2a6ebcff1513429a7d43c73b9f6eb7
SSDEEP 12288:FY6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:FY6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T145452323B9080A19E35D42F2CD8583B55A19BFEC7948024A5F9A2746573CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ae8b05ddd5985f1cdee9984bf0dea85b3ec29e96de9b9939860d475c29b43de1
MD5 42b30ece3927dbca3c9d9aaeac89884b
SHA1 18151e3aebf9605a45586db2fede6071a66625ea
SHA512 5ad6b84cd54f26c1a8572b8944d2fc56a3263b0a23e50bbbd4a67ee07dc69879602f118e953ddb02ac3c892a1b52cb9d240c17c7d50bf781b3dba762c41c47a5
SSDEEP 12288:iyPz5L8b6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:/zyb6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T173550217776421F8D26A8275CC920A12F772BC751B248A9F17A407761F3B7E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3e81f9fdb111bef95bbbeda0a8e177d7a6b67edcb25f9dca6fc98d9cc7f68c56
MD5 4f42f8a8cb3740186958ddb1425ea3a2
SHA1 03672f3d8e75ec916ef8b88f831b919ae2c57d56
SHA512 9242c756e73cac00b7bafcb3c0eb35671257e4297621bace6a58159d6165026910065d0021cffbbd4a1872797d5ae54fffccb93844b02afdbdb81fe6e7640c8e
SSDEEP 24576:+TDaLl3z0zDd6LaRFdGJm0Q3WKVSwdr13Ek0VA:+TuLlje6KFdi2Ga9x3Ek0V
TLSH
T17C6501A6B35018F8ED67827ECC558A16D6B27C690B60C60F07A8365B5F373A01C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 00668cd69f81f4f0f8845000a177a78f384f2d4487a4b6f39bbb91cbe30e4b67
MD5 cc7e031d791ddc782089c5d8e2d69e6b
SHA1 48d9f0449cc42949f2ea01f40ebf5dbc3fa63733
SHA512 754fcdc90d2b6a46a84f19da269c1f06812e7ade5c822ccfc555c5e22e7b9afec620dbe05d03580c4646ec0e279e680efa47e287d8f832e9de6c0369590f615c
SSDEEP 24576:03vd9CHKy7GZh6LaRFdGJm0Q3WKVSwdr13Ek0VA:+vd9CHKyaj6KFdi2Ga9x3Ek0V
TLSH
T11375CF91F3E414E8F1B78A75CD768511DA767C991B21CA8F03A4261A1F33BE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e336fc9a4e4538428f8113d21f690462638628edc0a719f4091714d798ba56b7
MD5 0fe87d41467335d8842521fa4299e529
SHA1 05adf7e9f4a59bf5581adeb954ed87e0857729c4
SHA512 848669a2d3ac629a55bff423c2513812c7c36c6dab9373ea32e7eecc21da7c7a9071a82af79065f921f0e2b56be71d8fb56db07cbd350ba8afb30a70e82a2de9
SSDEEP 12288:0t6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:0t6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1D1452323B9080A19E35D42F2CD8583B15A19BFEC7D58024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0548da258880a4aac760fb3b645a76e5aceaecf17843edb9e6f9985f9ce9fee0
MD5 50c21e0ecfa4b362cc4a226f348743b2
SHA1 b62e1d195aec6ca187643b5239a5b8dc0bf89ee4
SHA512 dd0a32f4dd34b0cf417c556ee12131f604cbadd5d95b89ebb35d5b36d2b458ed1044f4887f08e028fa337abf44e9180e36613dca2b1fa3f81c95ca31c2476215
SSDEEP 12288:j76FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:j76LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T119452323B9180A19E35D42F2CDC583716A19BFEC7958024A5F9A2646473CFF97C28EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5c0780fa0e0b1ea096d466436060745a41efc1cf76453e5b085a3902224f6512
MD5 1283ab8a6aee9b5a0f7e5accba297379
SHA1 a76ccf6a1228ef2e73dae8a9d37e6f6cf5f134a4
SHA512 c768de21ca930604397313be5d61cbc5f15aada854ab41d53ae917bbc47e9fb32cad18b189b3dd3f7c60d43c57a77af32ca6e5821216690e16ccd8ea239cc1c0
SSDEEP 12288:FW6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:FW6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T186452323B9080A19E35D42F2CD8583B55A19BFEC7948024A5F9A2746573CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f8a9347b5cafbf98593a572fb748dc0ed4949d3ce1853a3cbfae70da3f8b05de
MD5 c256d6693b766e94c82e2691db9b9b1a
SHA1 6a784eb64d806646c9e823e1a4c2724e97c59a2f
SHA512 01c003c576332ddb0c1c6f29d9e7c5313debcd737f68e9c3c13dedb79cce9dce11cbfdaf0a37801ef92bba3cd02f0e9e24a01eb453bd4e0b63130d485f9adb17
SSDEEP 12288:OY6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:OY6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T187452323B9080A19E35D42F2CD8583B55A19BFEC7958024A5F9A2746473CFF97C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 656123448a6dd9ce031c2f3b36610db7c0c929b319d703912275f847227d4b5e
MD5 143e41244a4d7c54971efc949daadc9d
SHA1 f03d94372be21e73994f31012d75a395498e7836
SHA512 6abbd93e131e9d782c856cd69a82c302cfcc7fe6928789c0035f22d0e3cbb01d54e4d5fd2b4519ae1ea504e3fca19b7e38d07d99bf7e2f84da1b6d00937abf58
SSDEEP 12288:lt6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:lt6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T18D452323B9080A19E35D42F2CD8583B15A19BFEC7958024A5F9A2646473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 790824035c2ac812aba92bab29186cc8bb4c050c0249e11824fc4075e7f35bd7
MD5 21288ecd13c8c05003d568024c59ba2d
SHA1 3f64a417f36d04456c20bca5d733f5799b22b6bb
SHA512 f8a054906b33b98a90fde91a5dc6b061d97a043d46e7ab6c740a4580cf6219e39d4106815cab7eac45cf871704f493425b76aff93b9f8e6beae2fcbbde3d790a
SSDEEP 12288:6w6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:6w6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T17E452323B9080A19E35D42F2CD8583B15E19BFEC7958024A5F9A2746473CFF96C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 371d5c85955d14369dc94d3234d3c31fb38a1c2175cea69bfc0317fefebb4418
MD5 d1988d2c89031ebe8ef0df839e822357
SHA1 d03840389ca32d7238b07785e0ea736ed99b14f6
SHA512 54dd5eb3ac739c0426806b2475075c365e1c9a4a38c7674069817b9a782a0c901185ce340cbe6934e1028bdbd6da335adfe1eef12e5de3d41fa31a71f1722542
SSDEEP 12288:oi6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:oi6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1B8452313B9080A19E35D42F2CD8583B16A19BFEC7948024A5F9A2746473CFF97C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 95be77ac7a689e06df57d14f7d7ea69f9f5ab8c925a960f0bbf1b8d65bd39b75
MD5 299232908a8b56c387555e9b2619fc1a
SHA1 515744bae2c2438fae6304adcbbf68cc896f34e2
SHA512 3ea5d0344447ef97cdfba2a853625e4b18f3ede40090a7305183e22002301cfbd47dd0d32f4a5e67ae417f84a7c9689ce398e6e6f26502f9f607ca48967ccb76
SSDEEP 24576:efwvUk9RX6wkyAI06LaRFdGJm0Q3WKVSwdr13Ek0VA:GMnYI06KFdi2Ga9x3Ek0V
TLSH
T1D785C029EBDC44E5E177917C8DA7460AF6B178681B31C2CF029A536D0E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 337afb1a7acf0d39aea297eb5a7dc30592e1b74e4a2b387b4176df3b4a04a548
MD5 b47fe27e2b20a579e56e6eee4c9803bb
SHA1 34835a88a636136bb1126223025b0afc12bd4956
SHA512 f7dca4c041b1eddd6fc045361a79959df0298246dbccfaa95eae53691237f9b24347fdcf8bcc031a411ad3555e53c8ddfdb8bd71d6fd4c71fcd3418ed82f86bb
SSDEEP 49152:FYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Z6KFdi2Ga9x3K:oySzPhHFdi4VEk0V
TLSH
T1FD066C56A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8c7d5aae3a2aa8975b1d6a86e528c8c04b93dbcb708ea91e8103180a42f85bb8
MD5 9d0a99409578f395d12612cba48574ff
SHA1 9afc3dac7d6fb6db9f184c9a59c2ade3168548a5
SHA512 788f02bef446f503d8299b80dc1d049dcb2be981b515a903b7c6fa4f3896a059a5f0c197e9269d0420f805d9d40c87fae8779b97591298d0755ef2d426104677
SSDEEP 24576:P47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY/6LaRFdGJm0Q3WKVSwdr13Ek0VA:P47JUQjTirIhCnDHUPfF/J6KFdi2Ga9M
TLSH
T1C865AE1EA3EC01E5E1BA827889154A5AEA71782D1F31CACF1270437D6F27ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fdc5f57b4e4029ff5ee6849705105be4108b11fbc151f9f42b39ad9f79cd6339
MD5 c8de9ac4dda1aebf7c3b58577d9e02b3
SHA1 e428275a0b8fa38479328370843a421a050c7c3c
SHA512 1164ad6688e442d29aa7078050065302d2fa6708077d5ce3c057c008e1d8748157012564268e3ef5d3e7c0ba12d7ca443e8cb9c484a3266d580dade5792af9f7
SSDEEP 12288:obsfo6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:Po6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1B255F11AE24802E8C16E52B5CB854651B7237C6457E093CB57D0F63E0F3AAE0ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4a424ded304a742b45e048732d291899f87233d8b661f3653af158c7f034a78a
MD5 a85b78a10689befcac516bd3ea0e401a
SHA1 e14b110d38011a061e6fca2c44ddf89ad33fe0f3
SHA512 ba911dfcb2ee475739242834055712102e945fbc6fc63824723e760c3284c9d0bfeddc24ee98e5d87afbd58f49371ac2e0677c613fe9fda94f6a0da2b71bfe97
SSDEEP 24576:ppKIzUP66T9QWG1v1fzwYpp9OpLqNBjDh:zzUi6hLGyYRO5wBjDh
TLSH
T135451741762AC75BC6A950321E36D6CCA770BD01EE04AF0373C9973FD476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 19279218b5dcc063f2c4bc6fa62c972e2954a2079589499ea28a01cb364d6a3c
MD5 13ac4233d6e4ac7a841de72726b75bcc
SHA1 8b49132a2499a474dafd7ff84adcf753fa59a37f
SHA512 8cf8873c019582bcce524e7877a36deff5df6a8a4b4880f9ba3aef49cf8f83d76028834266c26ef2b5821272da5253f86415238a243a5aa65e708286b5a3447c
SSDEEP 24576:tSzp6Y7sYbJqVdseP4mNH/f4oeWjxzgS5Jt1WPOPZgf0:qp5JqVdsePrf4+1mOPOs
TLSH
T1F7552941A5B7E31FC9BE9037433286CDAB745C06B7453B0173848A3C9866A7EB5E23D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f6c01869e02a91c12217b451212e7ad0e0dc76bb5dc10d12cf1446c98c2cfbc7
MD5 76eac3470437e4a78699f532c8f291ff
SHA1 be05ed5f42e5d149bfa78187242a35059ebc656d
SHA512 f1b562d4aa2799fa7709f753f3546b6bc2bd930fe62e04b67c4a7da21dc0267eea96678e129e8d85b03440c9a4cf3c6bd002cee4bb4b919c641f78fb4ac3507a
SSDEEP 12288:S07A6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:DA6LaRFdGJm0Q3WKVSwdr13Ek0VA
TLSH
T1B8452323BA081A15F37D42F18D9982312A1ABFE82F4441CB9E552386573CFF4AD78F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 01219cc967d93cab73637f60501dbbddb566a8167806f935d15f15b9dcd08792
MD5 c5b6d0b8ddbd60988c2a3d60c0394f70
SHA1 8dc26895f9986c1c227f0feb350d6e8d8d37db3b
SHA512 b0a0466cde6bf3200c50f11a1303ea45dd823550b3e2cd94af51ca3d597489a12dbd1bafb89aa074de2f379ae74685813470972ad4665bf3f21c8aa61a299f5e
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYe6LaRFdGJm0Q3WKVSwdr13Ek0VA:agb4mBIBhGF/6KFdi2Ga9x3Ek0V
TLSH
T16165AE1E22EC02F5E1FAD2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 dc7345139b618c8ac5a57cc3736b002822fa232a509af840b72c85c4cb85210a
MD5 e59bceae0d9b6ce8b558ccb531f363e3
SHA1 9841a39605139b552f5bb950ea4130c0de9782a8
SHA512 ae8d88acff5b5a3ebb5ac9531fb972db131f7beb11b3d420bdbaedc24680463a3a142bb1ac6ac6188fea6c3c92b24d983a1cb9a579754dcd8471a412574659f8
SSDEEP 24576:hG88u8FpJqH1bzria7/mP6LaRFdGJm0Q3WKVSwdr13Ek0VA:k7ZFPqVea7/26KFdi2Ga9x3Ek0V
TLSH
T1AD85F16676E001F0D47BD13889864663F6B2B8251364EBDF07A88B551F23BE54B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 973fbc6844773fc4a16dba0675d58c46444866f6f6eda6dff30fb1ea429e6a77
MD5 bb6e277f022effe8bdf0d0c990bea859
SHA1 80ec4ad85e9096437f9f97f39a59042d9b5858f4
SHA512 37e7dd2457a357342fb2acfa6adea3bca7373bbd83d322b999d2a0a797ac51bc4708d9fdc050585f7a308b786e2c7f66d8a691f29a581997d5019f9c95fd0ccc
SSDEEP 24576:5PUr+NQj6LaRFdGJm0Q3WKVSwdr13Ek0VA:5JQj6KFdi2Ga9x3Ek0V
TLSH
T1AA65E12F76AC18E5E67AA17D89828719F771B861171192CF02E1417E4F27EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ea72a98120ba0475895137128601ef2907491eabb88d309e351043c8d5bcac8c
MD5 9beb24e92b4395be727465113e6c7249
SHA1 b839d1a11380c6054520ed5268d001c798f8c70b
SHA512 70992a6d59828f883514edec0b840e54b777fe358b884654ed8bdcbf4de02affe14753e82db86759b1fceee2a19a8f21bb3dcb80439bc06a281592756db9125a
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjz6KFdi2Ga9x3Ek0V:1G05lO43bsHFdi4VEk0V
TLSH
T150D5CF6A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5dcd1bab296af27e9af831f0aa2ef26e1fd0a2488b384e42c1c22906ac1a1179
MD5 188228e12ebb35a3044395647e10dd9f
SHA1 69ca08fe0f1819f2a9e5eba11b396a006e0eda3e
SHA512 f1865e862b497303f10d60fe13b21b3e05853b01bc0f2ce4ef470f4db355ec8dda94a37aaca6d903d91f371e878cb6933f8575b27a6c4079a5d778c56b09f2a1
SSDEEP 24576:tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnZ6LaRFdGJm0Q3WKVSwdr13Ek0VA:da5POZ3BJt2pasx2+m76KFdi2Ga9x3EJ
TLSH
T16165AF5EA6FC01D5D2B9D17DC583861AE5B1342513319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 77a864bf70405dd14139fa6b9f856276fc6e935daac1e916fec5819e93ce3d5e
MD5 3de7679168f8a18f6b60a50978bef991
SHA1 d6ee0fd0a192fd963075f43c2703d53ec7b720ff
SHA512 ee296266f6abd6c09fb53b198ca7ec20ffe7749c52a306b74a9ad9f195368b6290fd001cd6ef10045c64cd9ce7f61253406b9a3fc9b95bab3df65609b4e1b472
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkX6LaRFdGJm0Q3WKVSwdr13Ek0VA:zNc/zEOVHFW6KFdi2Ga9x3Ek0V
TLSH
T14E857B2623E901E4F1BBE1BE89679546FA717869173486CF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7f9bdb54667c25ed8c9fc0adb74cc1edce6fd102ffe4a2673ea352ded0e77da4
MD5 b39a35f5ef2692e1de255e066ce96880
SHA1 5be3340ebc0f948863766c09febfa25acecf9623
SHA512 9b431e3dfd997cc5fd874febf80fc481300696f3a5a9c58a79bdc52dfee91e15b1bdec18481857efbafd81713d0d3e35ae585d8c2f1cd6a5f4555da35c2fcb27
SSDEEP 24576:cTkNvNnaFeYhJNtmZBmV6LaRFdGJm0Q3WKVSwdr13Ek0VA:cTMwBtOmV6KFdi2Ga9x3Ek0V
TLSH
T16955AF2EBAB846E4D1FEC6B5CD238512EA727861173253CB5290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2c8415956b8691ddf6f7222cd350531805ad71917a289ffe53cb7339da161666
MD5 23f6aea448732a56ea1a317007caf4d1
SHA1 81366c03da54995e4a1cf4e504da9c231d7aca56
SHA512 4cbddbf3b1199f0204d06460942806a46ac212539215360c278148091a3df8f933716d16550010caab98d07783298d26e92440be11b505f02e9917f7709b5501
SSDEEP 24576:uD3FHshBIYQgAc6LaRFdGJm0Q3WKVSwdr13Ek0VA:uDVHeBIAAc6KFdi2Ga9x3Ek0V
TLSH
T17475E13EEA5C04E4E57AD1BCCA538A06E77138A9072156CB06D481BA1F2BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1888-130-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1888-127-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1888-121-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1888-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2184-115-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2184-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2184-109-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2184-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2232-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2232-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2232-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2232-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2240-308-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2240-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2240-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2240-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2240-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3348-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3348-15-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3348-21-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3348-22-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3348-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4164-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4164-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4164-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4164-326-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4164-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4164-83-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4280-322-0x0000016FF5D00000-0x0000016FF5DFC000-memory.dmp

Download

memory/4280-323-0x0000016FF63B0000-0x0000016FF657A000-memory.dmp

Download

memory/4592-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4592-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4592-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4592-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4740-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4740-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4740-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4740-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4740-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5036-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5036-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5076-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5076-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5076-74-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5076-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5584-78-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5584-0-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5584-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5584-8-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5584-2-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5736-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5736-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5736-288-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5736-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download