f5ab8367176a6c28df9263a090d461781d48e2a0a1bef191c41d0a7cafc2ab15

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.2MB
Sample260910-vbge7sek4y
SHA256 f5ab8367176a6c28df9263a090d461781d48e2a0a1bef191c41d0a7cafc2ab15
MD5 543f390f8a711c481fbf0d0099736eba
SHA1 59e07e6aa0e6b87e9fd79f9293dec9061b30f764
SHA512 51a13bd72eddf3d44e4356b5601efe6a2f6e90e27f35ef10afe5d589e0caa2f18bfe25d756237f94c390e527cd4484ef4e56242e258ebca7e7663dd8c11d95fe
SSDEEP 24576:ih09rHVGAxUqVpHi/oz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iiPGAHVpHFzLNiXicJFFRGNzj3
TLSH
T12845D056B3D002F9E0B7D13ACA568A65FBB2B8094720A7C703E456562F277E14F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
252	elevation_service.exe
5900	elevation_service.exe
1464	maintenanceservice.exe
2196	OSE.EXE
2788	PerceptionSimulationService.exe
3560	perfhost.exe
3044	ReFsDedupSvc.exe
4544	SensorDataService.exe
4948	ssh-agent.exe
3524	AgentService.exe
1364	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6fca8991209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000067a4c8b4441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ecbde4a4441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000409e938b4441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d161b64d4441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae59c14b4441dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f449748b4441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	3044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3044	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3524	AgentService.exe
Token: 33	1364	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeDebugPrivilege	5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5736	2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	252	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4244	1364	SearchIndexer.exe	101
PID 1364 wrote to memory of 3536	1364	SearchIndexer.exe	102
PID 1364 wrote to memory of 3004	1364	SearchIndexer.exe	103
PID 1364 wrote to memory of 1388	1364	SearchIndexer.exe	104
PID 1364 wrote to memory of 5944	1364	SearchIndexer.exe	106
PID 1364 wrote to memory of 1136	1364	SearchIndexer.exe	107
PID 1364 wrote to memory of 2808	1364	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3560

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4544

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3289796a4fb764e43ed3121215d5b0821d17554b62554a1b5461cfbc9e3dd3d8
MD5 aeb78fe5e596e0fb47a556fd4767108f
SHA1 13785f4c3f192efcfe5d26ebcf151e06cb1b2904
SHA512 6876db9ea7067ced33188185bdbd047437135e4e53c2165bf435126867a37305c86cfa975d4692b59f8a5f93b8dd40bf7fa8d7dbf80cc8ce5132abcdb75fd977
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKLNiXicJFFRGNzj3:O3q6mjBJ7wRGpj3
TLSH
T1A2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 922deee13b4ee935fa6ed52a717461666dd693a9321d0ebd852096f7f436e4f9
MD5 4e46cad2a56181f7f5666f02affa9e18
SHA1 434b142739ab4666ba36a4e309e9bdb4ab317ea3
SHA512 6a8bdbd50b330fb57d44ed6636d9c064709d827b728e353cc57d5d30dbd9c2250b6fd17fad10525d0c071dc5119f5644d4cda338ae2ad02a040e555d78043e2a
SSDEEP 24576:DXYfDtczA1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GtcMLNiXicJFFRGNzj3
TLSH
T19275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 961e456ee2450981a46f6e0f4e7ad28b27f1884d366929ddce8ca0d59b111a32
MD5 7b5096857365f39d0d603547dbe6c845
SHA1 5d63ab58c82f565b6c8dc84a7bdf60a3463fd9f7
SHA512 6691e632f2b6a79b42bc0317653c3df9d861581bd1c7170a9ec97234a9ad0c9da4a9789f06af33b528d37718852458c6994e3d00f364e518af5ebbcc965987d5
SSDEEP 24576:l0Le5ji0hmxhrMi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lPji0AzbLNiXicJFFRGNzj3
TLSH
T1C185AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8de484c0ba9f8e412acc07c8ffc3a4c215e4d944fc8a05406cda01d466212ee
MD5 e137f6c80b6e3c140290b490454e8443
SHA1 70a4b8a72b3e35f2bda282af8eb447d69a49b514
SHA512 1f4dd7664a371d874637fa84c48fdd8a39af92705b73258d25b53f65973490cba51466957134a984427e11c8c0d6fb2a9f3de69e6183607b5019ce16fe66edd7
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWj6q8wyuc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7/ezSC6vUzPv+Hjy3LNiXicJFFRGNzj3
TLSH
T127756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 39d0a1c9fb4d857f67bbf493108b2759d1e895b1984c533a5a3464c00e61bf64
MD5 1b5a7c6259db3383fbdba1e9bf8136e7
SHA1 0e063c038cd08d21e9be000c8e5235d6ffe8b682
SHA512 55a2d1f5f14198b652ac33f137bc8a8ebf53a54e5fdd1452c89c6d39db404985427c5039f3e979b37e0e223f7f8d8f8b93deaff0426a65f9f4295df803e4c57b
SSDEEP 24576:3VbqPb88hv/l+BZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3VO88hXl+7LNiXicJFFRGNzj3
TLSH
T140559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7860f7c50b214aabfa48a8ea4accbce4821b988e2cb0afa3941822f2c15e0a0a
MD5 3bfb7cdc8059037fe18d3e6d5dfe576f
SHA1 ea7d0685cb0380b973b50beae08f7f0fe4fd9281
SHA512 8b8559047d6592581a5ee5ea1a9daf352ba3714ca78f8b0b3d3b6d7632f177b7f89b9e283953eee463fd6c34f8bc1dee25f23adc2bbabe32acc08bc678e5d9bd
SSDEEP 24576:eGm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ALNiXicJFFRGNzj3
TLSH
T1215523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 bcd7337fef5872678784ef3b7e06c60d3877c2b746157c642888f1b08ffdb255
MD5 6735f9719c34dd769446754c99ee20d9
SHA1 83cc9275a23778b83795c828221e38f927831bc1
SHA512 9508bce6cf5b6e624dd708b8a4c24c7d647a33ebedfe87b97394bb6fb414547b6a8ce4afb870eb21d1999796df10bffdfd259db83db315629a722957e170938c
SSDEEP 24576:2JIUR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2JIURLNiXicJFFRGNzj3
TLSH
T18A75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 887fd59a3cf0dd8e8c4c734e4e98060c3fe480e66a584e2402937d11e1ed1451
MD5 7a49afc26cffc463c7f0c58f4a85f16b
SHA1 c346d111f09f48ccb2df551b22457b292fc412b5
SHA512 18d3bbcf8783cc37ca12a609dc317c74fba78bfa1a0f4f17b4e30b82e09bfa27c6dd718f4952f9a442c30c382aaf8234343ec070e36f7acc8b9091233612da6c
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THh:rQvGAdlCEL8c/WRNw5Cs7wRGpj3
TLSH
T11F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5d47226d6f520ebc446b98fbd86d1ee78d613a6202fc7937fcd431957c1e77a3
MD5 6e5100d7ec084dc9002b26720b0529ab
SHA1 2ca4329f7661bb84761039bb8daa84138274db4e
SHA512 3add6fe255bb1dd49fe2283fdf586cfedb1b5e4237d712b485b93b145955018dbaecc0acca06a1f0d0c3fa9d80650d12826468f6fdc21fcb7859775e038f2d59
SSDEEP 24576:hfewsAjr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dljrLNiXicJFFRGNzj3
TLSH
T15D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 af94c16c65aa2b52c20e869fe5dc60822104caf75dc96e2c9363607984e56b80
MD5 64b70ffb3f496b8cc2361da1cf7103f4
SHA1 8d4f620d0ab5bcf8cba540c82727122c43b5aad7
SHA512 462ca246ec3de7281586a700e882480fabb7f4916ae1531310d1b6744cc52c412aeb4f7ec8a9e251a09e2eea7e29b6d804fbf89d6d489cc4a3f8237051bc77fe
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHnF9:zUEtQevvqc2W1cpV20I32F9
TLSH
T1C9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b93d840fa1b985364fb8f9beebc6654841914801a35f8044b861ff2883143593
MD5 7f750a5b58f8edb57477b3cbd27061a1
SHA1 474eea124ae2c3d0ce1188b58640fc4f38dab4bb
SHA512 582adb6ee797e7dc8bb218abd9af994f128494a7e23e8524f2e7b15b58e45ea09d7df5b95a453eb0fd20ca2e5395f020c1f44ec73faa2999e0c3b6ffe88ec023
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/zLLNiXicJFFRGNzj3:boq2Vjnm47wRGpj3
TLSH
T176D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 adf2a36ba87bccd74b7b3a6b4747f6df0e1d6284490d1f012803afc0bdd5c873
MD5 e52ce834389f8dc8a120dc35f6f8af53
SHA1 9ee6acb09409465c5cccd5d5ead33e13d6df3cc9
SHA512 cf454b5e5f8115ad8ba15b6f17b4a749266f2eaa00de1bcf13a51a3aae5ca5da4af7340ff9a0445e6df6710cc96ae7d186559030607db5fc1ae9c518effc79b0
SSDEEP 24576:FAhGL6IFoiwtA5l7S53Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FAM5Foiq5ILNiXicJFFRGNzj3
TLSH
T16E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 17a23bd804957d6b731de9e43961e514d71bc16a15a96207f6846cc1f0ec2d38
MD5 b1f63a76297239093429bc3e0b107cb3
SHA1 a9afd2b3fa39dffbf7ef1bf4e3a1a6d9d364dd83
SHA512 50ec0096ce9a1268db0694087c4dd78226315daa8c25eab046ba5e5739865368f862737ddbc89358be5c6b558ed434fe489f5bdb19f418080dbd908b6874a93d
SSDEEP 24576:bwuROWX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bwSO0LNiXicJFFRGNzj3
TLSH
T18765F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3cd7f8c943473b897c3d7bf811048b49fbe91366108081fc7ee295d61c0c64bf
MD5 cda36f460b0dbb81c15b3753e2d41c96
SHA1 33ab67701e8d3f998615d9feea33147b66665bcb
SHA512 0756dacb040aa7a53b2b00f3ccec08bef1a4c96d9b910fb4b00c597663457afc40cc6e182985eacc49c7a4a2ca283d06a9cfbcbd96599de66410fbe26bdd60a9
SSDEEP 24576:qZua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yLNiXicJFFRGNzj3
TLSH
T19255129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cd9fcdb23fd7a2cc40655fb4156d502cd9d12349a331ed6296c2d362c00e47cd
MD5 55601073cbcbf01569c4b283820f5ff4
SHA1 598a278766f3dae5fdf1910c1711294cd9de8b15
SHA512 65427d2ce07414ad2f1c2265affd10fef542b8caf2b6aa5e692717af56f81c6784a6a0bf7671f18adc35940aa71429594132a817163d2cf19a46efd2e03b92fe
SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:WQyiKanX+PNhF9
TLSH
T116667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a8008d08a9b52a911f0f5d2eb76d68c13542c0daee6a6acc21414f0d14fc884f
MD5 ac9bf5c50c267506b3c8234db71ab7ab
SHA1 2f790a752bf0bfe959ba291ed9d6082c1147c324
SHA512 1e1f1e8ca49fa251e4b81db46639c7fafdd1b2a183ec496df7e63d80c02612f3e15dae45f60f9fc2d75e4b2bfc32624d74b300fee567f7441903f59c818bae06
SSDEEP 98304:PQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:+QyiKanX+PNhF9
TLSH
T1DB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f7dd9e34a79d3d264e744538ab681ecfe279ca3740267495999eabc68b56205e
MD5 afa9f7f5d11b4094e0e7a86aa24609a0
SHA1 3f728f91b09f63622b5f74097687e77227516f04
SHA512 6df63412cbd6a1399e89c8f7790acf1448ac9c99079e1ec261355905e2ecae483eead1073a271e54c42383882775392f7a432db3773ff42249d7191c1aedd558
SSDEEP 49152:D68Qg55nhkeWu7PNU3/bLNiXicJFFRGNzj3:9thTRc/b7wRGpj3
TLSH
T183B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 341a3b3bc6e136cd56b7b8b341b02462c19bd56d2e056657af0cf2e3efb44a1d
MD5 1c4042ac6ac1a432a935377385cc2abb
SHA1 ce66ea55f6fbbe55d7a068669c8e4f1d5eb0729f
SHA512 8f1c804847bbf12667ceff089b5c0f0d4ab2edbb0458d2ece9c3363923b8a5b24f69ecd6a438f98ecd1d6e0fcf328ec1f9a40fc53b114178fa40538606c6173d
SSDEEP 98304:3y5112gYy5azzVvU69nLKnhZm7wRGpj3:KLIHRWhcF9
TLSH
T1DE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 189a91f1165230dd1568c6074541ec4b07ec7fb3415d8f905a19815219182854
MD5 b35940a68710cc7de35e8cea830451be
SHA1 f25b93a34178c0fb977528b595a9f2f54d4afae8
SHA512 e825c8cf62ad452f885fa67ee94e3f64d4d371fcca82041c48d7a596d715d892409ab250a0dd2e3bea09ec790bc67394e0229019e34d225745c862b1ab68cb1b
SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllLNiXicJFFRGNzj3:Iu6JmIxd2dl7wRGpj3
TLSH
T11BD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9299d6bb2e864b93eeb5ceda70a5d055ef35f88633e193621fbc2dddc537e72c
MD5 d9735c5741461e10ab30a87a68d6003c
SHA1 1c86238afac7b520d8c2abfbe50495a7d228d2e8
SHA512 2b686492dd27b0d142d84a5f862cb2e87c9c0855d7a8391c5d40205c5f00f45bcaa7f2c5c9388885590f48f2003d58a0f6b18ac03323102f9e1d62d32cea79ef
SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4xxLNiXicJFFRGNzj3:QmifPqR47wRGpj3
TLSH
T17CB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e4c5306f099202472c0accf955704ab357f6cfece6f8ef1f1163ae5a5499f765
MD5 41ac3457b502d629af6936d26aa30de2
SHA1 1db9f25d7379087a42c9ce686016318d9952e033
SHA512 ef5ba31215b1ba3e49b3dd49b19bb370160231004c98e68a03b6e1f14c4ad266ce420e2cdb217d00c2946cca3d9c3a563b8b2fad37b2656c2c820e972cf394e3
SSDEEP 49152:fSuZQIY0Be2KkRVtOnks6NMHqaLNiXicJFFRGNzj3:l5dKqi61a7wRGpj3
TLSH
T1B1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b1088f9fa9854f4fb4a6d2e12b052c5ebecf3d0178d40c882b3d66c6eb7f3bcb
MD5 e87f05d1ee159726178eb11a7d1a688f
SHA1 398309e305fe722cb1559f431cd11f2b5f4b89c4
SHA512 01ffcd0ee3096a01f48f3be62afd91ba085b6fde1dd32b6e3646251d2a786b917af8249ad6812942f2da439650a1f1259044e223e3f4349546375c59b2a5d66b
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5w1LNiXicJFFRGNzj3:FX2iWphU7wRGpj3
TLSH
T1C895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 26581c5dfe586d2ef6257954ed53cf919512afb320facc6ea35bbbe14f16c9d9
MD5 8561cb8c33816d2d002eba30c178205f
SHA1 dc759e5e3964c726921dc3b3c6dac769283796d3
SHA512 8ef98d8d79446912c4bf0c37e02ed66d7b785ece148a559d2c20371cb15d2f0299a55b03f2d91d08001f219c4c49ccb2cb2bf3fc02567308e2e0d0e4be518887
SSDEEP 12288:70iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D3558955B1FABC0039C6755428F5882E2DEB5618E3E3043D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a4c0c782a1a2d5124b517025861be7cfea17224728dc8d95b5a87f256e4455ac
MD5 5b633e61eb6119385f6fd168fdbf200b
SHA1 e758ae97e0edbd21b11dc7b080a8cba2d92be6fd
SHA512 76e62431f25921152cdfd1d53c743139ad6871380e639ebec4db8da5d1df0e74885b7f13f8619df32c6fbb2b763e96a68f2481c07a135b6215795d1d4a22f511
SSDEEP 12288:OriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1915523D3548955B1FABC0039C6754428F5886E2DEB5618E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2c1651d327837741ff5c9619819476c6cfa3de4d53152934d3cd92f329244dc6
MD5 e0caabcc65d601e8d16e784f225f96e2
SHA1 7cb11951ff9d0761935bd63fc093ccadc6eee2af
SHA512 997cdcba9d0ae4e57e4ab0113ee20637d06eb2822511dfacbcb60211e3462e54746f31c6a2321d08c5f07315ef8f506f3fb012cac65c06796b5d76ead58b2653
SSDEEP 12288:8FiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d4e67210f1c34628e6c6fa4594063b512c8b1dd7eed98105928cd299e7cedadb
MD5 5bce5b129aff7eb14cd4634d6781a408
SHA1 7fbb9b676315f865d4af2d6a72d509bcdb1df683
SHA512 447c2dfdd012c1ada9b2a89c1d358473a9f5ec4435cb9112eb63069cf8cd05a098fa0879071c0b22f23f0c100b2fc5c525c0b57a6305747483d1307d7d6193d6
SSDEEP 12288:qVOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C1552393168901F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74FEA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bde68841514b5547a0616e676f2178c08e344450124139a6a042ed503279b0f6
MD5 e619e613cb76a05285d7f394f1d71fd1
SHA1 f2f468e27a8a27e877ee6358d971eb8e59d77ffa
SHA512 5e9d888f8212e4307af9755822a97a069ee748f8d1f5efa472db3219d5905e3ee72e45cb0f9f51e959c4338005929fb1b4be79b4bc1ac2a6c2c89bacb9cc9170
SSDEEP 12288:yWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b8e0ff5d492b285ed2c72217c6dda7f7d48a9c1f0b3c4366b9a72506f4d7bf0a
MD5 01cdbc96e9ed532fea37c5a248ccdbb1
SHA1 d91e147efa8c7c3def34c40bb6450e5d3cac0a1d
SHA512 c0165822048abd1aa19ab7dcb4cd78089b78787e076a3771f162e5df0b73c19c9c18b1b5602e4893ccda2bc2c945c7d7dff402222727691c903c4717855fc47d
SSDEEP 12288:zXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3bfa370f7d02b1aa899e9c15704adbfb879f1d822539d8be9e95e6d7cc8de232
MD5 9748c1c8c6189b7477c2261eb47b227f
SHA1 32df280a6e029d2913b8445c73fedd7302db53da
SHA512 d6e3c8765d919896b032f8831769275125fa8661145191f6c1bb1d933cb09c82cb6384e848e0efb7cbd266f900e1dc81ed09806a819e256b9b208fba76cbbb2e
SSDEEP 12288:RziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1745523D3548945B1FABC003986754428F5882E2DEB5619E3E3083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 99d090eebc8bb5d1574d557e51e04df1c8d32e9829ebb74086db83020101ea5b
MD5 5014b5c1bd2eeec16c1620296a116382
SHA1 6ed6acabe8408308145b6128aa84da887299970a
SHA512 404916f5137b0ea83978a5e89038b2d0343e38c39a452821b18b1aeaebef8e72d3a6b2fd640396b1c00c4ac567caef754fc3f3f42982cdb9c88ea4211ff78f86
SSDEEP 24576:NZM3zFVSOf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NZM3zfzLNiXicJFFRGNzj3
TLSH
T141750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7ffa835a6b0e080d9f70cdd51313a2fb74b6a8bdaee8574f482164a35338f57b
MD5 78225bf07ae1ab3093ec30bac61333b8
SHA1 21fa7b43cdb512148c3678e24da742665549545d
SHA512 4f2ec7d9e5b27eb8161d94fb122c365dfda291873626c27fda459519052fc6e0d28358c25246ae30829a55963894fffd4890ad64b50e099a3e0b99d3aff31424
SSDEEP 12288:BYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a4fec2391838424eadc9d10f38e68057154ec514be23e3e0034c1afa01c10b2a
MD5 a01d6ae41929360fe83d5e7843af3c85
SHA1 34d866a3b0956ce799f2cf485f813d90c82b93e8
SHA512 07bb89fb3f142a554dd89a7042d7b2379295800639c8460d0a02f55c7decf2a5d69bea2015ac66eca7461135bad7e050f0c2ea1ec595cba46d524e23744b4c08
SSDEEP 12288:gMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d782125b13b38239297da10238e3c17fcf9388cdb976c744a8e5598002822ee0
MD5 868fc582a0a15e53581ace5e2cdcfff3
SHA1 a006ff888bc2cfe97f44e8dfdea8e915a13c1c64
SHA512 ce1e4bb5bd5ab40b94eec095945ab3eeda1f2a9d4ff561316512f2a4d21908e2419c87732eb9234012860f9b8e0ee58647b1a2bbcc95efcb870643aa4cb7d1ef
SSDEEP 24576:Bzy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BULNiXicJFFRGNzj3
TLSH
T1C4650247729530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 53f6041e716513701e0b32596e1afac6d7cb28d5d07c854a2f4cb824c84377f4
MD5 d88b36f12c3f8b60385d2cac0d60d5f9
SHA1 f7aec2c41c866a5b79926fa107072bc8ef5fd0b8
SHA512 67d5ce06286c2b041a3c5abc4ee05605206971849fa74cafaa5d511c7b5c2c6d9d02de258af3932b4856d281e61611939132bad0b04f4ba2ef062da2eb9be45e
SSDEEP 12288:mYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D3548955B1FAFC0039C6754428F5886E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3534c0bed41709334726a17cfb0bf2f5fbe823d1a19da2ab42ed16f6d35fd8bf
MD5 c0a1b678364672b70df8031263ed4337
SHA1 4e274620420326b65174ddb09e8f4c53818e262d
SHA512 75b8fa36d966bfd019375591670b8e3d4e50c31d0cf0490a34e2b50f29868f03493fc8617ef3f040515efb5b17741713a3ec1628beb138b72e36753d9223488a
SSDEEP 12288:hYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5a926fd634195db763055c0282002b4e9684aa84e5bef902eb97bd14fe553987
MD5 313421e31a1c829b118ff3885c5b7518
SHA1 ad15c31d7b309720b3a8febaaf6371dba86c8d27
SHA512 29b554a1fa432abdbd43b685ea243796ae639911721b58adc6eff79446911a195b3d0542a706305b4ccd825fe1871a625c9f0bbdb87bc748a30f95875120a871
SSDEEP 24576:Wzy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WULNiXicJFFRGNzj3
TLSH
T17C650247729530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 003ca090a8fe5e2ac7ba6180d50a2884dec008da9891cb58628d4e0c767a3f4f
MD5 b8c19f142550ba0541cf339abf1f65ca
SHA1 38e072d037820d46ce7dcd6b542ab40a4af3d4ad
SHA512 d7cef007cd3a8125272fff2b173fca38fcf14691a6a9c45fb6a424ac03491c4b8317af85c96f2ca54c9f24d494f2606a12134a781335be75f08c787e4c0fdd50
SSDEEP 24576:bT8aLl3z0zD5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bT7LljcLNiXicJFFRGNzj3
TLSH
T1737502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2d56856b1f2a951087866f6cfeec7926a24464ac05066cd46b29d33353c2f93a
MD5 de82a5bebf814bfc0f9cd4f809452e42
SHA1 d647deac395347158d887af06c40bfb7542bfb2b
SHA512 f99cd13a881f7809794e60ca26b81e53be706dc47faf7e3bb9850d2450a7c3d862f047875a3108184943fa36eec25b4cea71e0283f8dafeedbd6931bab32a198
SSDEEP 24576:g3rd9CHKy7GZN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qrd9CHKyazLNiXicJFFRGNzj3
TLSH
T18485CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 819fdc046ffaa2e22a991b062a96c6d61af1a39e5c49ba8e1529a3cfaa3811d8
MD5 b591168d812b6c8ed40738466176f7f3
SHA1 aae224ab38854868bc7ef3c930ccafa67230dd03
SHA512 a160796fd0035d53354623f49d05dd72a468e567276c2d376d526729c9bed20c0fd6c181a753cbc284351b6752546ead742f1dd3df39cbfcb1b21614cdaadb98
SSDEEP 12288:4liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 583311a9d5da261f571a034a0957573cce37c7da2501d6696adf3a64f00d281d
MD5 42032081a169bf817db6519e48c833ed
SHA1 11a8b74b8715b6b587ea858894f45a534d2f9758
SHA512 859614745904eebaa5b9ca84a95c3c21595eed357af2516ade03abacf58ecc598a6f298b5e7974c4d7e3b404301c7bea9375df8fa133970b29fa88d84e58021d
SSDEEP 12288:oviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ob/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 266d4dac2d40c98376be44d819d37f7f5e43b794d2a59868450b1284253d0d8c
MD5 9c3d8592f23f5775cd89b4e6d7727af3
SHA1 234fc2520fdd2fcb4eef2121be1436a67e8f9c4c
SHA512 208d919b2fc04bf80b6c6bea368906678be88aa22ef17e85abf06146524e121b31ce0b39424da6982f2ee110e987aa0a5ba25ae775a79092fe61ed0e73238891
SSDEEP 12288:WiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C05523D3548955B1FAFC0039C6754428F5882E1DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 af7f197fd7b869e3bf782a580203293c8433d90643c6aa672073fec4b5f169e1
MD5 a3ac2e81eed94c4a1bdf05fabeb144cd
SHA1 eaa4d78d79040ed0e7b5c2418d06a1377c1c67dd
SHA512 14dc1af507511f8b08209bf39d0e99c882937ef562d4e5ea89a27dd3f42e02d50e3c4ce93171b05edc231421ce3c68a2810b1867849fcf7cf527fb53a1715bb4
SSDEEP 12288:wYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fe0085f7f086049291757ca84c9ccd7f33d839eadb1ce17a37d1d98759afbedb
MD5 ce06239e4c07288930cf0162025addee
SHA1 b97251ee865243158297108a82099afa39ac7eee
SHA512 1df1a991d8251cb15335860189baaebb464edbab4096a276844e62e10218916e9accedb4c0af328e0e2fa23c6f3874f55667b5bc2fd81e1d4f9d18287606833f
SSDEEP 12288:KliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3558955B1FABC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 325671031d8716388b6adaac260c270fa62f7add40ca15a0a06d247089bf1b8d
MD5 8048169c0c7b4a2811fe311a0196d6b1
SHA1 678434e83ac1bb28df053c6778948591ba2ff3c3
SHA512 52169b985e8c9fbb8a5ff936d0e27f6130b138e3a6cfe71fd722e7c4a03c9da1a3fd4af5104d68b494db8d50b68b3721dc5b20ffca0cd46c3b5b6b59ec658c82
SSDEEP 12288:qAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3558955B1FABC0039C6764428F5886E2DEB5619E3E3043D1EE278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 78d18cf485d49256a120d3d410948ad5c6bdcd40e4fa4ea7367690d729e176e7
MD5 2aa247bd5961dd360bcb0f629ed97734
SHA1 ec20f9c6532b4fee9d11ab274ee97194932be750
SHA512 f74b1fad279461109822de708fe3a175dd64e05e1bdcb97449002d3b30337c88da0215f8d8ad300d31adb6b561bc56614e18f51e44b2104c403759212a6d7149
SSDEEP 12288:MWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3548955B1FABC0039C6764428F5881E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0072869dc34aaf3314ec89f975acc0c2a84c45a3d7d1ac88e025e4cc86a7b104
MD5 e046be51054efa51b860f4d559a68c7a
SHA1 a9a8c3d59cd2a8bc4508b0aefb05a1049cd7c0b0
SHA512 785ba64207af2e81da530672a4024f2bd94764cbfd9ee590350d6e42a68f09f865f775b71c48e161504a4bb9a3cd65c665af53d6e498aeb9c202a660129d8ce0
SSDEEP 24576:Rfwvzk9RX6wkyAIG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QMnYIGLNiXicJFFRGNzj3
TLSH
T12385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 41a611280cf125acb52be0b1867fb562e0e2e28eb9e5373e2b45ff2f7ee56684
MD5 1491fc09e0a6dd316fe9533ba20897dd
SHA1 463cbe2244c540ffa730962c79ecea5425aaef6d
SHA512 04ed0b36e13f9c96399c80177a19d146c18a4b417725513a6c2f562c91856ae4cd86f0fe4e88104c417ec7f2a86720af8c021a4441b49fff223d0de01421ce20
SSDEEP 49152:vYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VLNiXicJFFRGN:SySzPN7wRGpj3
TLSH
T1F6066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 061ac90a8e525520644c626928d4a25c0df21bb91f1dde544981cb48d8741819
MD5 8b3871173bacdaeca34bfdeb13c0fd31
SHA1 e9aedbf788d53ff944f93128ae74e6a781500694
SHA512 ce94d500b222e4e78638192ff1aae5b4ec6bde5fad0aa193798317315ae8f97019a4b860700105af00c8cd7e5e99abf5193d92e8ff73bdd7bc4e47310b4c94ff
SSDEEP 24576:047Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:047JUQjqirIhCnDHUPfF/lLNiXicJFFS
TLSH
T1FA65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 db7a7e1dda646da5981112d3338ad24ae901e9cfbf4f1bbf302ccc1fc6066d3b
MD5 12586fb95f81e4b4f2f95a7108f240f4
SHA1 5b2118f1fd2942029aae6500e28acdb5545f50e4
SHA512 df95e301fabe01ed4be7f6a786ff8c2202277cf275b826a3dfcf4b80cbfb4efab372c438611741d07a6899495b90f85f9ead2163d289df372cb75cdf9087a00b
SSDEEP 12288:XpsfoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B165F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f13a6855350f1bf0029d13feeff54b693ab67bdf30180062c19927e91176dbf8
MD5 8d18bf0e468f4e2f5b45aa6117cddb03
SHA1 a4042b38b75cef8a1e413d6846a76a6aa97fcda9
SHA512 35c7906e3add1e4e0109be6a1005911415d7902bedd31725da3379586cb54ab98a708f6228bc7a7c697232cc081798a27530eaf4a15d629d5b14fb558183b8eb
SSDEEP 12288:yhkAU3fsHG4KrEcqAffepOCg+YIOXvX3GaRMTqAI+fD5Qsfa0DI:yhpUPD1EcwpzYpX/3GaRMTqqlDvDI
TLSH
T175452840766BC75FC6A940325E32D6CCA7703D05EE446F0773C98B3E9576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 5352d9750f6c96357ad59f70838b74704f8140440351833eda0451ff9e1497cc
MD5 0d4f9e2d38b1c4bf5cce1d42266e5d0f
SHA1 d79a9a1f4ecb9d45e1430a8249ea2ecf02db8574
SHA512 7647ad12c7f5d2da1f510a7d8466d1d3f1873d15ec0eb18d6d8015af1eec7d7032459de95cbc28ef9239d04e5c735cab9e6cb1f2dbaceb8c049ec21615fd6d4f
SSDEEP 12288:p8sMKjhfvmNSYshHvAfDPtu1fYGLzhv+Jm2PZQKZio7W:p8sJJnHvOZQwiiW
TLSH
T1F9750A81A037D38FC1FB5032032A5F8CA7A4AC16B7456F2673C9453AD866B25B1F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c054bdb6d6638d5bafc2f5c02816e0d23078a45f01879dd4763dc5c1513f6f9b
MD5 a61b4c2c945e63b71168d1ee68f935a2
SHA1 248536e080bf87d81919487e14e336d016a5c850
SHA512 301832c8c2b682967b063bf999c1b1636318fa17c07501e89f1a12acd0975bfdce51c86971b3ee7077013ce0bd8a8e4b647da60f2e07283f3a3452954653a687
SSDEEP 12288:sF7QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523A3468D59B1FAFD0039857A8434B5497E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7ae43043faecd526a9462e15fec7b02e03a68077e875caa0a8b34154bcbb2c23
MD5 42cec0dc1d4d7c527717495196353724
SHA1 856ac4dca7c7ee42bb75348805370db43965f1b7
SHA512 e44aa2c897e897f2cbd81c46748014dbd1cce0e37f44f4071accbf3fdec217ad28cbd9e5b4d18ac8190ebf4373fa222885b12d94121f97b32e5d74aed77a669e
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jgb4mBIBhGFvLNiXicJFFRGNzj3
TLSH
T1FE65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3c7f9612c3f2fde03108ef9352ec94bb0fa0e9d345f82517ff69d65484e1bebe
MD5 695fe7e1f087309a724b43650c2cf1ef
SHA1 4ea58a7d4677ee464fe0ecb48ae751fce0edab0f
SHA512 dbb2672b55be0b92674f24eaf1d8d8aece52b8dd27ca313643496f01650760e1f8e7364ccc7de43ac84a0c477309dd81db6ffa11f7642bfe44687e863dceb692
SSDEEP 24576:9G88u8FpJqH1vzria7/mf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q7ZFPqVya7/ELNiXicJFFRGNzj3
TLSH
T13685F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 300d3872b0361c72b523d3ec6cbcd73fb8316214aeda9c5fad26a1c90aa75f05
MD5 5c5d7b23bf7a172bb346cdc051e96051
SHA1 63d89d2553fdd10f247555f8e3661317b6d9148c
SHA512 84d845ec8c1f38a608eda315207a441886cfdbcb677eba06853f6177a15557997f5dcd32093ef420a43b0767c33d6dc331de01538dffe03b41479947af68cd5e
SSDEEP 24576:iPUr+NQz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJQzLNiXicJFFRGNzj3
TLSH
T10D65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1f66091c08e86282fe36a79f89adcd5db4dd5fdee80c2dc50685dedc192d5149
MD5 74b46ab1cd55c63be6c2a03fdb3baf69
SHA1 2b22bcf97d38d638816bd97b74c57ac473b00ab9
SHA512 307b0f9cc286ea147511a542419c10ad77a6a2749f8ddcfcd8a999c043c22c55bc81a9d0cf032fcfcc5848233da6fb3904e78822bb39a76d1493e7934cc65ab5
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjLNiXicJFFRGNzj3:mG05lO43bu7wRGpj3
TLSH
T18BD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5af158c4e5822ee1f9990d77a41e57f0056f9efbc7cbcf98129575f5acc272e8
MD5 d94c8ee1e260b156c37b38fcc889bc9a
SHA1 f4a50d3fe30bf71b495ee8f596f318934f031902
SHA512 190eef453d08ee2699ba2ca0b9daebb058e56cc1734a048c27c789ee34681fcfca17e924965a32f1a67d743dff726a4e7bd784902296101589064c9efa21b655
SSDEEP 24576:xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnV/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ra5POZ3lJt2pasx2+mbLNiXicJFFRGNf
TLSH
T16965BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 487499f5a3f0e961a22f2c8b1d9161cfca271502bf131f3a8e78e5f4a0d96d85
MD5 55df2e27179a56303bfc0b087011096e
SHA1 65e1811134174a114daf0dc130a651abc2ecdc36
SHA512 ac2ce61fc478e51cd07f4ee7c87bbe7ea2f798c898ac2850132f2e84199ee41dd0215c11a027111a5ba46d910a082be73177ed42a9a36a1a4c0b0d05bc50e86b
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7Fk3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Nc/zEOVHFkLNiXicJFFRGNzj3
TLSH
T1C6858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 130a303b74798de25f3d1ab24c08290be0430f2f90e51b1cf35196451f1bc016
MD5 3c42566d3de224d88eaa01da608bf306
SHA1 796ca75ed88bf744fdbff26e51eeb9aa13d56d74
SHA512 97c96488662f4d68269bf11e6a4211878c8ced1cfb02ed4e13cc8b6b413e3f960b0c99070fb2e1d2f4c18ff31c451b284aa9336a57d8ac2969975a990209f362
SSDEEP 24576:3zkNvNnaFeYhJNtmZBmh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3zMwBtOmhLNiXicJFFRGNzj3
TLSH
T13D55AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e1856985a3e0b54140be52557cff5a5e2d223ad18193396b3e3b4de78add3fc8
MD5 2636c161c7f8e2d094792ef126493709
SHA1 811a0421efcd20f094eb9dcd45a0bcc0703bdf1b
SHA512 ef3872323faff9e16a7feedfd21de5699fee0f78a3ffe1148d0c237867f516e09cc1ebefa2a1159ac160ab4c9902095a82e83a00a9e2b1ba98013cbde7562a42
SSDEEP 24576:bD3FHshBIYQgA+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bDVHeBIAA+LNiXicJFFRGNzj3
TLSH
T12375E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/252-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1364-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1364-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1364-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1364-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1388-328-0x000002533C820000-0x000002533C911000-memory.dmp

Download

memory/1464-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1464-47-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1464-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1464-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1464-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2196-294-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2196-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2196-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2196-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2788-67-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2788-69-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2788-74-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2788-309-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3044-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3044-329-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3044-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3044-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3044-91-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3044-97-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3524-129-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3524-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3524-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3524-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3524-138-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3560-79-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/3560-310-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3560-85-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/3560-84-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4544-315-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4544-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4544-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4544-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4544-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4544-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4948-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4948-124-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4948-122-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5736-0-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5736-78-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5736-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/5736-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/5736-8-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/5900-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download