stealc | 96645509032398aef3d0dafff6767c7f3519c96df5c712f3857391ba649b519a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260915-wrc86ayzhv
SHA256 96645509032398aef3d0dafff6767c7f3519c96df5c712f3857391ba649b519a
MD5 54c0b2771ec4212d30dbc0c84ce6abcb
SHA1 4b4cddef4c5becebf271e72374615a1510ae52f5
SHA512 d3668c89a3538bea7e2724e1fa15b80c0da956d6dca032cee73984de44d6df120fbdc2029d06575f661e87b328000911bac5996b84fa52a1a3e5e4145767f9e7
SSDEEP 24576:QLBMAf0XHKDunAQLXimunrrhX4TOet62R6yz/TwSfVcYG3K/cJHlnFR+IGNe8j3w:QtYaDYzymsNiOEfLNiXicJFFRGNzj3
TLSH
T10185BE8997A401F8D5F7E275C8266903DA72FCA9077056DB0290338E7F3B6A1CE79712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/2212-89-0x0000000140000000-0x00000001401B6000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
2536	elevation_service.exe
4160	elevation_service.exe
4620	maintenanceservice.exe
5620	OSE.EXE
2952	PerceptionSimulationService.exe
52	perfhost.exe
4500	ReFsDedupSvc.exe
2364	SensorDataService.exe
5856	ssh-agent.exe
4372	AgentService.exe
3048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1c9bc4c2e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6fe0c533d45dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3e132513d45dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095db99943d45dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf852a523d45dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfa331533d45dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014cc67533d45dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000088f614533d45dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4372	AgentService.exe
Token: 33	3048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeDebugPrivilege	2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2212	2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2536	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3380	3048	SearchIndexer.exe	100
PID 3048 wrote to memory of 2680	3048	SearchIndexer.exe	101
PID 3048 wrote to memory of 1328	3048	SearchIndexer.exe	102
PID 3048 wrote to memory of 5932	3048	SearchIndexer.exe	103
PID 3048 wrote to memory of 4580	3048	SearchIndexer.exe	105
PID 3048 wrote to memory of 1100	3048	SearchIndexer.exe	106
PID 3048 wrote to memory of 4260	3048	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4160

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2952

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:52

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a0d76a779374ea813d9c4ec4c9d21a836cf1f827e26fdc81216c326318e3aed3
MD5 dff62458bc93e7a3e504fe8e7be77a5a
SHA1 81e6cbb2c962d4e3e380fcb9be37594e9aaa580e
SHA512 b086d6c4312eb86aa38f0023e4a9118b64cb42a6be4045031b8caa39a0cb3d26c34e4a33116afa720fd941e927320992acda23ff08a8dace96bce3bb5f98a678
SSDEEP 49152:pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnZLNiXicJFFRGNzj3:/3q6mjBq7wRGpj3
TLSH
T1E1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f9650eca76e5e69ee857315906ab401e77457a01ec8145d1977dc0d99d062286
MD5 5a54dee5eb68436cbbe87c3cc1b503d2
SHA1 a2d2f3b28663520ea21d20d77148d3955ba486b8
SHA512 30ce6b47edccc2f53faa779bca77bf31fee0688fdcd4dcddc0717c311322e5facdccc813c8290c2726456b5e378046f4bc39f5ec87f80298aa6a85373e34eebd
SSDEEP 24576:lXYfDtczAO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wtcbLNiXicJFFRGNzj3
TLSH
T1E675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 27c428e2475420cf9808f606fab0f7cc8ef16ae6c7b10d084289e2d6f819492e
MD5 b3494a88d65623eee7daa172e480a3e3
SHA1 2e53a9536b4b7e49acd938dc77a29775fb518ff5
SHA512 f82609454cd90640a52242dca1d7198065c79aa7cff67e453c0286c43bdd8f64f7c8c23ecf0862960461725668348c8bad9204a2459490e75dd7b463948a314d
SSDEEP 24576:40Le5ji0hmxhrMx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4Pji0Az0LNiXicJFFRGNzj3
TLSH
T18E859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 689e5662b36fea726b17171bc009e25aa05127dad2fa9b06e9a4a1b042269579
MD5 5f80ce6f6d977f6897203a3b1964791a
SHA1 10f4e56660be5adab2ab52849368235099624801
SHA512 3261ee15dbfb5e06e50fbb589d7ce00e4f97446ddbcf468f2ebc57dda5cded23371de80c4ec62c786686f8505c35f14203f979d9dce1d68c4bf86205e56148e6
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWj6q8wyuL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9/ezSC6vUzPv+HjyoLNiXicJFFRGNzj3
TLSH
T174756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bed7655faa512b6ad4493926a5bf15ae7e1af7f0b65fbad608817a4a76b13b9f
MD5 062abd2991cbd1de75e69deff20fdeb2
SHA1 6046ce041fc783b79bcc7aa2ee8d4eafc900a999
SHA512 3afa3c6df1a32fd6d62a1771ee369e5bcca86011e57712a1ffb2e084231f07a0ae88736284fd3c07a7a1d0d612e82a5df37d959addb0278e802edb8d65426bc3
SSDEEP 24576:ZVbqPb88hv/l+Ba/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZVO88hXl+ULNiXicJFFRGNzj3
TLSH
T12B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fd043bb5ce4a2fc6b0dcfb1415b94be7d384d35ac5219c96e8ea3659e33152e2
MD5 3119d3e2ca6d856d53735f43886793e6
SHA1 ce2d30ad42c99bfab8f5d83937c4926a3e8cdf07
SHA512 aafe1d22e1a46e85b5ed756f94135099ec1a85dc2ee49ea1c003043f5b24019de5fa0a23c1729cf1bb6280a884d8d78d111efea8d6643da5eaecf015aa55b2f3
SSDEEP 24576:QG9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
TLSH
T1C15523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9be60cbb62865988f43f45f6fee5c0b275ccef0a04243d2a0108f646d4b632b5
MD5 6fef75f07e427dd5c5838bb8b54fe444
SHA1 68e5c73f297fe387fd0ecc96c51fc525a95b47d0
SHA512 7a416a53cf0e2a041cab125d1aa04ef0148f3240a18ee299964a8eef8fe33f98d990ff28788e761dd63f7418c5e9376884c053773622cd8c5025ff0683fa86d5
SSDEEP 24576:wJIUS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wJIUSLNiXicJFFRGNzj3
TLSH
T1DC75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 13523b4c6f5b40319178ee3fdc5dc749cec9b440f4f5fe213ae5647e8de4b001
MD5 cc666028a0b337ac3623024f325dcbbd
SHA1 deada6ae659853ee58260d2eb0f28d6f3582b047
SHA512 1b51901bf47f16f0f7a66c9f001d9b9c9ccac7620d957b7b215e448655b054194a60d959fbff8808d228c87020e964851125409973e1aa39e552b7dfb246bbdd
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THM:9QvGAdlCEL8c/WRNw5C77wRGpj3
TLSH
T116266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b3f2a6bebddc639035655144434ed0372ee251d29e41097c3c62c6f3e1479945
MD5 f265657028506799073bba88d2f512df
SHA1 fcb52dc6bef7990c14a6188959f209ecd398a3c0
SHA512 ce99e7e6655ef6bfd3e82500ce795e9cec1d0aeac2c1fc523c0f658fa7ddf6a5d2004bd29f5a2229614fcf41fc7c6907429674b4a73184398e9f00ec11912785
SSDEEP 24576:kfewsAjk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ljkLNiXicJFFRGNzj3
TLSH
T12D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3f72010070f4d69a9f131a833c6e6fbc782204cdf333cdc12acf13d3ef4d49b1
MD5 0875eedda70c76e1b17f20c55cabf40e
SHA1 694b2a06654bc97a4ec00e2a2be5f007fe53cbd6
SHA512 dcc2917b3c2b9cd1a87786043e79f31ebdf3d9d6d83b33e15845139d82268a7e322273ac6c21cbee538f25c430e719dd06f84c8157400896dbe1264668215619
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHoF9:cUEtQevvqc2W1cpV20I32c9
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 55c7a715170b4b14246d0e61752da2e65cc00048ab15893b2baed25b0924c3a4
MD5 20e3297756be1a4d80a643886065cf0a
SHA1 d56f354c008119583384db148aa4945d3d7f0706
SHA512 3f6100d468aca6629e33538e8e4edee29fb36381d79a5a2d2626e1d38132837210eee9841acc74f748dfc7b84d35e9793710d06b8afcb13ade323a31b03b97b6
SSDEEP 49152:gCbRquA/m2yL5zLfFiV+XenmE3/zELNiXicJFFRGNzj3:poq2Vjnmf7wRGpj3
TLSH
T1BAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b958e7f9cb32a6347ba12b14f7fb635ce761ab86da99df4cae542b87ebd661ec
MD5 096161f9560688af7b3fef3af37eb4df
SHA1 3741f78b9413584df29d5b83f36c26d45c3f647c
SHA512 37ca4b35f3e5b62343ebeae33495e8439298b86f35544d2747795c360cd158dbdbd12732a3640dbfe22e4c526f98123e790b56f08913e4fdd8e0fbd31d008ec3
SSDEEP 24576:iAhGL6IFoiwtA5l7S53//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iAM5Foiq5PLNiXicJFFRGNzj3
TLSH
T1F0359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9d510e27d2945f7efbff2c7a17266991539a6bc405cc3c3f71afa1ce2fec26ad
MD5 743c64d51b19e21fd59d28cf442a3821
SHA1 0849ce6174bccef7b42be64f20e2314dca7b87e2
SHA512 8bbb9e817f2223433d8e2e73515d465aea297091f0e7c55b69d560b581d00fd31259bf42a9792ce98f79b802f223f6196b60400716b1f093b09ac40e15bf0d8d
SSDEEP 24576:8wuROWI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8wSOjLNiXicJFFRGNzj3
TLSH
T15D65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 32e055f9cc29e351e43254d03344f160077c68d3532b763cfaf2cda88caa74b2
MD5 fd0f0c0b43c4048ea462cb678e0fae3c
SHA1 382a421b5c1dd763cad2428e2f811a70aefc3f8d
SHA512 d954ef25bcf7d4591e7dbed93c7ac8ba7dfee79f5d0cda13207c7aa379874434832cdb8118fe3a1cf28869172d8e863f4b5655d7b89b73fcc4b034f9a4578f49
SSDEEP 24576:pZuJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T11855129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ef27efcd295e4034051ad3f69cf029fbecf55da694831907b0cb30d48fa5057d
MD5 08055f831752470203fc0ba816b0788e
SHA1 7388a7d8858c78a88b918148eadab523ff6e7e27
SHA512 d4a6cbac915bb12fc74b5c5e232ed157c2f4d9d8f49e3bab1e8b619e3518863bd26dcce5d628cf0aad937aa86aceac7e574e95d58aa3837977a275aa704898c5
SSDEEP 98304:9QRQyi36YOcPDLvw2gAf+PN3G7wRGpj3:0QyiKanX+PNaF9
TLSH
T1B0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cf19b185c5bc27b75e96a2fff18961800e605ba205ab07c4d67847ecdcb134b0
MD5 354f7f0a5c59baf229089966c1d271c4
SHA1 c36ddea9e2005ed18e49b6f4725699e66384d68f
SHA512 11b472f6c362ac5e0a90ec4a564a00e211a9c61b82d9d4a11a1eca59a2ec5735daa2f76d051c6d58c294130d4435d77e97566ed838e8cd8ae20f376987d385c4
SSDEEP 98304:IQRQyi36YOcPDLvw2gAf+PN3G7wRGpj3:fQyiKanX+PNaF9
TLSH
T141667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8bf6608639d04635fe4dd9c39c4fa88cd9ba6144b884a5373511dc11c0cc52ec
MD5 3171bebb1e49c8aa8f1e1351500c918c
SHA1 b0cbd6cc05cb8181ed0a7816e11ce5fe96b58908
SHA512 37b290df63feb40f441ffe4296e6d8cd886341044962f30e74e2edf3fd073c307982ad2ce9b233188d5dd1b999eaa5b5a8422d50e5b552c862fe8377a6cbf628
SSDEEP 49152:g68Qg55nhkeWu7PNU3/0LNiXicJFFRGNzj3:athTRc/07wRGpj3
TLSH
T121B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff02fa0c7dcbf6b7c294505774f802c25a298ab719e5b5c502c8ac72abacd226
MD5 bf4bbd61509152eb2bf3671fdb229563
SHA1 8be4c2a980ae539fddf20876eaa21f399699d17d
SHA512 12b4127fc9a1cf54a85a4e9595434af2a4ff2edf656d791eded8b479e7f1cbdafaa19216ac781f5578c82fa7a93afd0d4a4fa40bb28b8c328564058e4c08c743
SSDEEP 98304:Dy5112gYy5azzVvU69nLKnhZ97wRGpj3:eLIHRWh7F9
TLSH
T1C5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cb7dcfe5a04128b4296156fef9869fe61fe80fb1324bcd8dcec76c1bc51dc55f
MD5 4b71f3b3b0a49429ce7683200c4380a3
SHA1 0431b27ed183e592b31807d9a6754861724d0ed7
SHA512 a395ce1a22a82569d79d153003d723831fc16c3da0834393182c368d7e473943cdc7e7f217bcb9ea11a8be67c7db8c1fc73b6e5f052d21e8f6124d561187f93c
SSDEEP 49152:oB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gleLNiXicJFFRGNzj3:iu6JmIxd2de7wRGpj3
TLSH
T1C7D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 94a4d4b8258815fbdb27b8f32382b3f15f9627f3a0c9726e247eb9cc24167baf
MD5 559b13fcc0cdb5fc04b2e935b85ef5b7
SHA1 3aecd08dfad6b8c9041f9acd994621f07cc214ad
SHA512 bbe27366aaea4cfc9f34297fb3df56cd708dac8e05395ae1777a2e2bcebd7edda4350b56e6c6ba7fc9c1d4e86b6a9cf28bd60de7554264d1e91c20dd6da97d3a
SSDEEP 49152:g1hpsNoJpF1A67U44CwH7R4xyLNiXicJFFRGNzj3:gmifPqRf7wRGpj3
TLSH
T1D8B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 21379d5a05e40f6c685589dcdaa65effb9f02d99c7457d02ee7cccedbd5bbddd
MD5 e696ecd49413023f5717bb249ec3354e
SHA1 5f3fc4ad6c0a589b4bb22a6777d86bca7399a8bb
SHA512 8ed276f06a4ec7df6d042826d0435525475dac063754d8ac18fc3419ca66858d6dc015083a8192a75f4c7b5f7de57f863f9fc7bfe468059a9181e9d1a7c773c2
SSDEEP 49152:JSuZQIY0Be2KkRVtOnks6NMHqJLNiXicJFFRGNzj3:H5dKqi61J7wRGpj3
TLSH
T198C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 90133c860fefe6d3ece36457e5316b340ff7a000868c93d1cca4cf69a6449433
MD5 6c0305114a73b20dd5f4d888276eb7be
SHA1 1bb5b6b942ffc7d0b9ba0c3cd2b107e12c1ec89c
SHA512 369e7c6b9e5f1fa738a533ec800855076f0d70085453bc0760492f67943a11b68351238b73e971c736496ba17b09d3aaa6a34cb81ca106b5f04f18807942924e
SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5wOLNiXicJFFRGNzj3:/X2iWphD7wRGpj3
TLSH
T13A95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 555090cce458e10abc8321164f1f8488ca8ff5f61571c81b9f3745d9abecbfc0
MD5 9892339275e22de8c22b36c912d31637
SHA1 ddd39dea9fb4df72e69e88278702e90072865ea2
SHA512 99a0901345c835cbdea5732d20ba2bc736385d9092edd6323c5c404db334b0dc1d46225c5779598cea8f13cc6ac7e014821769d75b92ac8bd3b612903c0f5f5c
SSDEEP 12288:epiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD5523D3558955B2FAFC0039C6754428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f18a8fa6bdfde2b342808f7bed0379064856f6b17b0b97d2071df329d8d60919
MD5 9c886df53260656b34fe95a5181a28d4
SHA1 76570a3749d8679ea3872cf46001c6a1abef99e8
SHA512 cc2a5db0be55c14052686a63aecbdf00cc3f0af1aee8f51499f9010852ae79da9ce235a9197aa2116bc97c6d29dea33cc96caacf705ec400e261408d1a5ea677
SSDEEP 12288:2GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3548955B2EBBC0039C6754428F5881E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d6e8a40de67cd75a777b9fc6e1311fc873d0d29d852d6650162ec4251383dd5e
MD5 9e2da7a68280ec6284dadb7969eb883c
SHA1 5890efbc7014f9307d098f8d228a53ea5b3a7939
SHA512 0952aca8ee339198165d26d17ada4ece56d803ee885eba1997d6fa9be579599fd91f7236965a293f0e6a3ae543dd295c4dbc3561074afbaf3bced3c90e2d980e
SSDEEP 12288:vYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2cf3841aff2afd1fc9af25bea179212880e2b5cb25401d60eb6294c02e88b203
MD5 c40935e323d147bc06e9e4cf3bc82ac9
SHA1 3fec71165d0aa54d5228d0b3300befaef8f84350
SHA512 5d6fd30363e56191b6ec48360e900b5e0cca4c6d2749db92904d1dff8c70b28d32cf066deea20c6e918a515a51dd600d18de93b986f7a4ef4609a00ab94ef712
SSDEEP 12288:tVLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B1552393168900E1EAFD8039C6764424F2A47D6DD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4d65bd44417a6e692fabe8cbb57332eb4b25f83792bb1ddba3e80871ad02aaa7
MD5 6ef4d89e55fd9dc5428a3a61f02154e0
SHA1 544575eabb8283960538371206f3be384bd301f8
SHA512 77551aee46968866ef0c84b3e3537447ca830e2028ad50b1ab7612b946527417a28e11d4dcaf148085c1e0c89daf1e3a3df11f7c397d28133fc6b1899110505a
SSDEEP 12288:eziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EE5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5e4a1d6a9e2e82203e48f154c629df7024ebcd31ad15ba9346250d60e9f63a22
MD5 3a7aa2f69aa1834930cc52a46bdfa03e
SHA1 709c97f5b33608224d3cf430e0bab8c2a478fe7a
SHA512 95ec6f270cd6d71429782e70b3dc2055b927555d11e63a8c6a764794de72d9b3804b53773379b2dde5a0993db988eae4a07e0204b57e7380d68740098ca093b0
SSDEEP 12288:e6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ec/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3548955B2EABC0039C6754428F5881E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7fa7b0dd1fa2bc7aa0742f2c7a9ef45419962707f757c892c570646b15bd7f6b
MD5 324863d6356b2e6e1277448e738126c9
SHA1 f5dbf04c8301bc310b9d795df4b103508be6f20a
SHA512 58fc9f5f463f5d67ecc133c1bcf5b15735df04e1e08c27265be94f80eb72550c37c33b25589e7d1957b1193990d1306ef8e5c95040d0e0a48bd2a9912a243a60
SSDEEP 12288:IuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3548955B1EBBC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8dc3f4b3c587e65ff40f7810639cbd9230d7405c863aec67d7027d97c04cfd18
MD5 cc893837d3a08678c63615aea0e189dd
SHA1 b4b4418d15da6b86d89702ed4317b8731d60420c
SHA512 1d19e8874edeeaaca3b014841427142445dc8eda2f22907092edd3f1a6bf5b907725613c59333fd09f0cabe4226e9e0bbd82253af57b7ad23af2a2d30092b720
SSDEEP 24576:XZM3zFVSOQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XZM3zfMLNiXicJFFRGNzj3
TLSH
T1AD750295B39018F4ECB7813EC9258815E6B27C1A4B70C65F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8a1fcb5511f01d05609c58b20c56b112baaa7ed8623840ab557d8eb2c9da9925
MD5 85930c37565c0dfe3bf3f77956295a75
SHA1 a4cf69b32f4be478dd35c8f17aebb855209a8cd3
SHA512 9279732fd07a4338717a66c3ea02e3bf8b6eff3febc68b0798d98679dcde304e8f2344380af8db6ec7f572aeeaabdb4d333e33d4867acf400955a4be9b29c204
SSDEEP 12288:fViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3558955B1FBFC0039C6754428F5882E2DEB5619E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 35b2c82627aeba2526688c3d6db33730c41a8951c277ded3b15262846a712d6c
MD5 27e48cc89aba6838255a2ced12537481
SHA1 26b834353ee5a03b2fac4c0d7b37eaba780f4f2d
SHA512 80e7a4167f25895bb8b23db186179c28868dbc917d073ffaa75cfa4eabee260c3359de00a773b0d72b32ba794230e89937e0e70e06732f1ad272fa35439466cd
SSDEEP 12288:UBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3548955B1FBBC0039C6754428F5886E2DEB5659E3E2083D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fb4d6f95978d753a4e562e9f76ffd617011df65550789a331669da564c3cfef2
MD5 25aa7aabb6a09d138167ab7ec2ea7bec
SHA1 48f49a48d406dd70172e48a723bcf620e0c02321
SHA512 b639a06ad98e30dd8870e9832943cf7f07a3dc03ef2c8da8e41938ddce41c2736dd1938a97e2fa28898a8c1e0632ace1579b615f4bc8931fa95936359ed89003
SSDEEP 24576:izyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iDLNiXicJFFRGNzj3
TLSH
T1FD650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 474d20567da31fceb89fbe0ca491853dd6f8c19bf821ccc3e8d591fd6e8ce50c
MD5 46a843a55dc726ce98d07f62addf1678
SHA1 050910a6e3bb5189f1ea271b08cda3504a65b648
SHA512 172feac6e0a9851ad1d047476ed741b81043bc35d02910e407e7817d715fbb4fcac0d288dce2ba2f21151e58df2e18c0a73fff6c01236de749b9553bc3edbc31
SSDEEP 12288:sViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 20deddb06f0c19252c137985c1b77a53f88a3e2f386089c0e7f6f4c92f41af87
MD5 de19c7b8dcc12d055bd6383a3035ce71
SHA1 8e3006882bda1678cebb18ac857416f0dd4c5575
SHA512 04396053d5c52b0ef932f8b50e61eac34a2a48143749922fc3cb089b062f9084e4213461d8ef7a49ca137a64e84c67ef2b06ca7c27b4e766b3edad575d9f2b09
SSDEEP 12288:VViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3548955B1FBFC0039C6754428F5882E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 022429acdb476322b4b7d245e413fec543f7c5fd049e6b650d7d80d42512a400
MD5 3fd2fdefdb581e4bec8eb4bc4176f4e3
SHA1 275c26e87a10f3a221c7739ba5445f095fde503a
SHA512 1f4d28722bc34f29f37d220cd6adf1b69b4219ebef1dc12899aaeb291aff1be80353aa061e1d0297bd1e8c8be5ca79ca3ebd290c0612be80b0e2c41f28c119a5
SSDEEP 24576:KzyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KDLNiXicJFFRGNzj3
TLSH
T120650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 df2563e467cb251e6fad51ae1ccdcd230f86529930521a5b46351d3b3d11100c
MD5 4bb3149b8d15227edd0e05d761acbe66
SHA1 dc33606ed2fc61b05b494e3407bdf8ad5562a969
SHA512 831c18cd1423ae700ac104af238f8d243d061be97c48e38bd33eb1495a990b5dedfd999d214e0adf14c6289e7ab3d03109090528ed8339de19293fb411786d34
SSDEEP 24576:WT8aLl3z0zD6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WT7LljLLNiXicJFFRGNzj3
TLSH
T1E07502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e64aa55a8b50cbbcd57c04d3e7e5602735bd7203bfcc8e8aeedf7648023f3b77
MD5 e505e0968496f5e6b353af583424caf0
SHA1 a09123c70272a8f4efe3695a26aa0288e1a312e7
SHA512 17e903dd9789f06682815524b5936f86f93f9c196459aeaeb13db40aff577082fcdbd0b1e4a58785badc1c3743ca2e4a80deebc01afdff2459fd0b6b5281b76d
SSDEEP 24576:K3rd9CHKy7GZm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:srd9CHKyaMLNiXicJFFRGNzj3
TLSH
T16385CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1916d5634207ab19988f8faa79f881f0322bc7a04476360ad05ac7970e9000eb
MD5 0acc24c28fd300cef5b62f8734d5720c
SHA1 6d71c7fec11d4ece09104531c8d022b2c8fa7079
SHA512 77029f8665a000fc092d390070c3fc6a4ae220808d7371a46bb789c03eeacb66f95ff3d0c77451aa9be82d403f8ea90c74213b6f17a93f188ca0eb1ca77aea1f
SSDEEP 12288:E4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 92f562bb43262bba62cea8c4fa3e8466f7f0b1e47bf5aa67932be881a90c8a28
MD5 26f61dda415441395fb4e30662ea494c
SHA1 411a1615c386555e3c27e5bde7dee1fe6d75ef2f
SHA512 8a1c901cc7dad9b863a8de1dead12ce625881b02e2cca2a5856a8504308d42a3398dc7de9c7dcb22c6fd04ca84d03a97544466c774122e153aca104ccbff14fe
SSDEEP 12288:bSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D2558955F1FABC003986754428F5882E2DDB6619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b83289057ed6af4300b327ae6f3f02fac7a86981153fa31d069b8285754a0bdc
MD5 cc1bcfa246a8b20ecf15a5a96046132d
SHA1 a635d810d50c8557a9b04748f6c6b73fcbe9592e
SHA512 5272afa3584472edafadfd0c294372af887a869be894b35a97b16a62c8dabf312bf711d71a4c6d05b36d9afa2860586b2ca125afb5589d54c756471e1307658b
SSDEEP 12288:JHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19E5523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1170c6e6ec84324d01e4d84bdbcea7222caac1e982f4b16c7cc871841562d698
MD5 2984f1fa1bfa86178aa634049de4c6d4
SHA1 ee3b85a1347b66a37f6f9c286fc1872863f7044b
SHA512 f33ead3e513e7eb279b49cb463b40562f638ef38ec9dba524cf1aeac6cde1fa810067b27895052c199364811886dd47ec43582a29c7373a9c74476bd182b95bc
SSDEEP 12288:1ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:15/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D3548955B1FBFC0039C6754428F5882E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f4d84e356c9f8e28054542f26be6df927a567391296159d3c2fc936c7d32e647
MD5 931be16534cf3a44f9d270eb95f12673
SHA1 7b3865899971f20b2563033ca89bae8d72b16316
SHA512 98f3a84e6443ac50701cb2b7a5b9a5d091beb2067fa46834b2a87b7eb0013c982eed16eec1cf47d96302425a66ad26937cd8412bc18785fb096df9d8ac29563c
SSDEEP 12288:p4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 330bd45e3ffbeff9cc270970124b85c5033187849b3e8cc2277526d4a38b6f96
MD5 77f635efc9390b4c4c71d4f9753db22b
SHA1 9c143ad6abdacf9535d2527a686656b1808aa1e0
SHA512 864ea9d372fefb8c2459ec8b65217c11385c3afac93ec91bc2bd5012fbe8a0158d8aee6291dc746ce067fefbc94240b9b13154624d406d522323a4457dee25e4
SSDEEP 12288:4diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3548955F1EABC003AC6754428F5881E2DEB5659E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 fff535499552744203199c2c2b1741cafc9344127a4e47927338906bff0c4b92
MD5 df5988fc71cfabba31d6a1f52648142a
SHA1 c8e92ed28ed0057fa7404ee05bc4744607ad7878
SHA512 9927d74ab1476061d8ae6efea1a02164e71a81419da15816725177fa3c50a2aedbfcea8efa5183c505c3f45d2cbe580b159bcb19d547e12e7edd06db620c786a
SSDEEP 12288:cziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1e9ff4db130cb26e1c4d8573837ab8ccc4c51e0c7e1c7732482a1e8f32e7b984
MD5 0825fc209c140fd03cc25276059c075f
SHA1 ad164300f529e90dba1ddab064304abfd2946adb
SHA512 12e124e19b147c4799934cd7fa0a6374984751c851ab16e2679d4d9760ade2ee581a25c8855b80d40fe54a6ade268685593ebf6f850b32654dc9ae69166ad16d
SSDEEP 24576:Bfwvzk9RX6wkyAId/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gMnYIdLNiXicJFFRGNzj3
TLSH
T1A985DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2ca4d818f31b5c8c60a337ea988af44a6de7dadb74fe53688b093d57a6c372c5
MD5 22036011fe352655e04ec1b2a5e8fb35
SHA1 c0c16203daddae6736f0ae873fb57f850bd5104a
SHA512 8b5e4089f5ed7d09e27e1b0bf9d4e29666ad9fd9cd5bb77d0ba148c064abdd8436a5bd3abe109fa034a8fb841fbaa0fab024803b7759c34cb4d3cfcc7e498578
SSDEEP 49152:6YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uLNiXicJFFRGN:lySzPm7wRGpj3
TLSH
T13B066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3e5e28dea4f376889cb2b741aca84057903c30634b47585f110cbc8f32ac08fc
MD5 9d0c57746c72514fe197ccc3ba933b29
SHA1 8d1e46c09f50986bba611833ac073a3513d6b29e
SHA512 15084bbb0150a1d768c0054f8719fc5568b9b004a3dbae416fdeb4058e653633c412b925ef9f03480acdd3ece07ac6a28878cd1ed53afa1322bbfcfeca0c9837
SSDEEP 24576:b47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b47JUQjqirIhCnDHUPfF/eLNiXicJFFS
TLSH
T19365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f8b62c62d2cb8b31cd825c8579a44a53ac7effde43ace09ca735d7ea651c596e
MD5 aaf6f65be31a25bc8d6cc42ef644ebe9
SHA1 a1aa4f7bedb506ab54d53b3fe8b11a71ee29053a
SHA512 88f95c50d10ac2a2404539d2963a48282663a0017b28e3537b298682452d90632809e9561447d16cde8a7942e1cc792bf9f1ea56a191bf67b1302d481add70e1
SSDEEP 12288:mpsfFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10665F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92D0F93E1F39AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 41816edf5c29da723383bf3c042dfc298a5007dd9be3f6151a0b399cb4fb8c42
MD5 49ce0e6e1a73acbcfc2c0a138e338775
SHA1 5aea3fb0576f5bc6113e6c0c3c3752125955194e
SHA512 d7f974fcd5b229fd0d55c0e06210deeed39434cf544d48cf3ee61b0a8a85dc96cc761d7423c8c54dffa4baba6c16636404e241c75a231517efc6713555a4f2c7
SSDEEP 12288:wO+z2U3f8ZNCODRYnh5Sf4A4OAaIgsEyqI8DpS:wO+aUP8SOkk4A4NaIgHyqI8Dk
TLSH
T1BB4506507626DB8FC66940321E36D6CCA7707C05FE486F0773C9873F9476A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 279774cbb8040f9a22c30372b7722a3cd54aec9f7a7e2020a5f9dfe8d9120f51
MD5 fdf9844a023746e6eee4e6e164e00592
SHA1 139370bfbfc75e30e5c86c97573793f3f838dc68
SHA512 a2b072ab3bdcefad62478d597facc1fd7025bc8bc44731f2abd1aafc8837ce3af9ca46049db2f7b856668c513890c9452b880c259665268b420359c4eac7bf30
SSDEEP 12288:LyMWElPGgU9xw26YY0vKBDjaRtRLtg0hFf41z8CZyKwK:LyMzvGC7LI2DjaRtcz8+ydK
TLSH
T1AE652A4065B7EB4FC97A5037433286CDAB746C06FB852F0173858D38987796EB6E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dbc997793586a1ef821811760504f4fde81166d6600945b2ee8392bad2e95653
MD5 bba96106a7c8b298deaf59f59e1af588
SHA1 4870427d184181a97ed1a9a2483f950a69c6365a
SHA512 9b54b08e04cbc5e3a068bb88905ac4d950a50c4ac355e9e5da24cb30746b5b0188f5a4cb1e9b46bba603cccda4e36e0997662139499e8e84183cc4f13a7d4642
SSDEEP 12288:CF7NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B552393468D59B1FAFD0039867A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3fba8fe979cb174ad532d531a97dc41d5cbde0a3cbd2dab84cfbd26da6976f46
MD5 acf1a661b87a7fbf7961e4173558bdc2
SHA1 9f1b43ab2d1c2503d4f22622b34f90c4052dd02c
SHA512 60bcd70c7fe57eda2c5436fa52a67a036b07268ded894179e64a2d824911c513dc76430c4a459306b534a85115a343e8ea17705fcef72386e59fda95b6ee44c0
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3gb4mBIBhGFALNiXicJFFRGNzj3
TLSH
T18665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 0291e26b00c4d6453dc373c56ae6c83087b2d844bb139d81bd4310b4af9996e2
MD5 c9267eadbbfe5a292b3a5cf0697cc2d2
SHA1 7a277ab516d10af78ea36645959bca801d5baabd
SHA512 d10a1d04a9d24beadb098e634068af11626c278baa9d42818dc950d5dc7bf55bbe23fefb147a75927d64926916db74fd9737ac9218efec177f0ca9c56f23fa89
SSDEEP 24576:fG88u8FpJqH1vzria7/mQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u7ZFPqVya7/TLNiXicJFFRGNzj3
TLSH
T1CD85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 25d7939f52e8826b9048e8566458009c8c7934ed6c800473ed3f640c863e4cbf
MD5 2cf54f49a26c76ec1e76f41f1c9bc709
SHA1 38c2e0b8b6b9f7a085c0459fa90808caa11988c6
SHA512 3577b6a721c657bda98573b2cefdccdc8389c39843e3c254a728aa500f8e60c0652abee82d68e3eb8018a9a9428696c5475a8bf256f248453b72e0e67a735ea0
SSDEEP 24576:5PUr+NQM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JQMLNiXicJFFRGNzj3
TLSH
T1A465F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5eb38fb6d61f7d6c8391a0058de843e76ddba1c0fdb50a0e49f0acdc47d2dccc
MD5 9cffa1032526aeb5ecbd666ee1f7178e
SHA1 dcad5cd5628e0be7906c3834d874cf64743a0cce
SHA512 c3b468d7b35288f0cb3a3e77376dbccb3a0df4a00fe0fa13f7e875cb61df6a1a6e3dd536f9e2f4ead886bd33939a98e9657d1ffccbeb3ee79088e8e597c7ef23
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcLNiXicJFFRGNzj3:1G05lO43bl7wRGpj3
TLSH
T1D5D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 98b9e07d57cf4b13aef55aff9a2478d026951858ca18acc7a50863df6bc21ea3
MD5 de62308f23bc517536369b921caee240
SHA1 36f4003a4ee60cc6777e6b9bd52cd69b72e6fc7f
SHA512 b0810c584bc7a1db6a73b32c100b3348ad9a10603462464c70986dafb245a1ef3fa05daf8cc36f0f576f9139c946d645b34cc310b54687aa3eab34b82cde7c61
SSDEEP 24576:3fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnu/TwSfVcYG3K/cJHlnFR+IGNe8jg:Pa5POZ3lJt2pasx2+m0LNiXicJFFRGNf
TLSH
T1DC65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d1bd30b4e70b505d06c60ef76299095e478fcd6d0d1912dec258d68037bec79e
MD5 ad8194a5dd30c1b199776d2532f13657
SHA1 e63ab4cd650d376436e965eb1c6a9a66a6216c08
SHA512 1990ab112108dafe051a956febcba6a752f94fd9b99db5b6c4ce15bb0a3988245620dfb03b3451a45d001bed01c5aa3c3815bf94e304f4dfb465aed0a54ec296
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fko/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xNc/zEOVHFzLNiXicJFFRGNzj3
TLSH
T1A3858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 87b6bf44bfba23e1c81c030eb5a064b25663319e24b7924b2a595e1844280b7c
MD5 a4e0c9618deb310c4b5785a3e0cc3315
SHA1 e792ec11ad2d0e1abbead207b6942d46e2431325
SHA512 ad45842dd7f202b81e0aaee35b26fb2246984dc989e1e47f994e6117d4a3b4ef9e90f3a663d3d6efa14c0e3561b1221eecfaaef27f689391e1e674f6b6d0d58c
SSDEEP 24576:RzkNvNnaFeYhJNtmZBmC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RzMwBtOmCLNiXicJFFRGNzj3
TLSH
T15855AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 972d7c8466074adb70674c78fe0aaf6c06968f6742e91b8c5d67aaaa59d4ff61
MD5 4789b4dc54f521d84ce4ffa12f128334
SHA1 8c871c5d905a50c6568f32cc342e3e5cf2e9b26e
SHA512 1b14775bef68f25270f7f514fa2ccf135f7e7d23f5059b7b1920663890ee4f98090061648e3b313b2a8e4c7da496bc1fe744729fb51d17b595f644735354199a
SSDEEP 24576:mD3FHshBIYQgAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mDVHeBIAAVLNiXicJFFRGNzj3
TLSH
T1BA75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-80-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/52-312-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/52-85-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/52-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2212-89-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2212-0-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2212-1-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2212-9-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2212-7-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2364-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2364-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2364-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2364-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2364-110-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2364-316-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2536-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2536-23-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2536-25-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2536-17-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2952-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2952-69-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2952-67-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2952-297-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3048-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3048-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3048-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3048-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4160-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4160-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4160-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4160-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4160-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4372-141-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4372-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4372-130-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4372-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4372-136-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4500-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-330-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4500-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4500-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4620-53-0x0000000001830000-0x0000000001890000-memory.dmp

Download

memory/4620-48-0x0000000001830000-0x0000000001890000-memory.dmp

Download

memory/4620-44-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4620-41-0x0000000001830000-0x0000000001890000-memory.dmp

Download

memory/4620-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5620-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5620-56-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5620-282-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5620-63-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5856-124-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5856-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5856-118-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5856-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download