f6911c84e17cb07dc3b6665bf1cb99c0333b4c31eefe760358a41196c0f94ce9

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 3.0MB
Sample260930-gpc32ssdmb
SHA256 f6911c84e17cb07dc3b6665bf1cb99c0333b4c31eefe760358a41196c0f94ce9
MD5 07066b37b9f175d0f6436cc003c0d7d5
SHA1 cb2322814ee2b3e1421958ad5f1856c612563f3c
SHA512 ee8763b9d86b51311a5f748f91d3ecdeb18346522990ebe923611fab9331acc48ab63ec476c9f1ee4b2cf51e5c7ef8c7b7df2287a1408c5ffa6e14771b8f2c6a
SSDEEP 49152:LgHsa8bDRvFhX9Vu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2oMvA9n/TDb2:K8vzVu0VLGMb5Cx0taAUgLdpq+Xvna9G
TLSH
T109E5E11A579D00EAD17AD37C8A964906D2B33C1AB3A05BDF03943A6D3F376D09E3A315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2148	elevation_service.exe
3492	elevation_service.exe
2328	maintenanceservice.exe
5892	OSE.EXE
5184	PerceptionSimulationService.exe
2880	perfhost.exe
2248	ReFsDedupSvc.exe
3496	SensorDataService.exe
3808	ssh-agent.exe
4640	AgentService.exe
3656	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2b84a6ed7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2484-0-0x0000000140000000-0x0000000140301000-memory.dmp	upx
behavioral2/memory/2484-75-0x0000000140000000-0x0000000140301000-memory.dmp	upx
behavioral2/files/0x0001000000009952-349.dat	upx
behavioral2/files/0x0001000000009337-347.dat	upx
behavioral2/files/0x00010000000093af-348.dat	upx
behavioral2/memory/2484-362-0x0000000140000000-0x0000000140301000-memory.dmp	upx
behavioral2/files/0x000100000000a304-361.dat	upx
behavioral2/files/0x000100000000a2c1-360.dat	upx
behavioral2/files/0x0001000000009371-359.dat	upx
behavioral2/files/0x000100000000a1d4-358.dat	upx
behavioral2/files/0x000100000000a0ce-357.dat	upx
behavioral2/files/0x000100000000ba3d-356.dat	upx
behavioral2/files/0x0001000000006215-355.dat	upx
behavioral2/files/0x0001000000009b92-354.dat	upx
behavioral2/files/0x0001000000009cfe-353.dat	upx
behavioral2/files/0x0001000000009cd6-352.dat	upx
behavioral2/files/0x000100000001b952-351.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000056b2a9c5a050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f6ed1c4a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000056751c5a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a93cfdc4a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4230103a150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2484	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2484	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
2148	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2484	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4640	AgentService.exe
Token: 33	3656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3656	SearchIndexer.exe
Token: SeBackupPrivilege	2484	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeRestorePrivilege	2484	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeSecurityPrivilege	2484	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2484	2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	3656	SearchIndexer.exe
Token: SeBackupPrivilege	2248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2248	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2148	elevation_service.exe
Token: SeDebugPrivilege	3492	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4296	3656	SearchIndexer.exe	99
PID 3656 wrote to memory of 5568	3656	SearchIndexer.exe	100
PID 3656 wrote to memory of 3564	3656	SearchIndexer.exe	101
PID 3656 wrote to memory of 2328	3656	SearchIndexer.exe	102
PID 3656 wrote to memory of 1556	3656	SearchIndexer.exe	104
PID 3656 wrote to memory of 4244	3656	SearchIndexer.exe	105
PID 3656 wrote to memory of 544	3656	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d99d2a370181ba36f6d1c7f5ec1f38397500dca2dbc17440f6be6ec5e793142e
MD5 4e56d46c0d412701aab5eb307b500cb0
SHA1 695c7a0be26507c539a3aee48272012fc25cbe03
SHA512 7bca5100b4ef2ca87133dc2ff03ef3a05c322838cb0fa2f377ca4176f708952aaec053d70ef0debc69e2347c13ce90c7fd022f052f3a6c74b110aaa70bc1262d
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxndA9n/TDbXNKd:e3q6HjB/fb9s
TLSH
T1DDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 afd865e4b2c78b07bcc97765de74cece2658f868876237615064d617f502fb6d
MD5 494ac6f230372f153ffda6752970af14
SHA1 48c15c9e55c57cad95c00605270a5bd88e820b04
SHA512 4646200529227d977a88e7e9f67097e0560346fa32a20e345a8315c390b4389c039708ee5c26d6878db7788d0bc1f00d9eec732bad2d1ca5c445312fcaf6d7d4
SSDEEP 49152:wxcHA9n/TDbXNKdXslFyKTmCDu+7A9n/TDbXNKd:wjfb9sXamC4fb9s
TLSH
T1E1E5236567F808F9CE57423DC8A1C604EA72BC4A5394D7DF03A866251F336C85E3EB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6152141cdd5a5afc98300a9d98334fbb1e66414ea08c3e5f8f0d841c88e0a012
MD5 62f9178d0820a1c6787f08097d42536f
SHA1 d35f4833f0876b354ba66568b58ceb719344376c
SHA512 c2541c896875f20b7bc1dc66ccafd6f6dbbc07d15175c3a738338beb42de7e4c8eec1d3efa1cb654f842b18ae788e93f8ed9997ce9eb64d090673442270fb22e
SSDEEP 24576:rXYfDtczA4UeA9n/TM4NZYeNm+9MhUwd:utcHA9n/TDbXNKd
TLSH
T17185012967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 23f23cfd0a6459b084468d2f89fec96613c0e01fc181308f09b094371674a678
MD5 737ea2358dacbc70187ff1d59ebfe533
SHA1 3008a17a38b19b33dbe84aa203843e47380ca4f5
SHA512 acad3ae5c70e0f64bec6b0d405e6d868f9eb0d7e35e033308b2a705e5ba5533ae74d2d70c76dc7d17870027689dff217ef9475761d2bbd5088f5eb1e08b2b5b4
SSDEEP 24576:X0Le5ji0hmxYrMJUeA9n/TM4NZYeNm+9MhUwd:XPji0A2IA9n/TDbXNKd
TLSH
T1BE959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b8b52467770294edf2268d38dba37363ace211605c7833024038d86bbb2adefd
MD5 a39bca906208da0a4792f831d1e83742
SHA1 9b50906fd5006ad1ee50b8c673364ac4d1104619
SHA512 92a31468dd8965054b52f5c2911d443fac854a7751af2e0b3361f1f3de433af07516c1b76b4f2fbd3faf589488af54facf70029002ec7a1868490a79fc0dc585
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuzUeA9n/TM4NZYeNm+9MhUwd:I/ezSC6vUzPvxHjycA9n/TDbXNKd
TLSH
T1E7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 05a3ece69ad70dc4c9d814fa59063a97cbdc4ec053ccd31f7415838d0f9863e3
MD5 a3c3355502b706fe195c0cf70d92f669
SHA1 7013958b27d113c58193cae45b5796e628bfca86
SHA512 166bc89846e67e07b4f91e5c90316f76076de3acda10cb1891644c3735fbf281de939ddc0c785a0c51b79a33aa147613fa0bad1d71a6896df5cb6a97570bba32
SSDEEP 24576:YVbqPb88hv/l+60UeA9n/TM4NZYeNm+9MhUwd:YVO88hXl+pA9n/TDbXNKd
TLSH
T13B559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d59c2b8630c60fffa12ae9e1bf2c41af0451baa3dcdc2dbfc9171b13111c2142
MD5 3c4877e9de7ef83a928304e766ee7b87
SHA1 72022234c1f67af39c05116e2fb2d076434abc25
SHA512 d3982640fbb9ab8c2aa8429b0aa80c0c1b859c385c26f1e4a8c31f75b35a4404364c415f6856bdffad56b7fa5736b780f05c08778c048b42fb9a8542e9dc29ef
SSDEEP 12288:vHVBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:vHVUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1516523824BFC08F1CB8E0A7544AABF0CCEA2FD4DE584879D4719762A5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 dc0618fb86d5b9a3fa9e1b0a1e1603afb5b92c3dc6db30c218c09b7139317e07
MD5 24f45fef32d6c43232d4bbd77a6cd84b
SHA1 797aab23dbf1d38dd431a2e117e208f9e0f9e702
SHA512 971004d7ebad130e51f415aa572d7d68504397a372a68d068f108db4807b5e9ddde1567b92cd774c8c7012b8631ad70fbb07159311d81680469dc8c61f92d35a
SSDEEP 12288:PeBNUbTVO86UMBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d6:PJIUMUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10385CF7BAE38ECE2C27E4DB956918700D77278304B5293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 52e8869c57a09f41044e1a419030465c877390f8531ccb964188dc0f8bdb55a6
MD5 894969347c4577987a4adb60bc5d1764
SHA1 e9443403598ef183286fe05e28dd6755bca89e4a
SHA512 dac669ebed56c7f2c8b1e59d72fcd65bf631d5c646d5268edaf60aacaa786c005308ff724c38a01f8c313b9902126171ba328f11a62b04a73006a56afedeb46d
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:ZQvGAdlCEL8c/yRNw5CUfb9s
TLSH
T137267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d22046de3a55b7e7470874e66978d38efc33619b1d23eff59b58c3e2b2a4a3d1
MD5 56bdb6b21c459a6f23739d70fa4f6054
SHA1 f063faef657dee8f2911cb8a5ec30e77ab822eee
SHA512 c6bab25ae295e2c5abc74eadcd699a84eb341fcbf22e5593aefa59af6a700e7d394a87a0aa056ff7c6c2daa0613b17f9e1631263dc6a0cc642853403d72db6d3
SSDEEP 12288:LAwSfxL/2Dc3SDLLmt0LDQewsAjOBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh93:07ewsAjOUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15F85E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89A9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75757dfdb8d3735515dfb4dd7805f18b0c570f3ff0639d2e120206cfcf15a36c
MD5 e371be56f313ed0267d84f2bb3e902d5
SHA1 286e6b1c0425f2abccc1c5e71f9d1e1fc1a179d3
SHA512 0a441c8b49392fc8af93b4a427ffd7ca254cb4ad9a0769add11a723cdf9799e864135421eb26c5add5a4a9cb0d226912ce57945d7c33aa9015ed43678ec55aaa
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHd9:/UEtQevvqc2W1cpV2EI32
TLSH
T131474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 820ee73d6173a2af89ede2e39d0f597cc2f3d75bc72d15e48e8091707c1e252f
MD5 f96a0c8b5c899ce420a6b634e4944d70
SHA1 b167c6138e358acddec9e35b0d3364ce8514af2a
SHA512 90a0f2afd2354897f0a5d9399f1720321360e6b4f615204458aadf32fe3d11a31f405d4a55288b29ca045a91fa93db8a31e6a124989362263df4022c62e0883f
SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/zYA9n/TDbXNKd:YoquVjnmQfb9s
TLSH
T116D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 84d36e237514c4d9e8ac8239ae5cad4c564eaf6e0acde12bba6e84a9d30834f2
MD5 843773af0864bbc392bc062d0fa9685f
SHA1 5f612736e12d42e0dabe7a22faee273b0db66f77
SHA512 c13b2313d3aa37ecc2c2899b480f49017307878adfa5bfffbd0d5779842fc4df4b12399dfaf6a9ce99c7faa8dc130265bb01523b78752a62d1381e543535912a
SSDEEP 24576:lAhGLJIFoiwtA5l7S53nUeA9n/TM4NZYeNm+9MhUwd:lAMyFoiq5rA9n/TDbXNKd
TLSH
T195359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c31e1ecc96ae35b59918eec3bfb40b3f1cadc44013b75336f1b3d4c224765431
MD5 7971d39dbaf85370380989088fde6db5
SHA1 bcc855e01920fcd8d8269c09210724dadc825e68
SHA512 365dbfb3eae65dc2f3ea8b31d9492f1e86804a23c186011cac847afa6057e45cabb8aeb213e6fa3a61c0c77ef7938ac3b5d926c931998d1f6c2e8082333654e1
SSDEEP 12288:cmw5HEjsChNzBFgl0WDm+CTBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dj:ZwuSOWCUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11785F14637E80CF9DA6742398597D635EBF2BC062A21C71F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6d83645d25a3f6df1f7923a6d75d498ad285f1b35abeaf1bb41707011239d8e9
MD5 337ef59793b200e22b45496f7c8c5d80
SHA1 4d3763522d9ccd33c53411710d5ac85c56d389da
SHA512 23febe657ae29cb538b6d23ebc03fa039c75d0f783ec528cabd03504e0c1390d71173cef24a4e869d931615b0e1067b6f76b504a62c7ee4bf51c6a3c3bf169d8
SSDEEP 12288:ojZ1Iy+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:UZuBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18475128627F814F5C397527CC8E56B08DBB27C5A637543CF0225526A1F32AC68E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c7b67e34bef197ad6c8539df4962f7be26b16723f7efd93832d9ca3b15ea0423
MD5 29a29fba76563ac8436c3089651422b1
SHA1 3e2ea037c995730786cb09a9fc5f3a3a648809ad
SHA512 0a8db312484cafac39b2f72d1b3202bb100b7eb150425b0ef1cfe30a75cc6bbe0701a87b3d411bfca19541b23c0254795bd3172a51c047bdd122760d61e163b1
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:3QRQyi36YOcPQLvw2gAf+PN3zfb9s
TLSH
T15C666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d63b929db33fea1089c42ba18245c6d064c6fa955c67c53353f704a78cd953ba
MD5 c665e457d9661510593914723d801da1
SHA1 46ba0a0b12c30aea2d2dce59e69e1120a573c14c
SHA512 29edc4a93574317ea2044774660a0f0f9621e993c7a488c9c0bee8db5a8d409724fbd01c1bc06519ad8d6dbc97a550e21acf1d4f087a873851dbce6841cd2d52
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:BQRQyi36YOcPQLvw2gAf+PN3zfb9s
TLSH
T148666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2cf50ba365d3901516d212bf89eff1c59c6059f0edf98f3828290cd582ded049
MD5 73313d7ccebc71b0598266863d6b4c30
SHA1 c9849b9701dd308b187cd9ef3861278aeb47105a
SHA512 4cf87b29e4c8951046845200ba34e2ce82077a4841c4e8c35ddd660e724f7934a5834e858198feb9cd447b02f09ebe05af7ba3f7d1a9f29e92d3f286ae033f37
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0RUeA9n/TM4NZYeq:I68Qg55nhheWu7PNU3/IA9n/TDbXNKd
TLSH
T1F8B55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1ab90afa96a48ca1c77b7809586afdd99401bd0ebc5dd349d5f8c6ea99a77219
MD5 d6e77a689b4b272827b3d431c4ec942c
SHA1 74f29b9770c9297dc18a9e9c3a1f7e1b4fda21b9
SHA512 cd951a3cee3a7baf6c63e61f2b0d3ec8db286d9f813be3e005fe87a63859340b5e96d10114b15fac71e1396766bad726d8568eaf18bddf62dbfb0748595b39dd
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:3y5112gYy5azzVvL69nLKnhZ6fb9s
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 178ee93cd18c1845564f70c7af67f81062afd2a28e05adb14d70a25004b9928b
MD5 2588bdf3b04d18f974b715322700b10e
SHA1 b414a696f4c70c68b653ee63d16283e09b445a74
SHA512 5268f264ebc91a49512884ff96afe148494ea123f0e1bb1dacddeee64feadc90195f7f95271a24827d5bdcb7d7d90000505e02c2bd60f8d35f04b16265370a23
SSDEEP 49152:1B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqA9n/TDbXNKd:7u6JmVxd2dbfb9s
TLSH
T195D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 826f3496257aee0922c773a58e5d19e0978c1862b34cf35defbc29f10a389d4f
MD5 907e8d47a0d2f20a93a8eefbe1eaf5b5
SHA1 92699b101dc0bb43cdfffb13caaaf35922f7c228
SHA512 99eecf85530f599675e07488fe65e379c1d6be438153df5c64c279e183237db240929d4de43110eb2688ab43b957696f9b216d0b3f23487f9a19f8e02afade40
SSDEEP 49152:T1hpsNoJpF1A6UU44CwH7R4xuA9n/TDbXNKd:TmifPbRQfb9s
TLSH
T1A5B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd5ad286033e18cde88b139260f70d265b6328d090eb312bbc1bb00f61f9ce43
MD5 db80dcbf6a3e6f3e96955c8ac826c0a7
SHA1 d81f289e08fafa407cbf9ac17010ab48606e131a
SHA512 d1179557909927864463cd8c686e0549b3e23f32e6d5510dd8833de3d43bd7a01e1b2428cf3d52797c08b49edc67afc8ae5a7a0be0f9d642475ab5daa0cbf3e1
SSDEEP 49152:VSuZQIY0Be2KRRVtOnks6NMHqNA9n/TDbXNKd:75dKTi61efb9s
TLSH
T185C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 295e6aa79cb9a97b84c1d69b000e6dd1547f3c77d50580aee31a94224aabd01c
MD5 e42f18a39266f671045ff8c5b901b1a8
SHA1 ee8184127e579b2d0adf0ec9329d24a185926a1d
SHA512 34f8a7078b7b862cd9058316b6921d7e704b4cfa3a29f5d2316f2387beb17a84d9803b79abd77c0d44fe8be500446bfeafafac71b3e036a8275b85df696ee623
SSDEEP 49152:+htSn8EApI0figngiDn0AP5waA9n/TDbXNKd:fX2iyphsfb9s
TLSH
T1D695BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f934e4ff9c45d4375fd7ced17b40d9ec0a7f4623d50e3708d881d7312ab5c2a3
MD5 d857f4a711941d9974c12c92dae98f26
SHA1 e6f63633b62492a9abbfb0f22139ddb409e157e4
SHA512 5e284e12c9d21431a071a428ee9c9762f87984c3c2595b855cd903279121d2e74784d2a6720dfb40783174f1881dfa43033ea17c56b904b7768e88b57a789ca7
SSDEEP 12288:atBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dr:atUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19B6523824FFC09F5C74A0AB584A6BB0CCD91BE4EF68543AE470D722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bcf8273d0055f906d6b3f2a46ff3109bbbb6e1df1d229e5b4668541377fee995
MD5 8ab6eca1c15a3d351670cbc7a7fbd219
SHA1 3641fb7c1650aa27749634d70cfc4ef5ac36411c
SHA512 6dd251653813548ff6152c015adc668235cf098292f30e4605ba65cb4f29504b90cacafe8f7455bb9a7c0ad9ad8499d9cd52a300ddf024826950a91d32be55cc
SSDEEP 12288:eqBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dr:eqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B36523824BFC09F5C74A0AB581A6BB0CCD91BE4FF68543AE470D712A5F385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5b2d55fdc6a54f9c650affe87509cf6014845c50388c5b31e2f2072d8c8334e2
MD5 b0a092e7aef6dab5661c3a900d34cc41
SHA1 700a9f5e65499f12d5465879758484fff2ea42c9
SHA512 5d80db6587564023b14ae08b8ffaf8a509706983ea0fb1813c623354e47aeea93d6aff668c6e62129b1fac7a7ecbf7cd2106d50ef274a3f7c947ae0bb8b0b39b
SSDEEP 12288:YEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:YEUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AF6523824BFC09F5C7490AB581A6BB0CCDA1BE4FF68543AE470E712A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 01dab1b1af4fc7644c199aac33d30a19a94fd65aab2abcadab9cac5bacb9207f
MD5 0a60027a992cc960eebf68987f9f12f3
SHA1 b5089ac46542025acbc9551cb86bf05d4d34ebdb
SHA512 ce3810e6c25a458a95e5ce28853f83d6464a34c2fc4abc49e4e2fe5f8339638a4940c0a48b77110ae3150d27eddb4f680cd767825c2b2e596bee7fd9ecac6faa
SSDEEP 12288:JVHBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dc:LUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1556523821BFC04F1CB4A9675C5A6A708DAB2BD8EE76183EF4705361A1F302D5CD3598E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 145ff08c9a2feb0b0de2cdc7ed4a9f1b8df0c8e0942f1922c70c9d5402fac1d0
MD5 015bcb5b87b218610b9af252cf5e24c3
SHA1 d11b2ce97692974d88b7f6e41c968aad3e37c1b4
SHA512 83f7bcb35fdbb00c4a8ef227ab28f19110a631915f46740e0dee71f9465577d823d4d46e48413d3d7e8f4f394951fa6cce3407aaa23d5f4cb2f6dc308a5664ab
SSDEEP 12288:EPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2db:EPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1206523824BFC09F5C7490AB581A6BB0CCD92BE4FF68543AE470E712A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 30db8fbe5c9bce7a551fd5bf840cd319c8e94f786c775f78d7c05725d826d66d
MD5 51107b383435bf108491976152b36acc
SHA1 bd4568c397eace1e06b654ee79b62b82d7cf32e6
SHA512 72ffa6096a7321a9489c65c4cf28ca74a480fb878ae50c55aa2a37feaa5c4745d4c8ff80b49ea90637a3863c84ab19c1fda040124ba607f7da4ab9c1fb7b9c93
SSDEEP 12288:aGBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dK:aGUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A36523824BFC09F5C74A06B580A6BB0CCD91BE4FF68543AE470D722A5F385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ef1c3cf3a04c378fed25c034d3726a7fb50d7b5c797030847752265ccfab3222
MD5 4c1411adbcb77f8afd6e8adb6955565c
SHA1 35ee9bdf7e4a3020ded4b0dcc46de0cea6963a8e
SHA512 d0720585779317d9e8c4bd0cd3137106bd1dfd6db27cb10e9ae7087a9c71b92531cbd70eecf59a2f66c2bdcf26b9fb5e97eca01e427525b16fa8ccfe8ef61a9a
SSDEEP 12288:HSBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:HSUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A06523824FFC09F5C74A06B581A5BB0CCD91BE4FF68543AE470D722A5B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 46ecdcdc5af66414aa834fd147c1da1f9e3d131bdda398f0fa1ebd89ec430eae
MD5 a5e97f813e71fa455395ef6f35a326d9
SHA1 f88a3a84cf08d92336d27c70872e59ead893214c
SHA512 3cdfdd9c3187eb91e7cb450965471a918eef26ff3143b9c8d7e7a92f5e12cad6a1724794d1879cf5d429fd8a0234ff5bbc22cced2e954e002471bfd816c77c5b
SSDEEP 24576:DZMEzFVSOKUeA9n/TM4NZYeNm+9MhUwd:DZMEzfgA9n/TDbXNKd
TLSH
T106850295B3A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a8c04efd406f9325284eefef0c7e6cc37c900ba255530e3821117e29a370cdb9
MD5 d296ad1b4294a9665547c02229994e31
SHA1 22b8090b00a805579af42c1b26d957b4dc863ce9
SHA512 4fe253729cfb87911cb4a635abb33ecdf2a42d7a0bd9ff8a5233f7d4a1ca69ef83738cdb4760f077962ff5fa023529dbbc8b09dc423c44efae7a152436d94826
SSDEEP 12288:8xBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dm:8xUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10E6523824BFC09F5C74A0AB585A6BB0CCD91BE4FF68543DE470E722A5F385C689164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 47afc50e8a844a5263e4366a06bae0e55fde7718716036402c1c8398135815ae
MD5 92f603680149d3b875fc297df70d6991
SHA1 bdafb0d6ad6d4f8c737f9b5fb82b655df695f6fd
SHA512 6e312c38ce035cef31bb8ab9dc75c3d9c58691d39de18517718beb579fe3f35cab92b24ae3d360dfcdac70df06546f9214f725295aa4bafbb560bdaf14400180
SSDEEP 12288:CFBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dK:CFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CE6523824BFC09F5C74A06B581A6BB0CCD91BE4FF68543DE470E722A5F385D6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 b19ace51ef8a7566bdd7848671eaab033762439b440d1434e981e050d9a755f3
MD5 85fbfde4fbb50047ffc7d0890a241304
SHA1 58be328f17c034fffaa66e1d6bb4585f0b20df5c
SHA512 40487106b9fba4f3ccfb9d1552f4ba0999ea8467f57f2e4d81a45d4dfbd5ee082302947449ff2d0e93ff845bb2e9ba0329b42fd13358227b934b4fe47437e6da
SSDEEP 12288:NyPz5L8+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2df:kzy+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D475024777B520F9C2664238C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e98cb655dbc243f0564a96770a76643cad89478f5e6cdd98e559b8aa90bd0c15
MD5 97448f98546438c638a932531b19bbda
SHA1 e68048267753084685cd1d045e76909b47b7e014
SHA512 961a4140025cf02896dbc749269b0bb6467a65b9b4d5af1f071baa51f1c235563f92ed512bf07969389daf249d0c29183a602bbcfc257bb1acee31b2fcfad334
SSDEEP 12288:XxBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dH:XxUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18A6523824BFC09F5C74A0AB585A6BB0CCD91BE4FF68543DE470E722A5F385C689164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 beeba4e577bcb912b540a72b42aca1352d06278a9c9c474338f46906f77f4233
MD5 c1d251e599d4c9c1d5d45a583054b4e0
SHA1 052ba053d6aceef2f4a43eb12a7ae0462791f0c6
SHA512 7f91acc41f54709bdb40f67b5277ad39e3501b0c3d3914f5bda5c216e4934161defa2ab2453038d24f10fb75005aed811a516cac59a71109dd84d24447e0585d
SSDEEP 12288:LxBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dX:LxUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1676523824BFC09F5C74A0AB585A6BB0CCD91BE4FF68543DE470E722A5F385C689164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 d1d3269ba6c92923f4020abf62472bdf6661cb33e45fd347da5b85ece02230db
MD5 39a360224b6c359ea0851b940ddf7617
SHA1 425875d9e6364d246bebc2ab2d4e351580628d10
SHA512 cff9b4eb64e162d3cb2d55c10a2085d41c694ec7d0850c7a02da47d3959c57f1c5a096e568396031b75c3dcc4d26002fc539e8afe2e96128dca09356f8acee8a
SSDEEP 12288:EyPz5L8+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:dzy+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T11F75024767B520F9C2674238C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 ee8f79bb2ede42aebfd563fff8a14d23e1b741d6c6489ac25f4538e72f24e0d8
MD5 aeb907dcda14470dea6542754b962e30
SHA1 1707901ea2206dacb8bd753210c514a88a83e65c
SHA512 fd350e90a1b9ff88911bde7b1ade903e28cfc5e9f214a01b922931f2200075824ab9df97ea8954186c530b067b28f8bd16a4fefe6a1f608f54ef1467e3faaf73
SSDEEP 24576:YTdaLl3z0zDUUeA9n/TM4NZYeNm+9MhUwd:YTwLlj3A9n/TDbXNKd
TLSH
T1C9850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e0168c7fdbb55053ef11fc841d11f275188ea0912f2ab881d5d49e212dc8aa77
MD5 01bff4759707b679c6a81fe779407ab1
SHA1 bcca200ee16337ee642450d36b1662e3c7c9b0b3
SHA512 47df610b9c1cd019ddce8d657798e6fa2557bd7afbb44f523d84041df8fd20a0e6b20fe17d32bc0e57a89e97b510f6f3723cef2a09c4527968124e0a4316b068
SSDEEP 24576:G35d9CHKy7GZQUeA9n/TM4NZYeNm+9MhUwd:o5d9CHKyagA9n/TDbXNKd
TLSH
T13595CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 4669f1792507d54e551c82f12a12513a7321806c87ea0a9b7cb3fb68b1a394fa
MD5 62741a0b5c9cded0b377935229c16c1a
SHA1 539ebe308bdafb36170d79710323b8ab221fae70
SHA512 52c94a3bc8bd0742149abd9b0cdc8c8dedc9ce1845a38529f571fad7fb6e50870a102fde21a9203e9ad82a3104926411959df08df449aa39bd8adb3596694971
SSDEEP 24576:6Owvik9RX6wkyAI1UeA9n/TM4NZYeNm+9MhUwd0UTDWG6goHD2LwyKTPxEDev7uK:zMnYIxA9n/TDbXNKdVslFyKTmCDu+
TLSH
T13BD5F129EBEC08E5E1B7923C99A3460AF6B178591B71C3CF029A136D0E37ED45D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 32a544e1f57563a55b569ee275abde381ff6134366aa6bb0635634597a9c97b2
MD5 03058ac699a49acd028f6cb11e704048
SHA1 ed9508dce5aa235e337cc7c94deb09d1639789de
SHA512 7ed96b977421dcdc4ab3a85110d08d84f92064b40daae21b9c930d6dbb4bf77e5542b769f59b7464e6f8a021887baa20583ed124400b3f1ffd74638ea89d795c
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06A9n/TDbXNKd:0ySzPTfb9s
TLSH
T1E6066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b25756df54da768ac59b54181e21ffc8d56aba233c2cce3a17f421d927eea940
MD5 766a1d226c0e2d8efe4c38dbfb9fd80f
SHA1 51932495f38d8348e5701013e2dc421b1ff8b611
SHA512 e8b651877d3e95e5c57f4932d5f22a9b9f49929e05b4827eb347295ecc02f5d3cc4718d2833e4ab3714dad6996286aafb4bee6371f42a0c0ced173a5e97d8fab
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY6UeA9n/TM4NZYeNm+9MhUwd:x47JUQj1irIhCnDHUPfF/qA9n/TDbXNs
TLSH
T16265AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 23fe4b8209f474c25721b4cf7dc8e487f3b373e107b4ee46ae0a81f91b07c6df
MD5 fc05485e15660dab5446206732e98ad9
SHA1 262c8d8ad2df3bc9f3d9493772cc7e61fbefc96e
SHA512 d681a9932465fb3d7d1292b94ce3cd316a7a0e0916a85fbd1560e2b9edac08b40a3f55d19d855f8bbb46343204367493779fa5b42d1da55ebd9abd8b0596875a
SSDEEP 12288:FzsfBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:cBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17175F04AD2A802E8C15E6279C7569A04F7637C2993E1D3CB43C0F53E1F366D09DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4d0e6bf63ce2867ecd9c00ae897b032b7b25edeff772045cd3d68e6b169ba302
MD5 b89b148dd5b56104901780ee9b347404
SHA1 9ab61229892d2c06c4256762415419fc751f7b80
SHA512 abdb644235611c4970cfae2bd3b5c2e3d8cc90def60d672178c70f80ed1e809a3071012cd634280d430030d58646ae21194dd7c18ba58ee3c49cba9529b9af30
SSDEEP 12288:4kg/yX+U3fQ4qANFFCyp/NBuYghRN1hGyvGqMP7iv/pwb5Qj6:4kgKuUPQgynsy+qMP7Spwbs6
TLSH
T1013528117626CB4FC66940325E33C2CCAB707D41FE45AB0372C98B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 49261e518c6d1f77fb7e0aba001a27f07895d87a00158a6f7c7491b12afd7cd9
MD5 152f9eb568244470bc6309271262a2ef
SHA1 5c3bb364e6f6a467d5471883e451afe2689ce934
SHA512 2851c9ba9d04de693eab7ca2010d304fdffe3de933095930b69886d773afd24c3a8f7189cf320e7e08dbca77194a029af5da80d391fb306e186fe63d07cfe3c6
SSDEEP 6144:VhR+E71RYLdhnlHR3pSyvqTI9XIUfbv6uJd2wHLm0Wt6QytMxoQytMxucFTBAEj1:VhRR1RYL3Xq+RRSHIFl28JGbTu9uh
TLSH
T1F775F8419537E78FC1BB603207269B4CABA4EC06B7096F2773C9453AD86A751B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 fd50189752dba07dea52480f7033c5cf5e1fff43bf9f88cdaacb153d354d64b4
MD5 75a21c5ebe3255ddef1690ae28f10b4b
SHA1 2d4ed4746e364bea29d028db5bb91b474876ddd6
SHA512 6d730b3bbd311436fdf3b273e0a48326e627a89b6709d77b355af167f775c1ad56a4e18dcec3a361925429978c408c922340c38c43015f53bfa553622da9d246
SSDEEP 12288:TO7pBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dI:OpUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1006523824BFC0CF5CB5E1A7440AAA7089E56FE4DEB4083DF8609722A5E345C6CD7694F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 437b7aa99516d156542f5d68f3b6218d3d5f692876bc544b08d88e02b8da68eb
MD5 4deaf0d8f537239c9f23239a222d8a10
SHA1 ef23c7417d7a6e20b80828bb2dff2bfccc396467
SHA512 51d9d04c6dd01b6f97cb6dee27c71701c2bc428358e65679c7960186595a33911b43fb316df983b358e03bf5e9c13ccd726fc6c06a017f497c9e2c79c8d29a88
SSDEEP 49152:pgb4mBIBhGF0A9n/TDbXNKdsslFyKTmCDu+:ptsfb9ssamC
TLSH
T1A9A5D01E22EC02F5E1FAD2B8DDA64417D6B278161731D2DF0251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 89ccaad7868091c3dcf434e78d07970d1e1a5254979f186ec32c8d8b9725b4d4
MD5 29dc8d106c7bf9362c65fe054b70f885
SHA1 c7fbc3499d395a405b185a92184889da4293e79d
SHA512 7265f42ee027ad73c08b19d7b752dfa494ad2e07bfa465c28b0547da2681bdfd255492c72b14a79f2f3429beffd183b7b953a3ce5a776b891a9d50167680a395
SSDEEP 24576:2GaUTDWG6goHD2LwyKTPxEDev7uvx7S7:2G7slFyKTmCDu+
TLSH
T13A05237915FA34F5D67A4339E8A081AAF6B03162339457FF4BE923345E448E02E3DE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 287fff4637933ca2ce85a0cca656feada4ce71e7bae366c553d05b59f4b51941
MD5 aca845d67a83fc76a37b4b5b030a6705
SHA1 da6298901c006ffaafb3cb18e526fb9c7ddc7de9
SHA512 d45e2bb7d0565d51e29e639621f94ae67e5d356a3e8b27f5e7341e74ea4d27a8838ea8d63322a4669ad1a902d319053a15b7e75f3eab313b88c3918acfe67f8d
SSDEEP 24576:4G88u8FpJqH1hzria7/mKUeA9n/TM4NZYeNm+9MhUwd:77ZFPqVoa7//A9n/TDbXNKd
TLSH
T1F395016567E401F0C47BD13889824667FAB2B8251364EBDF07AC8B551F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 67ff430be4bcab236972a5d9778b78dbb0d57ade259e857278027a4752dd79c8
MD5 f6e0a8f01ecdd46211a39052c69752ad
SHA1 e1bc92c4e95195353c7e9ce25286852699127a3d
SHA512 7f64471f1bbc815a2d057cbba3b3a75e17e0815aea545c381e186191102f7eb0a8fed8f47440dd89cc4ff6e2940a6eb73727e3db279b410913ae0ddca4eb76ab
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwA9n/TDbXNKd:YG05lO43byfb9s
TLSH
T158D5C06A62EC01F9D1BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 adf38edb5c79daea59cd837daab5ad4fb57e90de30d95d20426a985fd5ce79f1
MD5 7c94717f9d5b7b710967409bca3ba231
SHA1 e47a51759fdf54022477d56225e2c7de1efe7688
SHA512 c837e42799276881fa17e8bebef378462b8a7cfb71f38d49e843e9da19c664087c2326085cbb94e3fe0d50de518eb91013822ab37a34b8cfd03ccbe5dc39ae82
SSDEEP 24576:Pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYUeA9n/TM4NZYeNm+9MhUwd:3a5POZ3+Jt2pasx2+mIA9n/TDbXNKd
TLSH
T1FF65AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3240076cbd3128fcf916828631734f2978cd7fc5e82681cb4260da6318957cab
MD5 8b3cab4c236c62aec739ae514f860e66
SHA1 59ac4ff2845cd66c35918e001182e77ea0760673
SHA512 58cc78c18b76674b09c83ee706452ea9cdcdda1281d3186207b855684cf674ad0cb583574da9b70762b9357e8b6be102a89bd2c8a6375c82a9ad8a8bb039201a
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkiUeA9n/TM4NZYeNm+9MhUwd:HNc/zEOVHFfA9n/TDbXNKd
TLSH
T1F1858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 5cb48a6b0e736650abca5f8d0861533993a9b3acbea80a57b1c3a2b270e52161
MD5 6fbfb79a91d78b894ae886e47f8daebf
SHA1 446ba8877cdde9d8b0bdaf20803cc6dfb92956be
SHA512 dc63a49f00dba10fa902e014fd05beba4e974a22d40d4ce5827836fd1e1587a5a31f3ca6f2b2977111249c176ef3f48f5574a431352dc3328390b173f4b9b555
SSDEEP 24576:S6DIHUTDWG6goHD2LwyKTPxEDev7uvx7S7:S6DIIslFyKTmCDu+
TLSH
T16B25126D237A10F6D1BB803ED5C20156E2B1B072939256DF0BE8867D5E93ED8BD3CA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 6c89401688e416fcbbdd9572cd26bb23b6de017f8994057e5a46b53be58575aa
MD5 04fd9383c94f7bc0287061160d625725
SHA1 6340c47fa0359c33c5708b05f50163cb4df77db0
SHA512 05ceddab0c27b5c4b1b8300b0d68c12c921d6058ca4adb3262d5f24ec597e8ca1979308cbf628bd669c4f04d77299ecb9f2f99b6cc0d8506611b53bef2f40338
SSDEEP 24576:styDUTDWG6goHD2LwyKTPxEDev7uvx7S7:stBslFyKTmCDu+
TLSH
T19015235153B820F5F6BA0238E9A281A8DB74BC22379193EF47E1372D2E35BD46C34756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 88f42e741c0acfad29f101803bab414e482930d72fdfe2aa8a9a365b4b867712
MD5 3872b3cc0c270ee4da8b395802165d60
SHA1 c43bb539788d2c23fac3e5bdb543d7190fedeb5d
SHA512 db3e5afedc1f2a0f8b81ecd6703ba1b98ae2575d2efb356fec5548d1165ed73b4a1c40037451334eb7f8e324e301af554c8e2c7f87a1628fc9cb766e98a4a0a1
SSDEEP 12288:05MoxDXDGPGGw89Xw6g8HD2Lw0aDu1MTZVxEXzfepfJ5i4uER/WS4WpjXglNfS7l:2MUTDWG6goHD2LwyKTPxEDev7uvx7S7
TLSH
T1A60523B542BA34F7E6A60239E4D082ADE2B4722733D593FF5BF923246D048D42D39B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 f32a6dd0424c944b5dc3368b1ae9c2a56e0b1cec48ab5ade313005c6a7f57204
MD5 23a8cda354cfcbeea36c9d6f45048030
SHA1 77f88c9e8174a4241c68279abc1ec1e5d1f3273d
SHA512 4963099c8179ec59ad2321c817fcb1db93e70b9ebb5ae26f7c31e96abf749f47f9a46aa068b71b998de22f36868b43c7212db8ee99150739a5bb6e7594b45040
SSDEEP 24576:lvg0LoTfaidZMUTDWG6goHD2LwyKTPxEDev7uvx7S7:FgTTrZ9slFyKTmCDu+
TLSH
T10465AD1D67FA05DAE2B2D239D8625493D633B4311372C6DF2548C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 7cbea40151063e114179da37f9366d6b98408446e6004cd06e169b7267bce99c
MD5 792f0966b333bdce36260fdc87441a0d
SHA1 75549dcd42ca6796b14e8bd4ea8b9e30610c32bc
SHA512 d73d5ac8c3cf5d78836752a9b81153e0ba70a657b812d4af1cfe8894662ea145553dfde5199d56b289cab5e155449903406f3a9237cd3950267bb173eb3bfac4
SSDEEP 49152:+gb4mBIBhGF0A9n/TDbXNKdsslFyKTmCDu+:+tsfb9ssamC
TLSH
T145A5D01E22EC02F5E1FAD2B8DDA64417D6B278161731D2DF0251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 92c49a9ec77884df0952748886c66ae44ce07cb23388f033eb4bd1c8a299f607
MD5 4fff971a5192f616574911eaa34fd85a
SHA1 14bcf936b9cb51a2c20cd5da7c445ffece10a5e9
SHA512 de4eea13196fe8e578af0a3c75d2ea74c4ca2af3bface0fe6e90b3104397e07cdd68eefbd5b0d4bdc1cd57ed808f94f1e1ab42520101171f59dbd85e0d3352fc
SSDEEP 49152:HDMwBtOm+A9n/TDbXNKdNslFyKTmCDu+:jFPfb9sNamC
TLSH
T185A5D16EAAF805E4D1FEC6B5CD238516EA727851133293CB4390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 477a90419c0598a420770fad3fa2952a0a739545b3f863d00996538cc77b9c20
MD5 7554658a98f85bb5a3a6a682265c1fe8
SHA1 9f5f7944d454989758c8e7e168f4ab5a5e421bcc
SHA512 e54ba301339bddec22b890873ea14d3456ac7978d38798931bdacc70ee7742cfc84cedcd57802fe64b1d0e6e0eac8d9156c677e28427ab9adbc5c3783b365231
SSDEEP 12288:THvUrBFrEjwaQ2BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dp:TPUr+NQ2UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A985E15F26EC0CE5E67AA17D8582870DE772B856131292CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 6cb6ed0c3a7b18090cf19844fc1155e6317c3ca8b5db33b788bdb3d5aeccf58c
MD5 c1e63efb47080a068f70b3ef6aa06610
SHA1 d4fc5885ced92e6c818659eb7aba0855d6b1a829
SHA512 0407cd20e1277e4f90a0358f2843413076f654f7a5772af506ee8abfa1753de13977a31acab5fdc1749dcac8c58a22c268330e40922ff10adb24015207c93005
SSDEEP 49152:xDVHeBIAAJA9n/TDbXNKd/slFyKTmCDu+:Kfb9s/amC
TLSH
T18BC5027EDAAC04F4D57BC27CD6A38606E77138AD036256DB02D492791F2BEE42D39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 49b0594e933f06331faf9b4ea5bac5b385f58c85e724a6ad2ecb11494579b09c
MD5 89ef8c5de45113252f381713fd76f246
SHA1 324945ed7cbe7e539057f4970badeeef036c9753
SHA512 f35590bc64175bd703789e428d5a957a5831c2fa4613bea671fef04252ba6ba5ca94cd932be153bca386e6a7ce5c2021bac52f1c6f944a586018b6844c9ab3be
SSDEEP 24576:jJnJPbzB4SnUTDWG6goHD2LwyKTPxEDev7uvx7S7:jJnJv6SoslFyKTmCDu+
TLSH
T1CE35E13DD2A810E9E4B7C274815A175AFF71346D2B256ACB19B8D5343F02EE0AD39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 b7af15f1c13c7ef3115d63224e0d6b761cd7a319702d2be327b32a62f64079f5
MD5 4a8cb9d83945d412427e4819bb929ddb
SHA1 7d152d348d54e3a0d03a726fd7fe8fee996e80de
SHA512 ecf48e27755affb828df1e8ba8181baeb196e9e34218074457ded3bcd61f0e16b432f73f500f77bb9c30732f68b78a86a16f9f1860b5cc06ec75f506cbf2a85c
SSDEEP 12288:YFoxDXDGPGGw89Xw6g8HD2Lw0aDu1MTZVxEXzfepfJ5i4uER/WS4WpjXglNfS7vd:YFUTDWG6goHD2LwyKTPxEDev7uvx7S7
TLSH
T1330523B145B958FBE6A6023AF8D081ADE3B4721733D993EB57FE23042C44CD42D79296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 807dfbaa858093089c67c0116bf81bfadc13704c337aaec0e0f3146803fd230a
MD5 c1df65b713249a232ccd69d6983722d1
SHA1 0930d445d9b42d354412348363c327378cede6de
SHA512 2b5aff98f34e4747ccce4ab6526c56168c9065a92d5408fee942f0d74949b4eb79b289f33b4aeab779f11c03d6446b36f1c2fb01d1ea336614d313ded471e17b
SSDEEP 24576:d6UqjpoUTDWG6goHD2LwyKTPxEDev7uvx7S7:d6UCslFyKTmCDu+
TLSH
T1AF25126A56E424FAE17A0234E9A18169C2B0783323E597FF67E8173E4E31DC45D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 d02fe27b21a44e98314d0d68ab99a42d23bc7e59c8eeeb231f0bb85898d13ec4
MD5 bdd73cf41726f716e9a85d3b4a1950fe
SHA1 dee0b83e0a494ccdc6e881998fec0b0b6db2372e
SHA512 9efcddc5ae222f6ef6b8e85b98794fbb807f5be2cd77f346187dda0001e14e1dfce09ed6c79195aff0ad79b06a90469fe80ad87984bb94eb16afa8d68e90bce6
SSDEEP 24576:8CLHGL0MoeVtFumTijCmlKQWDkX1UTDWG6goHD2LwyKTPxEDev7uvx7S7:8CLHGeeV5ijCmlDWDkXWslFyKTmCDu+
TLSH
T11BA57C15A7EB5184F8F3CAF5C92294169A327C549B34F7EF4A80CA6A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2148-30-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2148-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2148-31-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2148-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2148-24-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2248-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2248-98-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2248-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2248-417-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2248-419-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2248-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-48-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2328-49-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2328-56-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2328-62-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2328-60-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2328-55-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2484-341-0x0000000003340000-0x00000000033A0000-memory.dmp

Download

memory/2484-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2484-345-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2484-0-0x0000000140000000-0x0000000140301000-memory.dmp

Download

memory/2484-339-0x0000000002980000-0x0000000002A03000-memory.dmp

Download

memory/2484-11-0x0000000002980000-0x0000000002A03000-memory.dmp

Download

memory/2484-9-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2484-190-0x0000000003340000-0x00000000033A0000-memory.dmp

Download

memory/2484-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2484-18-0x0000000002980000-0x0000000002A03000-memory.dmp

Download

memory/2484-196-0x0000000003340000-0x00000000033A0000-memory.dmp

Download

memory/2484-75-0x0000000140000000-0x0000000140301000-memory.dmp

Download

memory/2484-362-0x0000000140000000-0x0000000140301000-memory.dmp

Download

memory/2880-88-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2880-340-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3492-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3492-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3492-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3492-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3492-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3496-402-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3496-401-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3496-105-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3496-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3496-404-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3496-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3656-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3656-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3656-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3656-406-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3808-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3808-124-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3808-405-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3808-116-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4640-131-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4640-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4640-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4640-140-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4640-137-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5184-84-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5184-78-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5184-76-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5184-324-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5892-64-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5892-71-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5892-314-0x0000000140000000-0x00000001401AF000-memory.dmp

Download