c4aa7a168aa30297dcfb50db340c4972cd9d6f8ed92a2c9fedea686bfdefdb53

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample261017-ehgrjsda44
SHA256 c4aa7a168aa30297dcfb50db340c4972cd9d6f8ed92a2c9fedea686bfdefdb53
MD5 e97bd205b918b539f7953c9ac20823f2
SHA1 74831b0af96cb30a8eb46a7196c25c4575b33ee7
SHA512 bd9f1d832ad89b08e496fd96d496d0d560f635e339db8f4563326670e2568a0c00d09b46a800510a73af814fe7f0531e486d1568ee3dc4e506188fb226963da6
SSDEEP 24576:rbdlZPzOFfSndwE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vdlZifSdLNiXicJFFRGNzj3
TLSH
T14475BF10169F0CABD897F13D8A618D4BD1F27C144B26C6AB66A02D1A7FB778369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3332	elevation_service.exe
5360	elevation_service.exe
1368	maintenanceservice.exe
5840	OSE.EXE
4512	PerceptionSimulationService.exe
6056	perfhost.exe
1824	ReFsDedupSvc.exe
3484	SensorDataService.exe
5432	ssh-agent.exe
1396	AgentService.exe
1848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42d2bd77612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d43a6d81eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d0710282eb5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d227d0c2eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e9ddf82eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0f78a81eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4d493c3eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe
5360	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	1824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1824	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1396	AgentService.exe
Token: 33	1848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1848	SearchIndexer.exe
Token: SeDebugPrivilege	4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4704	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3332	elevation_service.exe
Token: SeDebugPrivilege	5360	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2628	1848	SearchIndexer.exe	100
PID 1848 wrote to memory of 1820	1848	SearchIndexer.exe	101
PID 1848 wrote to memory of 4436	1848	SearchIndexer.exe	102
PID 1848 wrote to memory of 2340	1848	SearchIndexer.exe	103
PID 1848 wrote to memory of 708	1848	SearchIndexer.exe	107
PID 1848 wrote to memory of 4840	1848	SearchIndexer.exe	108
PID 1848 wrote to memory of 4892	1848	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3484

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5432

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 51365690418198dcc5ffa3b01a683f16a11ed7b35db3a6ae014b36f1a0d91981
MD5 c017fb7401157d79acc913e81e15b33b
SHA1 362555882ebda440a1616ddf4bf4cde9721233b5
SHA512 495222ab1722df9c603a1d3518f1fe2984a3eff211be32c14c49510fd288b38370894654f073c19ed136caeaec34b8d9b99639294db896be37dbc35a7069e13e
SSDEEP 49152:1b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKLNiXicJFFRGNzj3:L3q6mjBl7wRGpj3
TLSH
T1EBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 215ceb077c9f59bee342ef5ba2e33bbd873a263ac5cbe67832d0bb1695dc027e
MD5 97bffceb000be24267bdf5cd63b1a1ed
SHA1 00444240732872aac836cfdd1e9b9f6e419ee152
SHA512 5add3ca01b1a8d23f8839a6dc8287905857a563bb1013d71d1e6433be64d216c35c66d35e66493508aac3bd8b4bbfab9a3133bc0d958b65cf6781006af6da106
SSDEEP 24576:PXYfDtczAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6tcYLNiXicJFFRGNzj3
TLSH
T1C475012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e73ec37a65fe7fecef030733a74d5c0a29e3721f8254197a5e63579f49651ff5
MD5 59417a23b5e52e5eb38a69183ae829c4
SHA1 644211dbbcca6d17bd9f1a867dafbc501e2589ca
SHA512 083ba5ae8b8a6edf719ee2467e1e9b8a63c06519d13c8c4009e2929b33c72a742f63669d5313053090f40ef73c90af2d615b65dfcd5dca435de5dedc2155a1df
SSDEEP 24576:q0Le5ji0hmxhrMS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qPji0AzrLNiXicJFFRGNzj3
TLSH
T194859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 52285a2d5ca9c4cdf91fafb22496fb1e8e89c878803eda4a0ef2baf323135bb1
MD5 4790634cd94137eb6f630d4939113d4a
SHA1 e90d0f9e2b685971ea744e2d12e4693345b932d8
SHA512 72a3e10b7c63ebb5866f47563b7e1ecb7065f240fc2c90f7251ae1b66bcae49729ef8db6ff8079888f1e9569870aa173743cb9212f685e6c16b7822d7ca6a8bc
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWj6q8wyuo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0/ezSC6vUzPv+HjyfLNiXicJFFRGNzj3
TLSH
T123756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7a017465e9d042f0594392fad222966a3b2e1da0419de3709a09fdc02462d80a
MD5 b9c4d829503a3e04378fc29a3926c62e
SHA1 ee44c14499b9a6cac2f06d696608f7d361498032
SHA512 83de72c57bc45398ad8f1bea35ccad4d2eaf5d31bce6482a1837e5c2911c8ed3c13c030112b96e0e88bc0a7d4bc04f0f38f76b6df1e4f7d2a4a4aef344b7d971
SSDEEP 24576:fVbqPb88hv/l+B1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fVO88hXl+LLNiXicJFFRGNzj3
TLSH
T1D3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0dbc71a85ca8ad36ba604a943aeb49dfe22ff9f47d9a4014512a089c3446e5ce
MD5 5dfcd6eab802220d417b9d372e799283
SHA1 1b0de8e89b9c534b2e1732a4864f0f0480aed7ce
SHA512 6d700159348145a26985732dcf49602d7178a589ffb304d5d33f4ae89e887e373f17e87e2c2706668430041887b69da399932e031e718c8f396ab92c4f7a73a6
SSDEEP 24576:pGu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BLNiXicJFFRGNzj3
TLSH
T1D15523D3468855B1FBFD003A867A5828B5845E2C9A595CE3D2503E5E923CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 78e885a96e55a7edfa4c86f97428946a860f7a8cd93079c548e3e6a35b9e125c
MD5 a135de32ba1446126f6db9e614ed627a
SHA1 fcf01b57879e8ad229f60569d8d524d02f1b118d
SHA512 028cc3ac63413f3508b2cfb10b44a821057ec4b09254e2a117b8756e2318caecb5f73cef39407bcbf8e2b752a01fd7032f94945ca58ca293dc837888517265b5
SSDEEP 24576:KJIUd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KJIUdLNiXicJFFRGNzj3
TLSH
T14275CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5f7fa7a62d2478068d801cd71ca630fa7e4007d57ca6046b1f59725b41e946b2
MD5 425454fe0700e3fac55931f23f3838fb
SHA1 7a4ed646b592bf80fe765ac381c7501f247e3578
SHA512 35a955cbb8b93a7384684ac3aad048d06f7315b96408d59dda230a1f7c4209b1525bc8c66175222ac8e4fa1e6d56448443bd7461af3eb6a920b9608a9a89ac7c
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH1:FQvGAdlCEL8c/WRNw5C47wRGpj3
TLSH
T1E7266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 85df358714ec2aac320ece312762f41ab2bf9a4b8bb7a006c63cc708299fa422
MD5 4910a5c89138c8af815b46f8b5d496cd
SHA1 5003b910afdcefbb0fdc8b3103ff9ab1ee02b46e
SHA512 a2f3541c5a996c4ee032b926fb707b2c6d70b4795cb02e4e83adb5dec59f5b1d488334a9bda516a8414408d03571f9ff16c88b68369bae9743ab35a7c8fc69f4
SSDEEP 24576:+fewsAj7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:clj7LNiXicJFFRGNzj3
TLSH
T1D775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 127773e4d50a71efb34aceb03e784594e685f2759d929d8999b6586291957a05
MD5 fdf338d03453420469b6ba27d1ef3d90
SHA1 8af7e33895518a7fd21a546b7ac84f6b3e154d8d
SHA512 866b02ac375cd3c8c9438d18e0ee8212031e326646cff0603641ec07e6271f209b3329fb2060dff932a69e68888806098abeeb8c72ecde8a7e4d67e97d06c612
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHnF9:gUEtQevvqc2W1cpV20I32F9
TLSH
T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a86419f97728cf6c4e4d8b4929f6072549166007ec6a1ce8e2388aaf7d610cef
MD5 ff9fd7f3cd109cdf3ce0f4d54b8bf5cb
SHA1 e098b324f1e3ee12f6f96d2ad4eac4360917b147
SHA512 72e31d56260756cb82c0da7b8894e6a53f275efb93a7be47d689451ba27cb910e309b801fd2bde9d02b602271a56b0cadd985cdb59cbded665bbc90528ec4a61
SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zbLNiXicJFFRGNzj3:Hoq2Vjnms7wRGpj3
TLSH
T18BD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 26610aa0c399a4321eb32d30d7a1fb68eea9c897aadbc4999d8116f3993f5672
MD5 51ea64cd0a29988d0eb5991f4cd2ce59
SHA1 d4bc1e348527b2bdb5cc3af92d899d0d68830dc7
SHA512 c495599823e08bea29762e0bc0bc74f4fd874f8fbcb3a981285e14fdfb379cbaba3a7565d486f72593820bd4beeb06885eaa0e8c5a4afc0b86bd1bf699c5b8e0
SSDEEP 24576:ZAhGL6IFoiwtA5l7S53M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZAM5Foiq58LNiXicJFFRGNzj3
TLSH
T19A359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 bcb96bdc46b4cce731a4e2293428cf67cb4bfacae42fab35f84f9eb007bac71e
MD5 c879efc45fddaf482ee587711461d82a
SHA1 a3459aa55c4cf2986dbbb7aaf9ad40245bbfb2f5
SHA512 e2ea4688982d8b8a4924f5f49686f6990bafe62dd4875484be47b0b83acee42712f577a66d0ab1e3462d1027ac2cfe67572782eb35d49b30f7919d6dda7ed81b
SSDEEP 24576:GwuROW//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GwSOQLNiXicJFFRGNzj3
TLSH
T1B365F08632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 35f3df94dbf9affd18f0885f5ddd70b6d724621c5a295738056cf18dd46794f6
MD5 b1ac5460ea88a7d9b077666055d3126d
SHA1 63d991bd38d8f0b7daff53faf55dd13f93757923
SHA512 99533d9e771002ded08983045dd5bdc683fec6a9892f4f654baf661150fde056e25bd178b77fae49d7f228e658ec52e154bbd04122fdedbc5836b2b2d8b816a5
SSDEEP 24576:RZua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tLNiXicJFFRGNzj3
TLSH
T12355129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7355dbfa3deab319c6f833e4c8811d106e1a2b8fce614a5b546d15a76aafb4d4
MD5 d181c769b4fd84a5388b15fdd01990cc
SHA1 e92c559e6918e33f9ad12d460284ac70f97c89d4
SHA512 b43ab69be5b5f29b032a68817c38568fa0202e04e44cb56a7c254f7752660011a885978197f756dbe59f537467ff9fced81d96fc81cd76e85cd115abdca62975
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:9QyiKanX+PNFF9
TLSH
T171667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 38918f22c31aed3665fd0bc926b0366e0ddae9b138b60b6852758eb9d47d8d76
MD5 377ed90bff641ed1de60b30b9405aa66
SHA1 15dee83bc155a4f89e08d4c616cda3bf1b930743
SHA512 ad7eb09f73ecf04424e277af8163b6e5b577bf4ce3f33e7a27eabe4002bbc2ed098feb54caa291a60a8be890d745be11782dd21cad65eae6104016e28821846d
SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:DQyiKanX+PNFF9
TLSH
T154667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9f746e926b57d297660e703c6f8f99275c6eec01f12c826f50ecf70efeb3a4e0
MD5 dd7b2b27814547a871c8f3c19116d3d6
SHA1 236b1fd5821060e1af48bb7f7f45e9b81d1765d9
SHA512 48b43760c8afc9f8719af7c1d79797e6b0e4854d29d7b103f6c2709f69a195500566c473c7f8076a499beca78f406c49d65e573ca7763e82aa67450fa64d7a2d
SSDEEP 49152:U68Qg55nhkeWu7PNU3/rLNiXicJFFRGNzj3:+thTRc/r7wRGpj3
TLSH
T159B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 47463d5ccd7d7a19b1aa794d0ee1165f46d1d033eb7a6fefc7d617d925f7a51c
MD5 56a0110a67dd5caa9e2666d299187ca1
SHA1 857b812c4bb8357e3a499cf2a028729f4a2d6f97
SHA512 d5b0e18e5f4923088121bf9169a789db6b1c07618361db2e7b8070a85e035c901f2f46159556c36b4e3280150ecb3e47dc678159387f7312208b567ec6ad0494
SSDEEP 98304:0y5112gYy5azzVvU69nLKnhZu7wRGpj3:1LIHRWhwF9
TLSH
T19D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8f8c6d9555993834df06183395807c73c2693626df9834d346a7d6d8b9bad2b6
MD5 addf98b5585390b41785cb7f37204fc3
SHA1 98ca80a766fe540e031c6ce74d81b864fdd08d06
SHA512 c0a62ab1a41846c026afd40f9778396f3c88d249064f8be4e3f09fa0acf1f977c87a51d7d2ee08003638bba12c900110351f6817c0cc8355a34401ec1713e445
SSDEEP 49152:7B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glZLNiXicJFFRGNzj3:tu6JmIxd2dZ7wRGpj3
TLSH
T19ED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 42f6c4e55e22d7ca701764a5d44619c7e91a7ffa5529653671b69e0fe8ad10e4
MD5 3bfe348c79cc791d74bf8b8859bba8c9
SHA1 7d6c40828de5570739e5cb939ee671c5d5320e70
SHA512 6998e829c8aa246e17bc4c7949bc8b91c28d451cbc8921b9eef6990e9f3809cbdb826e8d5031aa834616ae5b88de6351a3de092a59437d884de9373eb55d4c82
SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4x9LNiXicJFFRGNzj3:QmifPqRs7wRGpj3
TLSH
T184B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 82bbcaa83f99fe9e877bb025251e5c1b467c4d7e674392cf20c17a99c89861fa
MD5 089b1e4a1c2007379464ef3913741012
SHA1 3bb71f2cf5e04c95afd61153a4200f5d11933b6e
SHA512 b7bf9ed30afa5587e7166f6104b46bdc5b7b0f708003dfe2d117df047388feca47db5b69f4bb220c834b6a82d9952cc053f15ce9fc8ccc00f45df9ece7a51e78
SSDEEP 49152:tSuZQIY0Be2KkRVtOnks6NMHqaLNiXicJFFRGNzj3:j5dKqi61a7wRGpj3
TLSH
T10FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 23f06a6d6b68e2a58a9b988644e5619eb81571e4e1f3c81ba6172eea3c4dadc9
MD5 19b7af25bde9e30d765521cd33dca1de
SHA1 cae1d497801b4e8412734f68b9c894cea8b15fc0
SHA512 9924a3a8aed2261495e634893ee3c33bf23c7d0ce1513ea026a99a6f9c57b84f2c417a3acbe9b54341e61e5067619e2abb657bcc37fd76bd08c46505f34efc99
SSDEEP 49152:ihtSn8EApI0figjgiDn0AP5wpLNiXicJFFRGNzj3:DX2iWphw7wRGpj3
TLSH
T1D095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 41af206c4c9f5e771fba8b77795bc401cc8f72c94cad9b4bd558b5d8ae4cbd3e
MD5 0b0e1f7c6642b69b69ee1198c8617fba
SHA1 75729b04a1e2680d391742f5fcacd093d42b95b5
SHA512 8194b1352749361686421a137e6034329f5a6ea65d966fa1b40aa47647212d50f301a7a8bfeb2f493d267e019f953957a7de1644e13ecbdede5c6f284e8278eb
SSDEEP 12288:VMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8b66070d34cc708aab1e74ec318cf9aa4f30c4d223a5d78a0e49b6a7a61efee0
MD5 9c4398b93be4789e2114bb95c633f660
SHA1 f9551a7d95b39a9d8df378574d1a1a8f7c4b8f22
SHA512 ba68adc09957ff305cddd947485566658181493c3a00706ce82d1b163ba6f1b3ab2296bce479b5ecea458842b3a67f3b0d601a1b2ecb6b3f79e428701f62280e
SSDEEP 12288:zjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2851d9d8ce39f1389a6cca92b033a2ea824fc8f41367b79f7d168d7022e2d0a9
MD5 86596b569b5ede992bfa6b9f8b71b052
SHA1 9f8403a207f6d5cac51a7956486d850444880d1c
SHA512 6d9fcdc2ad1ac579021b4d3cdcc7294c3f1b455cfd9dee4b9279aefa81aa7dc622e98039fb449fb30906ec52cca91a3e5d89fe0105c85bc8f00e4eaa3aaf1ca3
SSDEEP 12288:35iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D55523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6b73b21cbca7a279f9705c8e9ecfc25514f1d6e872f321f2d9a255b8d9348b6d
MD5 fd56a442225a30edcc63fa1cbb7b1e7b
SHA1 8d962909d30b6a988beea5ce112ac9875d296111
SHA512 b1998ca451748b35498d48276b44989fd58c8babdd636eb49267d062559da79482e403c92242fb27b5f677ee78019cc2206fcd6394da2bf1d07705d566077447
SSDEEP 12288:RVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C552393168900E1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A75FEA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7ac207ac1d85cf4005e980e190b7b79a198c84c882bdc6ad50b675f29ae6254d
MD5 418ef7dceb02887ee5d19b60f56a8cc0
SHA1 a51769bc5e97ac6f8481a20c68bddae257ce9d54
SHA512 ed9121ac92e93d61762520752edfc5d4022564e457be5c6ebfed4110fd382490c35e21d6600b86c828643e9731acd744903948e079722c4867e255072df92a96
SSDEEP 12288:vCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 39fa3e664e1c68b3e01aac7d0946b1b1012e53081d3ae46efc204e274481ef56
MD5 9412133529eaddcae78c1ac4ba662b0d
SHA1 614fecb4fc5cfa3b732defb4bea64db89947118b
SHA512 0cc9d1dda8b44d173a196f29c80bb8374646bf9446a3e92675d68bca022efd9562d42d4f447741a8a7ae44c887526ac0074a1a1ae06a5adf24358dc2b13cc736
SSDEEP 12288:SXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f442f2f2e58404a69fa6fa4ed03c371d270c0b465e18abf18e928395e07fb8f0
MD5 fdc1b81ab45d36f6271d7ef06bab5a55
SHA1 5e4a42f6d8fe66a1e21b06918548f1ea16467df5
SHA512 fa2ef365a40b8b9013b5a7693eaaf58cd6407f52f0865f5067dbff5fa3ca37016591bf4df594751c8eca7cc766dbf7dce4b203fa25deb96a79538d9d7a6eeb4a
SSDEEP 12288:U7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Uv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 198d653eb423e9f6acee60a7905534908d0d8ce73233273792deddd37b91d6ae
MD5 5274f8461d3b7f1e0c027da4f448167b
SHA1 3a8780e2fab86fa956851d76b6dbe6b4ff236f29
SHA512 033679123861fde7d0afd60ebbae1d9e76b821195fe4186d88e283df16616b10721e4a9edc402f8dd973ee396eb4fa7f96bb7edbf9eb1861d8e792b7ffa162f8
SSDEEP 24576:TZM3zFVSO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TZM3zfzLNiXicJFFRGNzj3
TLSH
T191750295B39018F4ECB7813EC9258815E6B27C294B70C65F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 72aaff7f53bdb1db881f2c0773b6bb6823a1f37d48eac22123f571da32713ae7
MD5 445b79a17f618a64d6e88a4f797c17f3
SHA1 8e6bbd7c9b93a57fc37654e7c8a96e8d8ba412e1
SHA512 1a405d6b642ccbc2c5c56bef4d6cad84c3e3c159c38896d8df6e0aadc9ae1a237ab695b9ea4e05899dbdf31e4d520ac68a9672acf730d42eef32c00f00a306e6
SSDEEP 12288:7YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 927f26323c304e5c5224bae16cfd3e3474be52437306b73467bdab67d7940ed5
MD5 ab990a14695417bbcffacbccafd52b5a
SHA1 ea73c7990293af84c2f6ebebbd4a6e48fc223f86
SHA512 abe14fc9c5b87c4202a45241c397a85b78eb38c35cb36a138b49fcba5349339b4c452f3ea10648a955ed0fb46b60f51ae09134263c8217b9e1fbda6eab4cf6a2
SSDEEP 12288:5UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 694696e9c8e576cce31f6a75a035f9d2d2946a62a64ab4ed3baa5691819b3d5a
MD5 892b688ef21ab43557e0756fec2bc8b5
SHA1 1af4eb76d46ab957640509bee2ee0c010dccd39a
SHA512 6cd38cab8055db720f3316fb05829c1e8ea76c48d4b932c51d24e68b1113378f70c4f3a3349d5bc659b03a0fba0102960bc408cf8bb58dfd478fa4d2b8ec74a1
SSDEEP 24576:HzyL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HwLNiXicJFFRGNzj3
TLSH
T170650247629530F9E17A8139C9620915F3717C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9f571c4699fae94876ed50ccd6e61bcbe93a2817dde45e7878fed8072d5a878f
MD5 50a63f858bd1e968d97c7997540d8138
SHA1 184a779ce5c2a02a74eb5a1b16deb479acea6553
SHA512 c9f7250d674fccdf539bba71434144a542db1529b5b49f12a9bb39eaf9ad3dfb087f0d04b0c4512226c109347718777eb7c7dd30efaec372a24474594c6327cd
SSDEEP 12288:7YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3548955B1FAFC003DC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 54fc558e7fa261ad8431b1f6aa5c6e8393fdcaa12999ea0cb1e053133fbf8052
MD5 3395e8429203bcc3160863d592711d39
SHA1 3b376440ed4b82bf6002fb4b1465a80a2f482ec1
SHA512 95f3221cb12215f1cb4079d98dd9f9c3c9068e583dcf380c301cd339f465035dddaa115fb54a550a4a34945ef0690604d03d4619ade6e076c077cacc01a75ad0
SSDEEP 12288:RYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e47fc47d35e8a40802d79d7c3aa4a1623b698609784e2d798d29683c320942c6
MD5 66b19f43b54d25078fb54d77c9431a25
SHA1 433c79aaf63207e71fc9d46ca676f1f9cc9af756
SHA512 8d3372c3657e2bfdcde420346a2ce82679eb45445dea94649eb455588f056668ee65770ef963131d93ef195b5eb3c76f2f230abaa41463a05938ad66fa63f6f9
SSDEEP 24576:jzyL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jwLNiXicJFFRGNzj3
TLSH
T18A650247629530F9E17A8139C9620911F7717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4c391ecb6996aa9c55459e55d8d87c2482ead61c0c56c356579cd932e29bd515
MD5 ddc7b323f221e1fb42849e3ef06df6c3
SHA1 c88e60566866869bbe59670b4f6256a5a71bb7d5
SHA512 2c005c6999d80b7e0277f87f2a6226886deceffff31871c33a058a2ef5360097f2da148277a076450732adeba68adf5a4ec28f8d850099f8844b43ee94a18748
SSDEEP 24576:ET8aLl3z0zDV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ET7LljoLNiXicJFFRGNzj3
TLSH
T1357502A5B39018F8EDB7813EC9258815D2B27C2A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 adc0d2d80b18e85d4dbb7735d20d94d09a4f34ffa442fcb04daecd32bee9c94c
MD5 6a7657af7b695bd643e368ff8594af0c
SHA1 88b94b58431f82fd37973f970752892518a50917
SHA512 049d3d6d494e072de1ca343eb1de95f9f252fd7ec6c97166026236894b4e786bc277bf58ecc2690825300bea4470d6aeb3806c9ad283eb7cdc9fbef505395e71
SSDEEP 24576:b3rd9CHKy7GZx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7rd9CHKyazLNiXicJFFRGNzj3
TLSH
T11C85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5aedfaf07c30758f0d92bcd00a1ba477017189b4ebc39291adc82c06f7c07fa6
MD5 351b71720b15ae513f0e6269446afb90
SHA1 97902fae643357562cf16e9b3084de4e53a97a5d
SHA512 9749f10ce5e8c2c7134474b3488192734ebef16ed32bb6f8cc0cb6530a8d6f415dcb1f540cedb2c88e8610a49e1c161cff714971bbf6001a61d3e57266b5a008
SSDEEP 12288:HZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8e0e68984ffe0f8f93265f53e740771311f537764d619e948d77d3fbf388a83d
MD5 1fce39683bd5574bdde989efd251c7df
SHA1 aa2c83366320d8f57ec54e0bda022126c16d39e3
SHA512 a60381a1097c473bfe121f929175ffe14ee73e20a0c3f738ef0b7e238c42f7f7f05558be3b80c202889e1cbb4655d5e7fadeb497fd55326ed426fe9a43129553
SSDEEP 12288:BfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Br/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14E5523D3558955B1FABC003986764428F5882E2DDB5619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 381fdf75ab5fff79f1ad600b8da83b6a4a5e820759203bb0cf53f6e0844979e9
MD5 40c98b0a7776e9dc416ab1a247083690
SHA1 eb08ff86dd5282cc4fb8603f80a22ad19e3657eb
SHA512 d510e90dd209eb77c867eb852a863b91f5bb685aca96c55719c5a627654f37df2793ff0e93f0c6e4a5d604a05426be262a480c48d232c5ccb93c41db81c65784
SSDEEP 12288:d2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b93d320d81e6aebec57385f327d55f15e526cbc7cef3b32e5f75a47f0712ccca
MD5 a92c8c8b70cdcdfe9c7eda0baf90698c
SHA1 8445613c796701864fd7e8117db23b542a5bf466
SHA512 3d2661deda36544605c617f14d48382bd66eaea5167a6fc0c0af73ab1d5a8ddad061a1896a59bf407cad8826b62dd142130461b504ac9fd56148bdb0f9b0fe31
SSDEEP 12288:CYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1365523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 be87b8079e831a01a2aa40918cb3db54c241502b7bc46fadf4f5dad3e928352f
MD5 0eba8a3e81591d02dea461de2e7001a7
SHA1 d23342d0fd4e7c655d15898eec0f35479e985d0f
SHA512 49f1485ab669ad29d0748f4e54b26d05b11944cafb0b6859cf651161f23c105dddca89330d3a106f4ae1d61606406f054b71ccdf320f9ff04c5c20e7e6db9712
SSDEEP 12288:WZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d9263079f0a38764ce2a380fdaad03b97a7bc9e84da773a89e921fb1341e70b8
MD5 c03f60d909edbbba5b2a300f4ca75bdd
SHA1 d729f4a86bb7fb5c6fcb8ed0efd1ded353cf438a
SHA512 2f2d7f86f4b327064e194acf79effb74527036e27c36279d87bd1bdbb9003cc19b39b3a19f8c255df30e9c6234dd2ca56dd43e51b2909b24e46ec28ae24f0812
SSDEEP 12288:XQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3548955B1EAFC0039C6764428F5882E2DEB5659E3E3043D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 265009a2a9ec564a15c43162daf675e75dd9d8198c45938aa91356ca7abdf09f
MD5 666acc01da66224926b9c4084631fa4b
SHA1 f18c309bd243dc6af827b6e46e313be3afa315e1
SHA512 2c4727745de26049558762bececa0e9135122fe8e7f2b9654ab946a49dfd5fd4c6ed3afff681c8401e08d9880240e9e1f68c020a13dc1ce12472136ba4d4e513
SSDEEP 12288:jCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 1ceaba3504bde665522ad6323801a91818e6f864a44ecf55fb7879e58fae0662
MD5 272fbeca5d8697014f4a00533f7de89a
SHA1 aec1f4a7744f489be120a277dd21b119c09017c1
SHA512 6cf6b6852acf0c72d4360f62094a36e93c9c5bf1bd8c0f36442e4dd9bce19d1f10cccfa0d6b4b4024118183798e0634bd373f612f9945282b5c24b7ccbd365a8
SSDEEP 12288:WBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC5523D3558955B1EAFC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 487133e48162b171a44e04e1de698760a58ec3d0fa097d2fcc5e7a7e6c71af78
MD5 63a974be711827c0d3e59360747086bb
SHA1 d084e20ee2883f4f283c1cc6edd5d35d8ee6fa66
SHA512 7bf56a2fd319fdda847b32002783f3e0f58f16bb44351bae47fede63d62792d8b7d2c8296ef51a4b639a816a37f23ec16d19ca8536a3304c1a951a4d772b83cd
SSDEEP 24576:Ifwvzk9RX6wkyAIO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7MnYIOLNiXicJFFRGNzj3
TLSH
T1F085DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6d8bb8d9dca4101024f82d08250b87810a7ba199533b161df87224db66c466de
MD5 aaee05d391c68dea7aa4fc204140258d
SHA1 8f4eacf8a040c4a2e1624369bea8658bbc1d6e1c
SHA512 33a89429468380a55cf9caaa7740e9eb5586a15ac415c2418ad1733c8fe631b52af140c164584475bb31e242751b742eba015c882e0fbbd858662981d04fa57e
SSDEEP 49152:EYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JLNiXicJFFRGN:7ySzPx7wRGpj3
TLSH
T126066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0a6f78a90a15f3e374be0f944d14dacc17bacb348ce9d990d433002a21409f74
MD5 e277726191ebdb8e39db71248fee044b
SHA1 8f61f6cb0614f44416cbcae0fb9c1ea8f50432bb
SHA512 7390461e122bf7df2dd156c41b46331398bdea876c076bdd07df9e1945412658c4a2604799ac19ed5a9396d011a228770139144c000606195e0b9f24bfc5280c
SSDEEP 24576:A47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A47JUQjqirIhCnDHUPfF/ZLNiXicJFFS
TLSH
T15965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e2ec88409c966d74817ac39dc58bd91f2945dc7cdd77ec6258ff27a7628a59dd
MD5 44fe5a38874882f03555cdec5399bbe2
SHA1 07cb41ce936a25c4e0a5897672fc6214070099a4
SHA512 822ebd072d5e9c0a45cd9023f8a81c0d8da17886c7206b84f5892d0436d547d97fd3e0f7d491c228b0b4d7cf0900e7e23cdbcf9d6ee7215abaefde1b1d55fbe7
SSDEEP 12288:DpsfoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ka/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C465F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 db43807defa7577dfe5e9fd096bd435f50231e3cbaea707bb18b56fe24dd795f
MD5 54ce61e2aa91516dcbc57fdb416a6a55
SHA1 698d540a2c3fad356939c05a83a6c8c47574de22
SHA512 1bb0429486c98262b72f9ffe607bc335e30c634e22c4d5b3b0c44fcfbfecd843537bd2c323c207f6751fc6dbc61dc76fd0f4169215c87ea02175ac4e9c91b0f5
SSDEEP 12288:P6S5MU3fMrpKX1kJ/xjCH/l4iIcNuCX6ZX:PJuUPspKXo/qN4XquCXU
TLSH
T15B351810766ACB4FC66940321E73C6CCAB707D01EE45AF0773C9873F9576658BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 dfd04ae539f2bcf738218aaa61864255b6ddbfc39cecd58283e220ae3fbad334
MD5 3ce5c52e1bf1d1d349558d8484986779
SHA1 df13b4be30dec83f90c4d049a2719576a6bac263
SHA512 23c5de2fadba1ac482d0d485146cd58c1ff8425ea37d34ad3afa20c1d3cc4c59e379757c9f11d04d80104e192f6bb9cf8b5ae644fcb3b637da119a39dd918f59
SSDEEP 6144:LiFD/dXu72WiFjzYdceM0/jgyteLL6934sCLccyZzPnWtMx11d+RsTXw0PC/QQNX:k7c2jl0dDM0rgkFzaPWiA
TLSH
T15755F9405537E78FC5BA2032073A5B8C6BA4DC16B7456F22B3C9493ED82BB15B1B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3f5cb5a371c82a14f00197ea6550063ee0e0a3bd88208d7eeef33b0bfdf38ef8
MD5 029bf96ed02e7ee82bcfb5c96e7778a3
SHA1 e133fb50a4cf123904bc9bd2c43bcc6f290d0084
SHA512 f7f891ca8320847a251005660430bc0d88c23ae948c22b3575da0794b1c787faa714c8ff8e1392becdb8569a29a5c68f1e92658fc8240400f89cd19b4d8ad8a4
SSDEEP 12288:DF7giJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523A3468C59B1FAFD1039857A8434B5497E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c80bc6100fabe2c42752f973fad0fafabcba85ee61c89a438354e3453ae362fb
MD5 e13e8bd58e6b98bd6ea92a4e4ea4d4f4
SHA1 f8f3f272b5d475856596047f0c3267315b2eac5c
SHA512 df357ccdc03fdf0a657ee9080fef1a38522317cdf905a37f2ee1d57c0f9e25cdb5427ce5848d91c0dbefa0c50d38fb0fdbf3fdc9c9c3be14a9617da5ec04c5aa
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jgb4mBIBhGFHLNiXicJFFRGNzj3
TLSH
T13265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 34f9d547103f9db2829c38e694bbe0b5ff533be357f3ded93ff749a0c4b84a99
MD5 9e6647feac9e5485c55912b5411ceefc
SHA1 336b3a4701c7b3c07e57b3cb0c45d508cb367ca7
SHA512 a54bbb1fdbfce1248ba40013633cfcad8173369d7df5c7cfd757d966ad7d7233d85c868608e6534d3cbf9f58608003ebd16f1c6318f4f868c439e818da4f5a0b
SSDEEP 24576:NG88u8FpJqH1vzria7/m3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A7ZFPqVya7/gLNiXicJFFRGNzj3
TLSH
T1B785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1afb962b788ede91a2f860f7653fa06f43f8a804ba4331f75df821856d0ae0da
MD5 28145790f90b436ae1fe60a6f6296d9a
SHA1 e37fb90417dd9d84831b368aa53719fa3a11db06
SHA512 cdbfec1a3a604eae3dc1d7efb990120289f4079b98a858ad612aafb09da25abae7dc4a24e354412af88f1583c4ea443d7922b4692593aced0c2e93074ad8f23c
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjLNiXicJFFRGNzj3:+G05lO43bG7wRGpj3
TLSH
T179D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 55821e4a1ff0e7f7ea6d1ed06a8156dc7954c3d582903f8c30f6745e3371036e
MD5 29b11ad9ac253e6286a73056a1b11c37
SHA1 e06f29508c654464848b8d14ff6d2c5c38321368
SHA512 1a8b0b6f7b46c44623f54dcc9416b9c4ea04d92b437376c9f1cc7a6281c8884615ee0fe604a6c165a02b7b1ed3373bed69b4e6a67116c0c43b21ca778ce30f88
SSDEEP 24576:Efa5POZ3dpyWVM50JicR2hG0lasx2+47eidnJ/TwSfVcYG3K/cJHlnFR+IGNe8jg:ca5POZ3lJt2pasx2+mrLNiXicJFFRGNf
TLSH
T1A365BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9e706bb7e1be337f10d23e5b1f82ed08798f0571a0bcc57acce172928773300b
MD5 2d6bda8245e2bbc6fa9c19d1e2131c93
SHA1 095c68d853a12cdbd8aa5d3fe58d96a74d33e32a
SHA512 2bb54e7636c89af2ff879b33e1618eefb41128eeffaac041630ecae6efa849c4eb7a530694d03f67d2f147cbc0a3d73e7ac50d31e29e7d38073275b2ab250f38
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fkf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xNc/zEOVHFALNiXicJFFRGNzj3
TLSH
T1CD858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6b2d58cea8dba0f1827f6a75970430614ef19391110afbef2e78674dded0dd66
MD5 52d13189c6bbec002fd62ad664350d09
SHA1 72dc94844acd0994f35000c206cb99da1c2e70ec
SHA512 2f13be94496cbee1e64fd87bff774509b4b5f4c9a492a28398e4f6cb431883168669e91cd72ac6befa0a5dbdd93c64b1e3c7b83c5874dcf8d06fb6932bfbd66b
SSDEEP 24576:BzkNvNnaFeYhJNtmZBmt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BzMwBtOmtLNiXicJFFRGNzj3
TLSH
T11B55AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 33a062d78ffadb744010e60dd9d097fa4f5fedcc83958213cd34e322a57e0802
MD5 1a3ff0fd5aa3e31b06f2a9e5c2df5bd4
SHA1 bc7ff698f945f612abd8c862d91c9f92d04c7a7d
SHA512 fbc541691ddd221d6761db65e71b02ea1c2713637ffeea30da32a3d6400e355e9417896bd5f98cd1cd40c405cb459e94a6570a5189c6e8fb7f7c745b00d60587
SSDEEP 24576:4PUr+NQz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4JQzLNiXicJFFRGNzj3
TLSH
T1C665F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0ae051db3b1cc965c342c52b9bce5386f0ccebc5a59a8e49fac46b53d7d6eed5
MD5 429a2e7813f313e7d9107ddd2d364222
SHA1 33c354ca06fea1c903937a1b3cc417826bad42bd
SHA512 5665bd876318c54fa47b1f9257cd3d4c539c7a35e2ba1cf81b0083500768098e187f892747a9c8e22c5e0d6cd32e93833decedc090c25d4dd90b55e3605789da
SSDEEP 24576:oD3FHshBIYQgAW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oDVHeBIAAWLNiXicJFFRGNzj3
TLSH
T19175E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1368-51-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1368-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1368-46-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1368-47-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1368-40-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1368-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1396-129-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1396-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1396-137-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1396-135-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1396-257-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1824-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1824-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1824-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1824-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1824-382-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1824-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1848-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1848-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1848-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1848-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3332-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3332-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3332-15-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3332-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3484-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3484-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3484-109-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3484-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3484-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3484-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4512-309-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4512-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4512-68-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4512-74-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4704-78-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4704-0-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4704-9-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/4704-331-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4704-1-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/4704-328-0x0000000000480000-0x00000000004E0000-memory.dmp

Download

memory/5360-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5360-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5360-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5360-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5360-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5432-116-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5432-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5432-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5432-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5840-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5840-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5840-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5840-307-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6056-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6056-80-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/6056-85-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/6056-310-0x0000000000400000-0x00000000005EE000-memory.dmp

Download