xmrig | c9c7a6e3a5259695e22262047dc2ea90195effaf5e0e4128427efade6f64c1f8

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 5.7MB
Sample261027-lf232azw9j
SHA256 c9c7a6e3a5259695e22262047dc2ea90195effaf5e0e4128427efade6f64c1f8
MD5 ac52f7daf0753c1bcad5ed0f9510f28f
SHA1 5eaee3ad5e4d21b7f0d4c4c132565107515be30b
SHA512 336c0ce805d727fde1920405609baf548fc40bd3a0b972a5cd33a0968525ed586b9ae4441892ed24d53be2ecfe40b0fc14588c566e4d8641fa48868ef18a7981
SSDEEP 98304:un5g2rD2XiuzWzNbhFVj3hOhY5gNppnqAwBYbJzl85w:45joDzm33zOjp6BExR
TLSH
T1D3563304F6E110E7E2B68638878B0642F93BB9060B58ABDB4350F52C2F376962D777D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xmrig miner persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c588-184.dat	family_xmrig
behavioral2/files/0x000d00000001c588-184.dat	xmrig

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MicrosoftEdgeUpdateSvcsD24DB9F3\ImagePath = "C:\\ProgramData\\0acfa72b603dfbf3\\5EF01B6ED24DB9F3\\5EF01B6ED24DB9F3.exe"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
3540	elevation_service.exe
5416	elevation_service.exe
3444	maintenanceservice.exe
5720	OSE.EXE
3572	PerceptionSimulationService.exe
352	perfhost.exe
700	ReFsDedupSvc.exe
1888	SensorDataService.exe
1576	ssh-agent.exe
5176	AgentService.exe
5756	SearchIndexer.exe
1344	5EF01B6ED24DB9F3.exe

Loads dropped DLL 3 IoCs

pid	Process
1300	Process not Found
3216	Process not Found
2488	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e7cd9f6031e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2324-6-0x0000000140000000-0x00000001405BB000-memory.dmp	upx
behavioral2/memory/2324-114-0x0000000140000000-0x00000001405BB000-memory.dmp	upx
behavioral2/files/0x00010000000093ac-222.dat	upx
behavioral2/files/0x0001000000009442-223.dat	upx
behavioral2/files/0x0001000000009cd6-233.dat	upx
behavioral2/files/0x0001000000009b92-235.dat	upx
behavioral2/files/0x000100000000a1d4-240.dat	upx
behavioral2/memory/2324-247-0x0000000140000000-0x00000001405BB000-memory.dmp	upx
behavioral2/files/0x000100000000a0ce-239.dat	upx
behavioral2/files/0x000100000000ba34-237.dat	upx
behavioral2/files/0x0001000000006215-236.dat	upx
behavioral2/files/0x000100000001b99a-232.dat	upx
behavioral2/files/0x0001000000009cfe-234.dat	upx
behavioral2/files/0x0001000000009952-229.dat	upx
behavioral2/files/0x000d00000001c589-376.dat	upx
behavioral2/memory/1344-383-0x0000000140000000-0x00000001405BB000-memory.dmp	upx
behavioral2/memory/1344-432-0x0000000140000000-0x00000001405BB000-memory.dmp	upx
behavioral2/files/0x000100000001b99a-446.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091d667cbf565dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6395eccf565dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c23515ccf565dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000969df5cbf565dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8d2d4f8f565dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\InprocServer32\ThreadingModel = "Both"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E21-2F3A-4B4C-8D6E-0F1A2B3C4D31}\DllSurrogate	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\ = "COM Surrogate Module"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\AppID = "{7C9D0E22-2F3A-4B4C-8D6E-0F1A2B3C4D32}"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\InprocServer32	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E22-2F3A-4B4C-8D6E-0F1A2B3C4D32}\DllSurrogate	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\InprocServer32\ = "C:\\ProgramData\\0acfa72b603dfbf3\\5EF01B6ED24DB9F3\\5EF01B6ED24DB9F3.dll"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\InprocServer32\ThreadingModel = "Both"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E21-2F3A-4B4C-8D6E-0F1A2B3C4D31}	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\InprocServer32	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\InprocServer32\ThreadingModel = "Both"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E23-2F3A-4B4C-8D6E-0F1A2B3C4D33}	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\ = "COM Surrogate Module"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\InprocServer32\ = "C:\\ProgramData\\0acfa72b603dfbf3\\5EF01B6ED24DB9F3\\5EF01B6ED24DB9F3.dll"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\InprocServer32\ = "C:\\ProgramData\\0acfa72b603dfbf3\\5EF01B6ED24DB9F3\\5EF01B6ED24DB9F3.dll"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E22-2F3A-4B4C-8D6E-0F1A2B3C4D32}	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\ = "COM Surrogate Module"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\AppID = "{7C9D0E23-2F3A-4B4C-8D6E-0F1A2B3C4D33}"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E23-2F3A-4B4C-8D6E-0F1A2B3C4D33}\DllSurrogate	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\AppID = "{7C9D0E21-2F3A-4B4C-8D6E-0F1A2B3C4D31}"	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\InprocServer32	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
5416	elevation_service.exe
5416	elevation_service.exe
5416	elevation_service.exe
5416	elevation_service.exe
5416	elevation_service.exe
5416	elevation_service.exe
5416	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2324	2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5176	AgentService.exe
Token: 33	5756	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5756	SearchIndexer.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3540	elevation_service.exe
Token: SeDebugPrivilege	5416	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5756 wrote to memory of 5968	5756	SearchIndexer.exe	104
PID 5756 wrote to memory of 1200	5756	SearchIndexer.exe	107
PID 5756 wrote to memory of 4188	5756	SearchIndexer.exe	108
PID 5756 wrote to memory of 5204	5756	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:352

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2868 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5204

C:\ProgramData\0acfa72b603dfbf3\5EF01B6ED24DB9F3\5EF01B6ED24DB9F3.exe
"C:\ProgramData\0acfa72b603dfbf3\5EF01B6ED24DB9F3\5EF01B6ED24DB9F3.exe"
1⤵
- Executes dropped EXE
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bcff3d3b3b2ff1a0822a55fdf1fc2b84d91e32846696bd51eeef5775282403a3
MD5 1b992ca408148b26e39ecad5cceb51b9
SHA1 9dfc13696e73a0f82fec9f7b011817151e0cad9b
SHA512 87a30294952e6612eb633416ce2602e94362e9c230e17dca31498972eb8f9e422f2982f832525bb9a8aa06705b54c36347159bf000f24adafbea7879ac43530b
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrT/M+w:F3q6HjBUw
TLSH
T1FBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 cb3715ff20f842c3bab1d1c4dac99ea4ab50e028054a26b3fd91c8d7b127c1b8
MD5 7ab4ce9ec6c3d42e567037d7a7764eb0
SHA1 d3111c6ffa38d9b06b119113f5b9dea2f024f213
SHA512 78dc2e3d86656350b11f82bb56403ffa55c6823afda572caeccb3fb198f20e2b8319a698e681e9b15d46fabb3cd75e22bd3905e0b7334fd570a7a8ed62d258fb
SSDEEP 24576:RXYdDfczA1oHjto1GFxlXutIs1WZX5ARyvM3yReRdqmCAzxj884:Sfc5T/M+w7yMRYmJzxj8Z
TLSH
T142C51235B7E104F9ED678138C9A28552EA73B85647A4FBCB03A0D9291F333945E3E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 628b9d3fa00d2e06fd3f83c14df10acf0351645b273c3c091e8309bd74108301
MD5 c4a387aef843a396e3e54b6beb87c444
SHA1 c52755ec261719b6da0f6512ce3d92d618bcd378
SHA512 d6bdb37900868c31b176d5b95ea66740e04d5fb23cf1a062ec0e4588d7e45871db550bf4b04e5ab9c3dd682f60c177f8aec1d7377f0d1972074312c3e112e291
SSDEEP 24576:YXYdDfczA1oHjto1GFxlXutIs1WZX5ARyvM3yReRdqmCAzxj884:9fc5T/M+w7yMRYmJzxj8Z
TLSH
T18AC51235B7E104F9ED778138C9A28552EA73B85647A4FB8B03A0D9291F333945E3E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 9819f2386248cc0e34a1120f0fc6b3123520ce90d9906b09493fe2e697b04f80
MD5 d6a0770095725d9723c05a6143339acf
SHA1 fdebb496a0ca8ce579aa9c6bd948f1d5479a031d
SHA512 f56b38791d40b0c1bbba72a16eb104be157b4ae4a1bd5049921fd9c6f6487db030ec7e47ca1aa32f40ed771f19804279d921599ece8e6d9cc6e5af9d4e3707fc
SSDEEP 24576:kXYdDfczA1oHjto1GFxlXutIs1WZX5ARyvM3yReRdqmCAzxj8847oHjto1GFxlXy:Zfc5T/M+w7yMRYmJzxj8ZET/M+w
TLSH
T1CBE52335A7E100FAED779138CD938A52E973B4560794F69B03A0E9290F372946E3E7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6f8d7898e02944111431bcfd643a45611856f1cacb8160522520781214e79024
MD5 c6721eef3d94142d346a93133f7c3d2d
SHA1 6d6ac8d2ed9c335adb61795e9858d5c9c535de7e
SHA512 36c76ed2fe71f1b3d826eca3462e11a3c5e02af37c7c4a28958d5e9a4f4276a7ab9a810d59cb1aa3d008e13ba94286f7824a5d186552359789b997ab6a32b2a0
SSDEEP 24576:RXYfDtczA1oHjto1GFxlXutIs1WZX5AR:0tc5T/M+w
TLSH
T1E385F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5fdb3dda03a7af128af4a185bf05beb58dc560a4f41745362900fc6b90b8d258
MD5 09c873cf74617e936f69d26691dda08f
SHA1 f63135172240d0bb6655c2df538d22a0990f2b16
SHA512 8b7b35663a118bdde629146d6166c0a7ca2660c306543f8a6cd6989a6ea6c26ef5cfdba6fe0fcf455ca11cb5702608d67c79293b342fe0265a9fabc30d5a6664
SSDEEP 24576:50Le5ji0hmxIrMKoHjto1GFxlXutIs1WZX5AR:5Pji0AGAT/M+w
TLSH
T1B9959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c1a439b16159e724177be9c2dea1c5e925ab5d446492eb4f519ecb5d226d274d
MD5 051be5c38f6729a261398a93379942f3
SHA1 6034dca00914df1d02663c81607fa4e89426c589
SHA512 d05301ab9425e373ac792c0fc3f6d3db0e96f2a0ba89bbd9d44f8ce9206ec5ef7e462829df488646df985004c7ad4d3a8ca5a16006076db923c7b908ef9ee919
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuIoHjto1GFxlXutIs1WZX5AR:k/ezSC6vUzPvxHjyUT/M+w
TLSH
T17C756C25F5788323D0B2D0BAC5D7BA99FE7230465B3089CB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b7d40b2cb3974a032129a52cf4adfea05c655340e227dd94a96078604f85a7ee
MD5 dad0374895ee323d810a220e5cc541f6
SHA1 b71b2c08c0a52f894bf72985ab6933f1e663f37f
SHA512 bcd904782a974eba567fabe83e0d55bbcba00eb5666959de06cf45dd1146296772f39c87d83e15bf42548440c0366bb2c6a2a34fe4db0b3861db87c6f372671a
SSDEEP 24576:rVbqPb88hv/l+6JoHjto1GFxlXutIs1WZX5AR:rVO88hXl+HT/M+w
TLSH
T1AB559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c93e38cc11e1fc62d1451f9563b1a5cd1cc46a006e0bb27f3fa4b3f6b5dbcafa
MD5 10c6376e40b04ca9a5f5995976cdad36
SHA1 4b302b78c74aef2d5ca3d6c998772064d923152d
SHA512 0bc73421df923eff3fe03a73283f51fb3d63d71180a88963502b70c276a6299f641fc965fca3957d0ae45d50327b1e4dc54ecb7593bb01d8cb87f3f436320c7b
SSDEEP 12288:QHchKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYcN:QHOoHjto1GFxlXutIs1WZX5ARxN
TLSH
T18565236399F250D7F77A11B02DD77A61ECB7BB06094824BB8B50FE190E3C060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2068fad9a4e8cbb0eafcf1c785688a03a0d353bfbc8bfd16ac9387b1b8e2c26f
MD5 d83069ac9a556e6cb4c54d99806eacb4
SHA1 c4fbcdd0ebb06e51a904708448b7ba4ca40857a3
SHA512 1455e542f1f495b8ce8a7ff3a4229ae6c776c06e35c5eafcff91f8ce368b408b23b6abb3a74b7ba1a94efffc622982da5d6782ceb74825e58edc31bf6b6c3fdf
SSDEEP 12288:ceBNUbTVO86UnhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:cJIUhoHjto1GFxlXutIs1WZX5AR
TLSH
T1A585CF3BEE38FCD2C27A5DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1cb7dc925321b5d91a6f128fcd3a4ff2520527da8758105d4ffc4852ff5a62c7
MD5 fcea0b5ade7d1e7e28c450de5ca42a6c
SHA1 d88ea38a75b2e5e4551efb54b23ad8158170b895
SHA512 4f84d607883ed50ace002435e8d7fa4fdf704c00c8b3a6abab7ac1adeb87eabf14435ced42412b1129e4aae1bdb679f622cb92ba3e6f2ca5cf4ab5ccaf609e0f
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:wQvGAdlCEL8c/yRNw5CVw
TLSH
T1D6266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2500bae49d10686e9c54fe7a29ad8d709adf99f57d60e2bf7fd5ee48efaa1c70
MD5 5b6514eb8ed1bcacfc5802f0c939c831
SHA1 54abeada502b881010409692127efa0ce3e31cf0
SHA512 ec51f6c5e13fae3f481254209dacfeaeed62434727ca3859a7216581a1888ab902b7cffbe61c0ae18eeca11c6cc2fedbc4f92a1f84b97877c6aecbe882f9e1c6
SSDEEP 24576:27ewsAjvoHjto1GFxlXutIs1WZX5AR0N:kljwT/M+w
TLSH
T1C485E031FEB0E036C3BB0DB11B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9fdc7aceafce9750077e0d14cc48fdc7a17541632258b5499c79a4bd85aa6dd1
MD5 9c64c7ddd31b11dd13bbe4c833d347d8
SHA1 7468a643586abdb9e674413120124f9cf4a90318
SHA512 928cf4fe04fb39046d2401e1f8181967a66f0b773aa97c04045abe2d350fe77e148a01f16a55a0fe480616ed15fc70bb668efc1a97843a6c7c054e4fa863ccff
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHh:9UEtQevvqc2W1cpV2EI32
TLSH
T1AD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 008c64c89d522bc9aa69c6ae3c245b401bf4f0ffa218404038dc83d9fc01be1a
MD5 75b893d20872f245922f4a8df0514c71
SHA1 0976463ae6196bb27ea59a5abd7bd499d0a97433
SHA512 68e40744d560dccffc6b8c35f3ae74a8c4c9d29d59f5c06286273b4ba9d8b5e9f0c745ee49f7e41b3c5395e04e7f022586b3822b526072c0d6f3245d762687d8
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zQT/M+w:QoqtVjnmRw
TLSH
T135D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0d831e81296d0468be97d32293ec2b47b84f28f3457485e196c896e28057d5ab
MD5 d383e223cfed6c11d9382bd6da14ea4d
SHA1 713364b71ba2368ba255d2575b8ccd277b6225cc
SHA512 fc8137ba07b672368534624d7c5325f0827e9bc9cccce2bb662c40823a73cccb8afc3d0babd426d68ba854768bc998d57cd08527614750c175c579eb3e756674
SSDEEP 24576:oAhGLJIFoiwtA5l7S53EoHjto1GFxlXutIs1WZX5AR:oAMyFoiq5tT/M+w
TLSH
T17935AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a6813f2c673dc65279fd6a5f64d2880ae31e8e490dc933fe2aecb9e035c0e558
MD5 21a6b952a12b7e4401053f29b124a1a6
SHA1 220c53dfd826b95486fa5a7b8edf317166f7f123
SHA512 5a33f2adb67d7be185d004eaba9ac3f4e698722b0208cb40b994d81fb3db57537200b5c5a2592dcd6ff84f678ebd2144397f9865707fc8bd5045fbe23d0b03c9
SSDEEP 12288:5mw5HEjsChNDBFgl0WDm+CChKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:UwuiOWLoHjto1GFxlXutIs1WZX5AR
TLSH
T16885F14676E50CF9E96741388597D536FBF3B8022A25D72F0760CA1B5F37220BE29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e3e285cf8972b5cc8a753ca2a3252cdba57e8eaa7d97a04802dbcddaade62d30
MD5 ae9c2e8dcf8613f0bbcd7f0cf9671839
SHA1 98e1c4078b827e2454526099b66d907bb753f0ef
SHA512 0fc4b794a0add37627f2a06aac4aec6dd49f6f1ebe450c8010ec755574717efb12d28f5252c496a0cdfc6892bc4f611193a7052379e8d559471a6fdc199191ab
SSDEEP 12288:9TZ1IyZhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:pZuioHjto1GFxlXutIs1WZX5AR
TLSH
T14975125626F020FAE2A752789DE36A55EBB3B013173503DF07608A2A0F375D16E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 64fc7f749d47d03a850d2b65034ed9b648353a9a7b9077ff92edeecbe33e2db6
MD5 73061fda4fb39eef996b85f0a52e067e
SHA1 07324307f1dcb0659e8720f1dafcd1916624809d
SHA512 7a3318b62f8630be34fd7a67b7befa9f756fdbeb0b22ca92c9bc9a621c801cd0213f32e455b1e972e16b44da84059480a34acf71ff6c3ed4b45b03cf99e1bec0
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:8QRQyi36YOcPQLvw2gAf+PN3ow
TLSH
T151667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1f154010104385ec13d0e12da3f1a88713adae4126a219f902d8416470c1b4ad
MD5 a826ffa63f4832a5b2d4be88e528e2b3
SHA1 e2347d9e85fa1ec9263de28867292e12ac8a151a
SHA512 fc1b60c6c475acca76c92085fe9d5538c74807bff22414fc87a1b05fa97ca6505985e956664964752fe91b8b0dda98f587ffb6b676b3711bdb99b2925dc95a41
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:CQRQyi36YOcPQLvw2gAf+PN3ow
TLSH
T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d7fa4adc25c34bbb1cd419f01da7fce830d84d30fcfdba0d18c2dd40fa47b6c9
MD5 d2c4a48f8f88d177bc80d0dd3e146b7a
SHA1 15a4282a35565f441103bfb2d5d8264654047445
SHA512 8bee6244eb2b9efa085f048a6d2b8c7d806c9af9a3689b502afd461fabdf70453b9094d29644bcc480a4e3e0beb111713329714989432176c2c38957204567ae
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0SoHjto1GFxlXutx:f68Qg55nhheWu7PNU3/AT/M+w
TLSH
T1C2B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e3968fbdaadefc6fe84806f4c74138793385f85fc27226d8a21df0cd1300536d
MD5 177d5320630760ae3579f813400ce800
SHA1 b7d82ece743d4b1f7ca765c732bce10a02a4c28c
SHA512 103291709bb917193239b357b9db920b20978705b129e1d298a5b02b6c7ba08daa092356ed105be6e47917518e2d9061038d84b58363102b9e05325bf3237211
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Z:dy5112gYy5azzVvL69nLKnhZDw
TLSH
T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4b2d0a62fff03ffc5b5f9154423d2af6c91282c4a474f285194c924b53e82f6e
MD5 4ce442c7956c276256ae6fb875ee4017
SHA1 b310d426c0c0046cf190d1400950810382d4fc00
SHA512 ba3939ae7572dcaeecb90ff158100eb1990235457e6de2d83462e1d785de3599987e380ea3906c79d2696c20ef17e246ce86405d7d9bb62b5791d877f1ab9199
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2T/M+w:ru6JmVxd2dww
TLSH
T139D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 22f5673d22d3cea2ee31339e0340adeac67d688f841c7944110e23b34596dfc2
MD5 bcef95362069cf52b9c1ececd21fc893
SHA1 874197c6f97aaecd0c58a383e991cc92e593911b
SHA512 dbef4c11d2ef2a2c6936dcf9469b0a66cf22bdb5f52cfb0a6df8baef56a6cb01f8b0d4db326577677df6166f050b772de6e99633b0e657bae6fdcae7467db733
SSDEEP 24576:7hv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3RoHjto1GFxlXutx:R1hpsNoJpF1A6UU44CwH7R4xaT/M+w
TLSH
T199B5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f5fcd831576d13cfa10a31606f3040bde8df6ef558b07f1f3a7a4b36a83a2d28
MD5 a85e51cb6a2329bbc3fe1d67de866094
SHA1 753a3b8d5b01d12e97689c21996cbedae905fc5c
SHA512 121139e8e0df70879f00458b254280c16ebdd6fb182895a835f73dbe146c644108c5d4a7dd05f409a12fa09e91acaedbb4101bc65a7ac890fff9887f0630a1a0
SSDEEP 24576:m4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqioHjto1z:aSuZQIY0Be2KRRVtOnks6NMHqbT/M+w
TLSH
T13EC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 43dc0f705faf63bdd88148846f809a5fe6e83922870764258dcd57fa45fd186b
MD5 5be9f8e2116c8d60021c7728c6849fd1
SHA1 a910676783d3c5d9aa42af9480d83d6e29e0ea01
SHA512 7f02293d640803a843772144a3fcf35438668929111877a53957c05b9d401889aec045173be0ff2c02f9d09a683f95de51894e6bf989592c80db8013fab16523
SSDEEP 24576:YhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLRoHjto1GFxlXutIs1Wg:YhtSn8EApI0figngiDn0AP5wmT/M+w
TLSH
T15D95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 8144ab7abb960b89af8c43800b0d84a778a24837ec133f392917cd86abc84627
MD5 e17f6cd8951756678c6262e815585e9a
SHA1 a7ff7be40d701144991abbc1fce8eb46b2c4d5d1
SHA512 d6e5efa5155c3aa0d761043b523b260f913086f1da0dde163bd7095e67e47491726e592385c186d897ac948a22e6332d9fec72383510cb215fbbf6a9ef9b79b8
SSDEEP 12288:+0hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:+GoHjto1GFxlXutIs1WZX5AR
TLSH
T13C6523639CF340C7F62551B029C77AA1ECBBB347594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 0e58b509ec80c9ae89acf32f9d337eb25fb7a7669fe6337419040ef490a414e5
MD5 47277c16945ea4ec1ccebf48dc15368d
SHA1 a03c474ed26379602dfd1f81bec942371c37a0f1
SHA512 026ce8e8e90bf784113e6cdad837c99ecc5e35c033d535ac36264b2914ec9190e29aaff31cc67e21ddaec5f6b38e4a8e9f0dbfd0f09d5101ccc715cfbc01d347
SSDEEP 12288:MdhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:MToHjto1GFxlXutIs1WZX5AR
TLSH
T144652363ACF240D7F62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ee16aa044d8d6be32df67840c059dd1a102c19db7afe80a4ee53e2d0f10b501f
MD5 29ff70f156a83b8201d2239d9bdc5a97
SHA1 b9cc53657f52404eb2df11750ce2080f7799ad9f
SHA512 0e69cf98a58546864c39344086a258cf02f8c7041f5ad059fa55b8896c04c56dfa48fbbec39b421da54c791d46da8ed4f78ac45bbdf68938909f4b2f4707c6bd
SSDEEP 12288:1fhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:15oHjto1GFxlXutIs1WZX5AR
TLSH
T1C76523639CF350C7F62551B029C76AA1ECBBB347594920BB8B90ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 57c4b88ed3c4c8e440ccdcce3072743862c6a8347e12e6d1fd3de483f1c98640
MD5 31d1b91e3fa7ce80b1ae1616ed0fe7b0
SHA1 5a5f094bc6035379a780ea5c9784cd779b18f52d
SHA512 144eb59906e00e3c6888975d4c74afd323a5b6a5b2be00ee195ba12922b92170d7c29d69491184bcc2e9ffadf4f13ee09b2c5b4768fa133293ec2aeb6d2612a2
SSDEEP 12288:XV+hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:moHjto1GFxlXutIs1WZX5AR
TLSH
T1AB6523236DF200C7E53692B49DD36661ECBBB6465B2521FF8B409D190F391A0BE31BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ac3070294d57e86dffeef5101e6ba3a485c72d909ebcf2b3bce2dae7e8da6cd7
MD5 afe67390f7897ffec19bb91173022785
SHA1 42e02d6d54b18ce7c7edfd585a27b2b85c675c2c
SHA512 654395a37d1e8d82d1d4a838c518099956559c05e346ebc9330f85928809ad568c9a33662c2af458f8a3b68ad7de4cfb32270d22260f34c7d54b0bd23dab0b2a
SSDEEP 12288:wzhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:w9oHjto1GFxlXutIs1WZX5AR
TLSH
T1EC652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1e1655b357d6c0790f338227c792f9e47659e3ab02214f6d09b9a07377f17710
MD5 633c64292bd19ee2f5d957fd2041b85d
SHA1 88dda30c144ddaead1d63f960a6463332d46de5d
SHA512 fdbcd3347e8d23865aebfe8a82024c1d350e76ce9d6d5d7d46db56afa33c1a32b2b7e91d8033219e2e6c0116d05cf5476221e6456fbe52c88ff0dc764949341e
SSDEEP 12288:sIhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:s6oHjto1GFxlXutIs1WZX5AR
TLSH
T148652363ACF340D7E62551B029C77AA1ECBBB307594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3ebf51944d2470a2d1fe59412d72b719acefa49ec79889ee1c0dfcf9fd7a5a80
MD5 ad470a9a55ab6599f52d986ff9f71d60
SHA1 d95705664c1fd68dc90744cd378f3a76fe4e3737
SHA512 bd6a8f0706446ea6950ef48ff084a353aef85febb5ca07562606dbc6479795c31ab0f56803580b32dc441379ce2d820f9ab6caf055ce36643bc684e11311e889
SSDEEP 12288:TUhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYU:TmoHjto1GFxlXutIs1WZX5ARb
TLSH
T1476523639CF340C7F62551B029C77AA5ECBBB347594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 13e7a3153c9964bb481046e9835f1766330ae3bd44630490ad8832555e22246e
MD5 579d4c74b40b3311b75d90db158a5c95
SHA1 2c96b8cdb00f4defbf10b651cc79afc2a3140807
SHA512 30197dce34953504834c6f22194806af8832fef38bd23f28c1ef2f49f708c5cf5122218b233eb6f18ec3691f47d6a56034235af33c1cc36c49f8b11282a61ebd
SSDEEP 24576:dZM0zFVSOuoHjto1GFxlXutIs1WZX5AR:dZM0zfDT/M+w
TLSH
T1F28502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5ed2cc96e60d43e918fd4713df3318042c4e70f37463f1342c8192181c202a45
MD5 201abd3d2f1b9aa743791794d38322fc
SHA1 87491a720f461bb1cb5843391a4671847530dea7
SHA512 9d919625724b14815ff0987e7af6f270b91baa8a173a00c433f60eb4845cfec1b1d8a38a988688a88d323b2115cb68b8d54fffd6e62d83b72bbe983baa30bdaa
SSDEEP 12288:vlhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:vboHjto1GFxlXutIs1WZX5AR
TLSH
T1AB652363ACF340C7F62551B029C77AA1ECBBB347594920BB8B54ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 60b12bb859d76d91162a1e66c48fe67927c99b2fbe8635c143ef63c9a00d26e7
MD5 442ec5b6eba49b4a1c69b6d83115e23b
SHA1 9c5f945070e962e91413748664f5b9af961cd3c3
SHA512 44e9516eae67aa984ffc30cde0c8a84a6aeda5ddee4026d44f04ccc2e82367ac427eae6e27dc814c59803388dbe8b5efc4e67e0eb3dad02a86c190abfffdba79
SSDEEP 12288:kZhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:k/oHjto1GFxlXutIs1WZX5AR
TLSH
T11E652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50EE190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d1e7b1e563dd7b44c33e5f0baf0f2945096d5c3fed6b50da1cf61fa50b5f974f
MD5 4bb58f9571ab2d9e63fbfa6eb36e55eb
SHA1 6258238e6d5939a36cc5327095bab2c7d7ec8e72
SHA512 edda605af9953ff02c7e5a1aefa90297741f076bffe8c3463ab10af8339065d8cd371dcacf5707fa37189dee12fe7c27e74692d1febb1a1cfd7f7268edefb2af
SSDEEP 12288:UyPz5L8QhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:NzyioHjto1GFxlXutIs1WZX5AR
TLSH
T1A075021776F230F9D136927488931A51F777B43607245ABF47A05B3A1F371A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 8b72b172c175894d9e06341b72e04a6a3035862c1d5b4f6534932af8e38dc6e9
MD5 3af9bdbc867b8c2046c1cc001a670660
SHA1 00b0ff88303efff6fe26f3fe5e2796ccf56a5501
SHA512 769f8ff843e3fe1ef3ce1c0c78628585856d87d2b6bc43e881e9cd83684f0726a01a9bee8e9029363eef5609f3d5e6346922758998ad6eaf06aa7a6fdfb48b13
SSDEEP 24576:bfwv+k9RX6wkyAIuoHjto1GFxlXutIs1WZX5ARUvM3yReRdqmCAzxj884:DMnYIPT/M+wtyMRYmJzxj8Z
TLSH
T1DBD5012AEBD804E5E1B7913C99E3464AF6B2782D1B71C6CF0259536D0E37EE06D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 d83f1689d8592503845f0b292533f4be49eeecd7084c1ce5e47b9cb9758b86d4
MD5 47411704bda2b12377c479d34c18b56b
SHA1 e71ffe053d4f8cc6f8bbad95f213930b6e6d7640
SHA512 4995be959d3a9c058192eb6e1aa74f62648919ad41b10e207544a825ba237fe1734d2f47ee7dcbb30e7cbeee2986e7a9943a3715a6bb1b7de5d76fedec688aeb
SSDEEP 24576:Mrwvik9RX6wkyAIuoHjto1GFxlXutIs1WZX5ARUvM3yReRdqmCAzxj884:WMnYIPT/M+wtyMRYmJzxj8Z
TLSH
T146D5012AEBD804E5E1B7913C99E3464AF6B2782D1B71C6CF0259536D0E37EE06D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ee13cd0312e313179fb98b946d0799ae9ba1e9f7943b8abe388ed8c2ac91fdba
MD5 801991af7e04db490ab3294049287a04
SHA1 d56684cc59cbe689376ad9a0860b8a2422e20429
SHA512 4948487a6af2fdc2a36ab8e0514aaf25cae2b340def383d1e9ed201916fe0ff720e1b6ae511bab1fcae4ee571e73c318ebfa42b8276870d41ab305fe43af7529
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GT/M+w:bySzPIw
TLSH
T1B3066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9b82093b9cdff0fac641a19025dc9c13d5527aeedb708cb1b4ef5914562d8b9f
MD5 1528726812aba8156d448a3b40300aa3
SHA1 9448b6d4569ca9de9405b5a587fdf2590588c6e2
SHA512 4d7229d344eff625d08688e413b974a401e7116481b06c54d0a09a7f54a1208d77b4091a2af10972e5d634e8a16d55440e70bf788f4af72663579bc32ff0914e
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYDoHjto1GFxlXutIs1WZX5AR:147JUQj1irIhCnDHUPfF/2T/M+w
TLSH
T15465AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5b8e4ae5302123e672e0a0e4153e08cd40dfdacdc97aa890c3ce7b596c67517e
MD5 03c9d6561df99b3f8491c5e93fc3cb2c
SHA1 f565788ed7aca6d5c8678e662b15cf06a1534938
SHA512 5d50255476342d498b896fc61f10744504ce7f5eea85049faa0a91a9b2304cd9500f3292a68483df96af6ee27558a287721481bdfb409ae63ef36960eb684243
SSDEEP 12288:GzsfQhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:RioHjto1GFxlXutIs1WZX5AR
TLSH
T1D775F11AD2A401D9D06E6174CB865A41F7337D2647E193DB47C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5EF01B6ED24DB9F3.dll

Path C:\ProgramData\0acfa72b603dfbf3\5EF01B6ED24DB9F3\5EF01B6ED24DB9F3.dll
Size 3.6MB
SHA256 41a326b73e5366b72ef3cf64da5cc0380ee74b0679a8252be0c38325d69aecd1
MD5 c960f1429e44b8404c84167517dc3b38
SHA1 3c313d0a8db9da5468709d41572b835eb95fa3d2
SHA512 c542ff27527e9298b3d926dcdd26ae951380a183feba86b70a043d407ec49408c0ed5c8a59baaa070846acecdf79ab5d6a4864cd560cac03ddd4086a903ef88e
SSDEEP 98304:QXkdrU/PAU0UuNYYYYYYYYYYYYYYYYEmYYYYYYYYYYYYYYYYYYYYYYYYYPAbBIH:QXkyaUOYYYYYYYYYYYYYYYYEmYYYYYYI
TLSH
T1DF068D16F54240B8C09AC4B8574F7A57F621748E4B69B8EF27A487283E67BF05B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5EF01B6ED24DB9F3.exe

Path C:\ProgramData\0acfa72b603dfbf3\5EF01B6ED24DB9F3\5EF01B6ED24DB9F3.exe
Size 5.7MB
SHA256 c9c7a6e3a5259695e22262047dc2ea90195effaf5e0e4128427efade6f64c1f8
MD5 ac52f7daf0753c1bcad5ed0f9510f28f
SHA1 5eaee3ad5e4d21b7f0d4c4c132565107515be30b
SHA512 336c0ce805d727fde1920405609baf548fc40bd3a0b972a5cd33a0968525ed586b9ae4441892ed24d53be2ecfe40b0fc14588c566e4d8641fa48868ef18a7981
SSDEEP 98304:un5g2rD2XiuzWzNbhFVj3hOhY5gNppnqAwBYbJzl85w:45joDzm33zOjp6BExR
TLSH
T1D3563304F6E110E7E2B68638878B0642F93BB9060B58ABDB4350F52C2F376962D777D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2b96a74d5cfe3e1dd6f6232e598d261de91164137d12793e6b3fb334124494c0
MD5 c0a1fb49cd86d8db5d68e60dbea54a53
SHA1 3c050155ec75b57fc8d9d50f2a7a55da909f2aad
SHA512 19328f8b048bc707671af1ca3edaae25f12375b7a71c91f1a4e9e9eba0cc9b5cf67e255f049b8e3182e765d18e4d95d9f51fa15a9923fc4ae8fafd403bf5334d
SSDEEP 12288:p9Xf8U3fNJ7XZkHfj5HYPPtvssFF/53RyUnvKQIJZ62fW:p9X0UPNdXKjlYPPtLx3RyUvKQIPfW
TLSH
T1FE452840B666CB4FC6A940321E37D1CCAB707D42EE446F0773C9973F9576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 b2b0d930df97fa23d4471ccaa4b20710fb9aa6e1f497ee6ab509854304327447
MD5 4b13833ce7fccc74b2575caf4a5f00c4
SHA1 033b3a19e56f43bd1bc51bb22bde37b82a4ce20b
SHA512 295177da637569a4ebe9a6ccd2f8eaef3da9c28d0e08d576caa8dc4006981d64b9fe5ccc57eba8b727f2841d16d624c2c3895b27bdb1f173ff61d19ba9726b27
SSDEEP 24576:PibDBtYPYYP/YPZYPMmYPqBePAYP0FrOmUc:+YPYYP/YPZYPHYPKYP0Frr
TLSH
T1B765F9415136D7CFC1F72032072A5B8CA7A4EC4BB7496F26B3C9453AD86BA11B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 b830b7cc3661484d7f0072881fd85fbd6d6eb06c8593f7e4dfe2346bb989548f
MD5 5f732e6f1b163e2c9d8f192fcb6ffc96
SHA1 2b26cc55803e88c0c2cb135bf38da273fc92f486
SHA512 535723f9b86d6888f8d129658256b222c4aa57797d78f07593a8a3a274cae2821f98853e15a8829796c839b54abeb65a0e37df9ab3890fa497d09c0715c453f8
SSDEEP 12288:K+7YhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY0N:hqoHjto1GFxlXutIs1WZX5AR9N
TLSH
T1B565236399F254C7F57961B029DB6A31AC7FB3160F4410FB9A40EE190E3D0E0AE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3fa01e8fd82ba4b53c55627a9745e84041baf80a4201ddfa8d56b636e278cb1d
MD5 442e3ed32c76a19157197971ce209cc0
SHA1 637b6fe10700b852a69f234e50cb4158e22220a5
SHA512 66fee4578eaba38651d4d0f3f5c6dd8200e2bceabe635fb5d3872b8624d956b3bcfa26dae164559bca490508c5315b30d046e827251c89d62ee014f3ab6628a0
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYIoHjto1GFxlXutIs1WZX5AR:2gb4mBIBhGFMT/M+w
TLSH
T12E659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 9e4374e9dada380ad9e9c84d3a5e70a43da75e95df7f990b08d90aafe70dadc6
MD5 be0030dcb8fa2fccdbe5c0ff427dcc82
SHA1 fd52e7e3d7c73750b599a2ce3a4c3cfc41dad0b7
SHA512 b9e5d9eff409ef7fb3159029e657c48d98731bf8159a7844498be49651650be3e32892bf37872d12ff1ac594b56d9b610b356b61af1e4c2098626b4c41348400
SSDEEP 24576:o8kNvNnaFeYhJNtmZBmxoHjto1GFxlXutIs1WZX5ARyvM3yReRdqmCAzxj884:o8MwBtOmqT/M+wzyMRYmJzxj8Z
TLSH
T1CDA5D16EBAF445E4E1FAC6749E238512EA727461073293CB9390C13F0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 c46f1a7b5415923bce008a431e2ec0383e4275626888020e4eb2807dc8243700
MD5 ccd9a69e20b1133b0a4c7d5e13678736
SHA1 933eb5339bbae83c1790d2a721e47efafe7cdb57
SHA512 54fcd774827ba9fe64beab0bdb062fb7e96008f98ce2fd41f92ad9338424866653bfea9918576b7842bded2a51ff1bb4cd8821d8b2332e35b64b1d624d508793
SSDEEP 12288:qoGcyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:zG5vM3yReRdqmCAzxj884
TLSH
T13105233EE2F13058D6709A3552614AD7F9B1743A5BA4FEDF4490A03D9F323E06935C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 04b8f064112f9803c4dc84592c92394fc5f24c1ea7115c931bce9300ab70b319
MD5 6c8888117f75f75e5fcd6aff2b7bb3db
SHA1 d3b653a8dd6f5c68a467ed6883a0c3e0e28a3258
SHA512 c6a38e096b19d96238b0048ecba283eadedc835b4297c13cbec7df3dca65797b91f179376fa71b1e3c873e17c6530f789a6188333f1521ae29e93da0f13fa535
SSDEEP 24576:AG88u8FpJqH1xzria7/mzoHjto1GFxlXutIs1WZX5AR:T7ZFPqV4a7/RT/M+w
TLSH
T1BA95F16676E101F1D47BD1388A874663F6B2B4250364EBEF07A88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 38ce4d7f49df995fcee3e631170f875ea37630be7941227e2b220aa4c90ea21f
MD5 b3a4a5e5d35a47f5e870e1d0e28f7ad7
SHA1 3cc334e9d8ddd7a285efdf76a09fa0a41293b0e7
SHA512 2a8a3f0a0d3b9d49ee85c23b445885a2c887b5fcf058196e15c0128f6b07c10cd53d1a021877eee1711810fed2502a3bc2c9481c41a4e77ab19ea8ca08ddc764
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoT/M+w:CG05lO43bbw
TLSH
T123D5CF6A62EC11F9D0BBD17CD9C74A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14dbaf6892cf5394bdeff5197954415b856573a50bf8b4f3461a10c34a9b23d0
MD5 76adde75b8d98462e362daad17b3ff0c
SHA1 0c7898f6a57a00e447b98f2c823c9c1bf45a0111
SHA512 dbc18c35132c80f9b6982e279acd0e5901a809f6a991ed0af16f3a2cecf7affb9f19d22b95aad1691b9d2cdc8d56579a821ca20a2d1470ec3ab422125a30655c
SSDEEP 24576:Hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVoHjto1GFxlXutIs1WZX5AR:/a5POZ3+Jt2pasx2+mAT/M+w
TLSH
T19F65AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e965fd8777a7ed1afa5e81e94a5e91e284c7ca386701b53e7e1bb252020e8d2a
MD5 1a876c50b2f446c0bcd2c2af858d25fa
SHA1 9aabe4fa5608cf8616360c961cd1fab624cc58f7
SHA512 bf57b31ce615d4e6fea6a87e8644bb5addf9153da1aedabef7e46b32d98ec837a2b108618b7807145cb1b04feb4e8b3a6b92b1e44b824a0247824508cfe05557
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkroHjto1GFxlXutIs1WZX5AR:6Nc/zEOVHFxT/M+w
TLSH
T181858C2622E901E4F5BBE1BE89779546FA717865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 f9f23730fe0b6fdd5e0ec73838a9ab66f6ba6b75bc507227d22e5caddf186f97
MD5 6c72beb6203cd8857c247a19928c3250
SHA1 b42e32e67fdc9ce7cd8d9163c2e3d6bebd5b3fa2
SHA512 582ed3249adf8341263b99ddf9a0ecb97ca16ecb2207296cc8d7a34058b4563db9d58a5944000d4b4e3ba7223e41b8e4e7959130eb0fbdcd074cacf9ff06054a
SSDEEP 24576:QD3FHshBIYQgAmoHjto1GFxlXutIs1WZX5AR9vM3yReRdqmCAzxj884:QDVHeBIAAnT/M+wuyMRYmJzxj8Z
TLSH
T127C5127EEAA800E5E57AD17C96938A07E77234AD072265CB02D0D1791F3BEE47D39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 d95531143607d6f692060b1ddc1cf1842e4e9062863e43faf8c3cfd31fe4d7b6
MD5 d6f124634e4492ffb44d7e3a557ba17e
SHA1 4e6eb878a450d86401bb8236d5ab84bc4be3b4e3
SHA512 4224c41eab66bb6e9c904853f066203e3bc05e1e61d5fb59b81f512df93f574bae416fa7cf9a504f064c00c72bfbc8a05918da082d79a8812fe0d23a5ddd9d30
SSDEEP 12288:Y1Hck4j5ZI7myLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:E4DI/vM3yReRdqmCAzxj884
TLSH
T17425126D63BA10B9E177D03E82830543D2B2B4758762AACF5694D07D5EB3FD8BC38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 0a439cbeae1d2426881ae9cad48905586c3ce63f8d4ab45fa2479f3765f162d7
MD5 a9ba358e2adb1003545af0964b067812
SHA1 68718b6faa908d212bebf14d7fefa232a6ccec6d
SHA512 439bf5af19b004688f17eda4c7267208c34cbdd556eafe954e14444cfb86965415f3bdd541d93404d52d3f2ba04fb2293ca9a3f7f1204e54f2b7859b6738a4f3
SSDEEP 12288:RG6kyfyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:YtyovM3yReRdqmCAzxj884
TLSH
T113152215A3D46098F6B51638976282D6DE35BC255FA1EBCF6190B23E2F337D0AC3170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 d2643126d11e9a0f26c6ff9f0baa835f407663154b13daedd1b62052a9626e73
MD5 62ce8939322d132f81c4b7aef9893092
SHA1 909b4a9643f731bfca24fceb8cf271d3a6bb7aae
SHA512 2888bcbb6dbbd21f9bd56d9c2b495bf8f35c4402cfc350c26766d0a46465b2692431ae008dc40e6ce696fe86389b356b6ae584f378722bd9207a937761329ca3
SSDEEP 12288:riwyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:WdvM3yReRdqmCAzxj884
TLSH
T13A05237AD2A02119EA706D3513454BD7DA66B43E6FE6FECFB090A03D9A333D11CB144A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 b031c9077e075c72b2ed2c5a0cfa61b584efeb46ffd36fb77ef780039a821f40
MD5 1e05ae18bfa15d00c7be7400ad3d1998
SHA1 813b02ae8d497e739613ec733c246cd0a3d23b16
SHA512 3befad3cb0b8ce27934a29f488c6fd1a395896cfa26111c9f83a5151306dac5187e63f088ea1a7cfbd705509fd533c017607a05b74b110ba9cde82929d55d413
SSDEEP 24576:DDkNvNnaFeYhJNtmZBmxoHjto1GFxlXutIs1WZX5ARyvM3yReRdqmCAzxj884:DDMwBtOmqT/M+wzyMRYmJzxj8Z
TLSH
T11BA5D16EBAF445E4E1FAC6749E238512EA727461073293CB9390C13F0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 fb05668faa377adaabee397e1135f3186194b91d4b9fdfc604e93a015934d09e
MD5 a26c35db3b339f50ef15d666e2f582c0
SHA1 e596748ae4eb1587b118632f7410a810b6a37e55
SHA512 9433bc3db1523f1f33d9155cbabd16bf1f619ca606b3c285b96f4739e8b3a36a95f3311c723a624fdafe603eaddf6675c48390303aa48c7c76e8831698b8431f
SSDEEP 12288:fHvUrBFrEjwaQRhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:fPUr+NQ3oHjto1GFxlXutIs1WZX5AR
TLSH
T1AF85E12F66E918E5E676A17C89838719F772B462071292DF02D0813E4F379E8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 dd458ee011c49da1af57e99bc237ad9eda3091fd34678b29bf51121e2a32d0a3
MD5 abf0a9e8be0c5749ad69af939e28683d
SHA1 7fb7aeab3833cc6994a7bfeead4f8bbd17aa5675
SHA512 085fbece1154d1907a1f61afc1b0ddfe240c08db2cda8fad178ebb2219ffffc41a6a49c87fcea03b76e3fef1c84a0f345637d969f846ba53314856e8c8d4b46e
SSDEEP 24576:bD3FHshBIYQgAmoHjto1GFxlXutIs1WZX5AR9vM3yReRdqmCAzxj884:bDVHeBIAAnT/M+wuyMRYmJzxj8Z
TLSH
T1FCC5127EEAA800E5E57AD17C96538A07E77234AD072265CB02D0D17A1F3BEE47D39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 50137088e5fa05791b1ba6ca089fcf3b5f7a469c4fd160d229638817ecc3c256
MD5 91d0a9bf161259f0d222affb6acfd9e5
SHA1 2a782c529f5589f21372d9ebbd189f78a549bafd
SHA512 83ec659c7cba62bebf9177ac052f88121ae6f9d7b074afa1f3ad2907f43e26bce05515409ea2655338eecf10b5ec9984e1c07a7100ad70d8f9aa7a5a8432b657
SSDEEP 12288:MiHPJnJP6szeCs6Rl28d+yLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj2:FJnJPbzB4SDvM3yReRdqmCAzxj884
TLSH
T16F35E03DD2A810E8E4B7C274815A1B9AFE31386D2F2669C755B4D0353F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 97bc0cc2b3e3f4b802644690deaafc4d005c5038ac1f5968774318462b7bec32
MD5 1f8b74172fc58b4a78e45b818ac7b8ee
SHA1 880e096ff1f0f62e8e9cd54c0da780b0645e524f
SHA512 98bdf66bdf945924963b1d441b33c86d94c120e7d1b903c01c5b51d9095ca64c83d4115195e1083142ad0e4b941eee15190c9fc986ca0cc6c8e06a834159f06f
SSDEEP 12288:vdyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:v+vM3yReRdqmCAzxj884
TLSH
T15D053376D6905119F7B02D3623854ADBDA56B42F6BE6FFCBB014301DA4333E26CB108A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 968bed72f0f4994ea010bb0c2272fe0682a120f6d9ac75a8b8e4b9423dce0b8c
MD5 2206e4957cec83f30abf6808faccda3e
SHA1 70ab1af513f3e3913c884d5a698162a0a8b406cc
SHA512 c00a703474747726070be6a0c92116e7c5f957eed4b1c3b436a7fe5c9a604228a7ad455f01201b13d8d3c1efc0a4a3b3439e78809bf2a380cc86f6a511a114ca
SSDEEP 12288:Oyj6b3IkxjbBzyyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:R6UqjpnvM3yReRdqmCAzxj884
TLSH
T1C525226E93D020A8F1755530966182A7C5B1BC3717F6EADF71D8A13E8F33BD0983AA05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-89-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/352-115-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/352-84-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/700-116-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/700-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/700-384-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/700-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/700-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/700-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1344-401-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1344-409-0x0000000001600000-0x0000000001683000-memory.dmp

Download

memory/1344-407-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1344-383-0x0000000140000000-0x00000001405BB000-memory.dmp

Download

memory/1344-415-0x0000000001600000-0x0000000001683000-memory.dmp

Download

memory/1344-418-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/1344-424-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/1344-426-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/1344-428-0x0000000001600000-0x0000000001683000-memory.dmp

Download

memory/1344-430-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1344-432-0x0000000140000000-0x00000001405BB000-memory.dmp

Download

memory/1576-128-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1576-130-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/1576-381-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/1576-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1888-238-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1888-230-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1888-110-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1888-119-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2324-247-0x0000000140000000-0x00000001405BB000-memory.dmp

Download

memory/2324-224-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2324-6-0x0000000140000000-0x00000001405BB000-memory.dmp

Download

memory/2324-166-0x00000000037D0000-0x0000000003830000-memory.dmp

Download

memory/2324-160-0x00000000037D0000-0x0000000003830000-memory.dmp

Download

memory/2324-225-0x00000000037D0000-0x0000000003830000-memory.dmp

Download

memory/2324-8-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2324-7-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2324-114-0x0000000140000000-0x00000001405BB000-memory.dmp

Download

memory/2324-220-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2324-17-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2324-11-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2324-0-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3444-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3444-47-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3444-55-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3444-54-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3444-62-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3444-59-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3540-29-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3540-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3540-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3540-174-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3540-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3572-120-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3572-74-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3572-80-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5176-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5176-151-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5176-139-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5176-145-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5176-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5416-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5416-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5416-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5416-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5416-203-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5720-118-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5720-69-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5720-63-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5756-175-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5756-417-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5756-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5756-182-0x00000000006A0000-0x0000000000700000-memory.dmp

Download