841f52b17743eb43b486a5de5867c3fa735d06c5e1c49fa7af1796bd0462cfb1

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 3.0MB
Sample261102-1l5tfagd49
SHA256 841f52b17743eb43b486a5de5867c3fa735d06c5e1c49fa7af1796bd0462cfb1
MD5 d37e7e92905eb1f5ee51d1a33cb60d51
SHA1 12292482dd6fece6ea833302a70ad6e7bbdd37e3
SHA512 487ee7d44bba144f002a1874c9f4453c616328b1978b14c76db6a2139af5b9dab9fdeac06fa3b8d1dbce8c7d8e6230c51ab57302b8c85541c68123613cc82fed
SSDEEP 49152:mP1W5HtH6tgDg6Sge+Scpm4OZNjIzFTvgXpn2BjLNiXicJFFRGNzj3:HLTe4OuF7g4Bj7wRGpj3
TLSH
T199E58D8BA6ED50D0D966D07DC94B851BE3B2F821037187CF41684B5E9F736E20E3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5756	elevation_service.exe
2912	elevation_service.exe
3412	maintenanceservice.exe
6120	OSE.EXE
4684	PerceptionSimulationService.exe
5004	perfhost.exe
1300	ReFsDedupSvc.exe
1164	SensorDataService.exe
1284	ssh-agent.exe
1144	AgentService.exe
5668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1b848fc3f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008689acc1136bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080388d7c136bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002a7207d136bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a4f5f7d136bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014c6cd7d136bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8c5c0c0136bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	1144	AgentService.exe
Token: 33	5668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5668	SearchIndexer.exe
Token: SeBackupPrivilege	1300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1300	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4264	2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 2372	5668	SearchIndexer.exe	100
PID 5668 wrote to memory of 2800	5668	SearchIndexer.exe	101
PID 5668 wrote to memory of 3172	5668	SearchIndexer.exe	102
PID 5668 wrote to memory of 4548	5668	SearchIndexer.exe	103
PID 5668 wrote to memory of 1368	5668	SearchIndexer.exe	105
PID 5668 wrote to memory of 3864	5668	SearchIndexer.exe	106
PID 5668 wrote to memory of 2728	5668	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_d37e7e92905eb1f5ee51d1a33cb60d51_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3412

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1164

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 367d004f196b7edf434846ad4f4e1c21d91cd90ed1e8d6bcbb204a15ae1d3980
MD5 e89ebdb3e85f6e780bf04b97383588e2
SHA1 2e2ca6b53afefc30353eb15368af4bd628181290
SHA512 f06acc2aa533359c985446929aadc8ce00365332bb5d4ada5fe670d24dea699c5495ac77ad0255140e56ff679714a956555d6c88abedcfa674533a4da90b8ac7
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrLNiXicJFFRGNzj3:X3q6mjB87wRGpj3
TLSH
T16AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2f947624b0e8de3a37dd70890a553a0610f5e6c99b70a747f509d4e0465c30b5
MD5 6cd87c3d25c974701d07197b7aa38b64
SHA1 489601120e58083625de6bb5d2e54480f628d215
SHA512 eaad2a4935c53cc7adf4182ebde7e212faff9b6f69bb7ba2c68579895870a8c15dd5878e4a67db162f67e6392b8bdb0393ea4a4a51e888dae4bb8c375baa8810
SSDEEP 24576:4XYfDtczA4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vtc1LNiXicJFFRGNzj3
TLSH
T14A75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 94b4319cca7db180d8b7316d04b797c6f9faecb96a42d9395a3fb3687166085e
MD5 2dee49c96976d39c9554ad33f3c38fc9
SHA1 6853e1364f47fefb6ed848486848944c0da0cbf6
SHA512 187ea8dfedbb15b58b22fe7327f1db38d75a6bcb56657aee4724bc9c994d8972fcb724668f5950bcbd89d185d0f5756a1e0c930fbaf6ced97511f73d3b43f5de
SSDEEP 24576:p0Le5ji0hmxhrMD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPji0Az2LNiXicJFFRGNzj3
TLSH
T12785AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e835ee718d875959208231818e0871757be5795f4d83415689bccb74cbac9ea8
MD5 3db71386434b629433a1908eb48e8f12
SHA1 7bc3b9d542698293a6b102d2fefd375d047bb5a6
SHA512 1203f63c597fe336e812bff94743f63ce4b12a9c0714ae5bc06aef3927f25a35a039ab926617b09f84eca2c4c311b363cb32b7eeb057546de73a64ecd2cd82c8
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWj6q8wyuF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d/ezSC6vUzPv+HjyCLNiXicJFFRGNzj3
TLSH
T117756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6a6aa8abdf39c4f2391260cc3435b031b10eadb6220f2fa2b371b25130c80441
MD5 c5ac30d639ab6b17cf0650fa1ad6680d
SHA1 646548a8fa8bd3586d42d127214909e48898ff72
SHA512 8b9ec8f78f66a160c9347149a1971a6be055714b5300f51792906f6567f842c4887460c07a31844a679d0118c5515cdc69b7abd0a3bd3e876d90747dc6a1a21a
SSDEEP 24576:vVbqPb88hv/l+BM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vVO88hXl+WLNiXicJFFRGNzj3
TLSH
T16A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 222de605b0011324817dd0042b0eb6a88415e26cfd31a9cffc3a9d766ee46408
MD5 d70d203879284d15ea54fc4084687fd6
SHA1 1ac09dc6ad25b3d4e23d76690d596a679738b4ce
SHA512 5bd41bd9d93dbb69d7a2652a7aab65f266fdaba486b4c1007769b64c34c2e82450e78f895eecc304f7bc18dda960bfea28a84e1404e3a635800991c97585025d
SSDEEP 24576:sGn/TwSfVcYG3K/cJHlnFR+IGNe8j3IzR:3LNiXicJFFRGNzj3
TLSH
T1E85523D3468854B1FBFD003A867A5828B5846E2C8A595DE3D2503E5E913CFEBCF39127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 185c8a9cd9e485166146c8f25ddecfd81be542d2dddf2dda0d25296dd5a29e45
MD5 6674ecb688f4ae2166ca6ae7caf22a9d
SHA1 ffa90ab7e0d1f5e43200f4b0804b46e3aed2a62d
SHA512 455689897e9ae630542cdeed2944003ae2be4578c101a7cf51fa0131e4b947dd6cee5b4d6562b03a6325fd932833f0e8d23e86c908834f8092f0ab747947a8db
SSDEEP 24576:5JIUk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JIUkLNiXicJFFRGNzj3
TLSH
T15575CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7e278ed3631534e8b03a0067f45805482ddaaf069c176d77364024e36200bf53
MD5 67d34c4356a99980b3857c93d270c1d7
SHA1 cd84df45a2a8cf338c574255ccc53dbd141a86fb
SHA512 f7f876e2103290fcb77421896cec97da5a3fe2623eeeca54d54d18a6a553de2f831f53144e0862abb33f72ae956c121fb168cdb45ffc0428166dafe26c9e8c4d
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:3QvGAdlCEL8c/WRNw5CV7wRGpj3
TLSH
T178266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a169049ca148f396f1656637dafadb153bb813eb18456d76af53ed78ce9b6154
MD5 93c067f9b50a5c4d2c79c6682f1aeeeb
SHA1 f6e4eed3e03808d839459c43ef8e0f8285007e05
SHA512 7a8f8ffa8790435af69f340d323efc92644150cfd95c90b215edc749de6b8b555e38360c61290695a3c86a09db200f64157d4902bf10aad73f32c85502cef5b4
SSDEEP 24576:bfewsAjG/TwSfVcYG3K/cJHlnFR+IGNe8j3IzD:bljGLNiXicJFFRGNzj3
TLSH
T13475E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 54f7c1ba6fc91f62aa6aa6a3a6e3f36eab0b1b02d44efac54be4ce231c2913c7
MD5 79a733c90d97016e39ca6b0f858bd54d
SHA1 60b0b7ac7b8b38b546e4ab5bde0fc4b54f57da47
SHA512 64e1ed4c8fced7362bd11d16e9676893fce879ed547f85335b4df5a84d13939f18d4ebb178a4d729613eb8c6fd4666009269dedade02b0c7b3dc0df3757a6f19
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHiF9:MUEtQevvqc2W1cpV20I3229
TLSH
T157474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 55395881dd4c5934c96a53fcbc011cbf047ff73c9067b234b6075f2cc575b2ae
MD5 cb745d75b17b7bb9f06049163e3ce24e
SHA1 1aff189d680ff53afb7dc7210e600c082dc02087
SHA512 8d3f1cdeb9af54a213c389078ecefac898567b8f74a91bf0e7a1d21d08d1dffa89c0c789d316b54bb24e4173043d030a97816401126cda7795f1b4db2f57516d
SSDEEP 49152:FCbRquA/m2yL5zLfFiV+XenmE3/zmLNiXicJFFRGNzj3:Soq2VjnmR7wRGpj3
TLSH
T126D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 005e22f9cea59a9bb6d83f679bcf276619a413a428cd559640aadd8e65454f3d
MD5 2b50dd014f718aa517b2bae24aed047c
SHA1 6b6e56e892c70f8dad54f18084fd58b285dcb05d
SHA512 a1a8bfbd8d35ea219d0daa792838626dfbaf4a625b64a4133dd2ca5c85015a23d7f16f39f48064c98d8de9429cd445f19cc71cbcf63335be701dd9ed725a277a
SSDEEP 24576:JAhGL6IFoiwtA5l7S53x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JAM5Foiq5hLNiXicJFFRGNzj3
TLSH
T12E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C24F2150911F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 518b8a568af6255ca5442b815e3a90e5e79023a6d4941a50c3c878cab8c27d6d
MD5 207e303f7e5894f77736be9ab0f9c3e1
SHA1 313f452e34938e32d72268b5bbc277a77b8e8a46
SHA512 0d81a5ef404d2ab564d3128fa62d32ca96e3b69e424d9093bd728c3b85e2511b91ce659a57e5097f19a64f6381f22131f3fbeb5fef29cc6b0c9296fce069c984
SSDEEP 24576:UwuROWi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UwSO9LNiXicJFFRGNzj3
TLSH
T1F065F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 95581e15be125005cc3f71c8f10e78e499ada9e74d9e993f2c026fd15fa73800
MD5 5be6d275e3aaae04dedcd26b0f206f2f
SHA1 52a96eefb497c045a585ac23d9a1eb746a8fa70c
SHA512 575ac90c6c94709601439ffa037712a56dab357d69bbcd8c4355706d6c4ec3eb63a752ed77787851c7b0f11599f44cce267d5a0ca9831c04b516afb9c84f53a1
SSDEEP 24576:yZu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bLNiXicJFFRGNzj3
TLSH
T17755129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b92b2c7ad0cf9a49c168bc50e80e58701db644d46eac8e318142fae8963265e4
MD5 a274c06ce682532ed27bbdb4e061ed6b
SHA1 7c1601a1843af62dedb3683f4994c96558052fca
SHA512 eaf81d800229eac81679eac3f73ff0540893d69eae6897ac3df9cb0616a2d2fd4ed5595a41712b379c773629635864355d12c6a9951e274e33032108d3d69d05
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:IQyiKanX+PNcF9
TLSH
T18B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 895a029252d244a28048ac9204b0e76cabd75635c5f80c6fc475ef2147494238
MD5 bca1a5e9a578766ed9b48bac520b0b21
SHA1 e92a4dcbe173835a5f2be02e6a1a4f24e9740ed0
SHA512 4afc058c4ed71442fd182964861a2a20e81a0f57c8ab3fd82222f19bfee04a755cfe175aa200ce3d59fc9c1c35cfb93b6d35762996c64dbce157d3c4826c2da2
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:kQyiKanX+PNcF9
TLSH
T1B4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3c10861110feba424ac66482acfe8b4481169d9d57c5edbd801d5f7fd524e394
MD5 a109a141ad95f9450b018d0a85d8c314
SHA1 c27749cb21b8ea29e8e6c8c8d29483fc8989da92
SHA512 92e71720c2e9eb33587ce8d835db7ccbb686a5fbdd833aecc45474442bfcd0e05c058ed7c1544033b56a39ff027c94b532770330d199fd43cb89dc8181845129
SSDEEP 49152:B68Qg55nhkeWu7PNU3/2LNiXicJFFRGNzj3:/thTRc/27wRGpj3
TLSH
T176B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d5fa34118c4714c0ccd52426e769cf0dfdfde4f96d2ffa07d83329485b7c8110
MD5 e467ab9b175a6dc35c6433a67ffd7d5b
SHA1 96dd0413c817ff3ad269de007e5c265ef353b2b1
SHA512 381e299ee54314877a84144bc269eb170457a3978c298128e9d89c03565fa32d1ca26cf2abbf1c144d16e326137b7123855312c09c285e2543ef2bfb241cdd85
SSDEEP 98304:py5112gYy5azzVvU69nLKnhZn7wRGpj3:ELIHRWhtF9
TLSH
T1D7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e81f3534a3c742677b6ae4bffe5ef748097b45fdea4ac3cd62816ad8e490a21
MD5 6d2f0fd9082428cf6cf8b559a93748bc
SHA1 c753cb1d298e389347d7a9a0c1df7f0d9fb04121
SHA512 855cac72267c8bf451fcb3aee18539e679bb1f58f95360982604a0b426d7304b208676dd1815b79bdcf04890d1a7d483d1fc35296eed6517a1a9012a82616b2f
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gloLNiXicJFFRGNzj3:lu6JmIxd2do7wRGpj3
TLSH
T1A1D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 89a3a0b9b4e4fd30e4b5f5f3bacd2d769c4dc8e56f734fa54d48f95ae8f90e74
MD5 0efb135fbbbc1749b2d61ca11c42c31d
SHA1 b47dcabfbc6b6c200ba90210a6408f1d617b4c58
SHA512 2abf11372e7c3c2de95b5c17886638ccb9c589c37ee4163b3e06685647bd91fe8f13ec82410c37dac697392ecc718cb70d515afcc60868fd9fd8344792b6e971
SSDEEP 49152:z1hpsNoJpF1A67U44CwH7R4xELNiXicJFFRGNzj3:zmifPqRR7wRGpj3
TLSH
T1B5B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ec6a972dad93708e08f9bcd7e9f0ef6759ccf780ab497a5162df1b39a5c8639f
MD5 ce0345a6ab8d6d49db1868512a983c58
SHA1 4bc655f5452175b3de932e7c26733959fca83b7b
SHA512 8d705c2cb0507b5e99c47295730891a74512afb7bfcdfe8ae5d076078acdcd068e8e63113f4cedd90d7a6d6c3cbd933e781d4aee1cf525146ef2ec2ac5c479b4
SSDEEP 49152:TSuZQIY0Be2KkRVtOnks6NMHq7LNiXicJFFRGNzj3:R5dKqi6177wRGpj3
TLSH
T135C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 633f882de43c87cf5e0442a0c6d6a2c20201d7d6ac6c26fa0debc870ad7dc5e1
MD5 5c582125917788e06b79f118005486cf
SHA1 8338b9f76ea87546dc40656cb5858f6f53bcc313
SHA512 39eba2b5dfd175d2f70da02e77a43e234b69280976c422a950d0b8c69ebb5a5da4da81c4677e10776d5e468dc96e07a106e06ffcf5888a78973fb977acbee6dd
SSDEEP 49152:phtSn8EApI0figjgiDn0AP5w4LNiXicJFFRGNzj3:YX2iWphd7wRGpj3
TLSH
T13795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f0953a518d5e58934dc9729b3634769f79394fbc25f182ed183c12e6a4f3883c
MD5 c74b91140ffa664c1f42bda3f6771868
SHA1 a99f42a77e24d13a4341d9040f2d96ef8302d60f
SHA512 94bfee7bb91772db0f1c04d9570bac9583710365927b55b43eae8e591450c8f23b544df80797e2a82c83f1eaea290c979582d28cc77f7d33fbb862255b86838b
SSDEEP 12288:vLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3558955B1FAFC003AC6754428F5882E2DDB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6cb670fb9b1cb47ee968992f51612ae4345951ea647944538b4dc1211d5b63d0
MD5 35fc6023632c4a131d77967ee1fccb93
SHA1 1c25dce21a766ad6960bbd40e4a98a420120b0dd
SHA512 887dcc68e17fe9a1da80f04ab1367a409c9654fc742063009f9f5d9054c7cd73e04a016e1b5747ecb822802c5063b645df3460fa0294c101e71da6d08586a640
SSDEEP 12288:54iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3558955B1EABC003AC6754428F5882E2DDB5619E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 064f1facdc5bb0b914c0c468de151b71d13209bd182c3316689059c20c8dde03
MD5 2468382a1b45e289d99bbc735f9cdbab
SHA1 cd4a63c60261dbf8facba79e9ffc00d5c76f3e6b
SHA512 39b04d9d0df9447e35ee56403f4d8b5cd41d61c2fe15477173b2970bcd6b917986e61382135bd62483cbc811e207c62aa580af2e5d203d94ada29dd52aea84a6
SSDEEP 12288:7aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:78/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A5523D2558955B1EAFC003AC6764428F5881E2DEB5618E3E3483D1EA238FDBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 08e6c0f8e669d5d7cba9b0166a150aa5cbfaed9be1bfd43a91e8a08a4b6297a1
MD5 6b683810d44273562294377e9f0b961f
SHA1 63e74dc3af471d1a742f3d91f2772c5bc36e7d0e
SHA512 3450c639cb5099ed3f507178c5c01b8a4ec363604e105e9d33a479a50beda75f4ef4e84941e112c7524bedd2b2b37e729f86efc496eb9a284769fb7e18107abd
SSDEEP 12288:nVNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E552392168901F1EAFD8039CA764424F2947D6CD7325AEBD3003D1E5A35BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f1ffc9d2c10ffe5b3fa77033cc7cf7df2b97aa76d1b787a7143b6d2e6327d209
MD5 e1e1964e2fb18e179c3d5f871ffab073
SHA1 97b2b1e502fc1dfddaa547dedc459dd5689847a9
SHA512 53bac0b0c2f9e1a7069c88979216a35d41f141f521cc82dfcfb2e9aeb8993d0ec625f2d049afd6b923a005e8942a63f931aaee03b0e2078e7f18536fc599993b
SSDEEP 12288:rViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3558955B1EAFC003AC6754428F5881E2DEB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 21d60a5d2b5ec12d5e9824006687406851b67e66cc71cb1abf7dc2dd7816364b
MD5 e3696ce6f7e94a03c3fe802420aee505
SHA1 35a3f75fc12490d61999a3f28a510372342241de
SHA512 d3e0312f85a8d007a996462597f3f0c87ab0d5dac79edd9560531ba316ba61a03c6220d941e88c50cef4899037a000f13d5ce6bae5900516713e105eb1c31543
SSDEEP 12288:U0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3558955B1EABC003AC6754428F5882E2DEB5619E3E3443D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2bf5aa500534f1187750f417c0a0a9612b3d5dfe7b67a66a8620df06fd7a46f2
MD5 fb6a39523de61890a5bcbcdfbd74d469
SHA1 467a743ce653226e182fbe196b6a9f7f3f95ffbf
SHA512 407502e8c9a33e56410c1427248c7f96e95c1c178f820ff2a297a522279e3fee96f9abd3cd328c18a0db60bbd7c8042a042c8f356a430a7900ed198fe022dee2
SSDEEP 12288:vAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3558955B1EBBC003AC6354428F5882E2DDB5619E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 22b85d7e217e71dd48cb5400e426ea9e108e81b4d0ccbdb10d21705fb490437d
MD5 045a0cb4bc4d13237d073f011cd3287f
SHA1 31353a388d2cab961b6798fd98ffce5a61716e1e
SHA512 98ac7e13045fff2a6010dc02f36adb2724cb7e546fe5db8074fc9be3c0e90a68d4116576a3e303b32c02db780f7875ac2e20c185878d32bcfebbefb0fbd86568
SSDEEP 24576:FZM3zFVSOq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FZM3zfuLNiXicJFFRGNzj3
TLSH
T1BC750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 abf1160a44f75c76085d68c0dc2522716df9a0e00af3f46f0a88d7e4d85a57da
MD5 630f3f8fce2e86757731726e88c9436b
SHA1 8b1f8646636521188129ddf5a47f69fa5c273738
SHA512 cd09ad4ce3e455f4efbd4add691e95169c3897b6074fe22c9afeddc40d8749b6bc0eccfc4181292fa9f01bf8e0d272c15a4bfed3e04b60d813c921353679e3a3
SSDEEP 12288:F/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17E5523D3558955B1EAFC003AC6754428F5882E2DEB5619E3E3483D1EA238FDB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9824e6fcb89380a4a9b9e6ce69a162f03b20e788219f83ab50fd8cf4102fb4b3
MD5 66e735985174e45d1b73a6858debbfd3
SHA1 266fcaca7007a10a6f407b4bff1f4ab0020750e2
SHA512 67213cbf9ca59cdb494d951fefcd603615e8a3b11a1c2ce0698c6334faa39fd877bda0600a245c788d070f49048c89b24f78a2a9d825c52052857e170aeb6b74
SSDEEP 12288:IDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3558955B1EABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b8749a12fafab022dbf29aa7e83b34cede8e798c6f263e8184df95d1e6ebe207
MD5 3f4a25457425e27464b991998485135b
SHA1 823fa8cf01805649f2ab5519ff849a7b130dc6ce
SHA512 5662b8e8e069985ec99fbc89d92f7dd20cba0c02480bf6d87f86299ecad6370c172c46d81b483b218af187ca273bec3c522011f39c231aa936bcfc52cc24efa2
SSDEEP 24576:WzyW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WdLNiXicJFFRGNzj3
TLSH
T17C650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 da8b5ea61a7823d8f8db31f6bc9b77163c0d8763d3c71c573a3e73f84dc7806a
MD5 ba2c782e70396b5977cffb9655d21796
SHA1 98480c5eebed7ef2086a5aa320f87aea5c99bbef
SHA512 da4ee107f148dd1157c382294bdfbbc53fab21d8be767b74224da279f4d0b45b8dc5e69e3fbe97b58bfc74e0d7d9d8222834733f868b9ff488cddca0e0c7f901
SSDEEP 12288:x/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D3558955B1EAFC003AC6754428F5882E2DEB5619E3E3483D1EE238FDB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0203d2659a43911d4f94058608d1c4736f3afbc2a479ce000fe4b412f355ecac
MD5 7e893bf6a0765b167abaf2807629425f
SHA1 980d2b26e3ded74c5178db68adfaad787e2f2bc5
SHA512 d11ed5407f9a9b9f8f331b0b85076ff20affb4bd7c9f4ef8054fe2aeda1f13c25e12f2b342ee22634aa5f348f8e4acf19838e35567eac24884b88a55da3b3650
SSDEEP 12288:8/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3558955B1EBFC003AC6754428F5882E2DEB5619E3E3483D1EA238FDB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a0c3ec112df5f16ac1c3796ac3df1efa5f79bf6e9d1f016d9deb91607f54d19a
MD5 ac2cd68b4caed95faa41c9a875be57d6
SHA1 ac9783525021cca8719feb8153fa02c87224f08e
SHA512 75fb13b7480cd9141e0a690d608da070cb781b1b3e1000f6c51297e1575e9ba01d2234bc21219329bbe86bf2c43568ca49406f320a3970e41bcfb7a156a4ccc9
SSDEEP 24576:EzyW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EdLNiXicJFFRGNzj3
TLSH
T12E650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cae6658212e2ec7f043fba709866b78e2905a8838f2d5d57925bafb4ed4a02c6
MD5 afad2a1bf0bb96f2546791c7a263acf5
SHA1 10b1e50cc8e95b43976749be10bbaa6748bcdc9f
SHA512 2db997b1a027bdf54f9a531587e7f841799076985742c11b44cb0b2695f7e24655c440d003873067a85d47beef3828b6ae6eacd0ae66aa68d27bca6d7f7886fa
SSDEEP 24576:qT8aLl3z0zDs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qT7LljFLNiXicJFFRGNzj3
TLSH
T10B7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 68a06f3a72cd68fd8dd9f2d2d9a4f7091bdfe3fdd0d6c94f0cbadad9e3a8da30
MD5 df21f3ef27676ec20bfdb2c78d9e017a
SHA1 6a60822b716264adab03d32fd70b57751c615562
SHA512 9964298b07518f233bf45f660ef59784e0feb1f1f0c236810117e2179c52a56dff0f42da9e22942dcbd204cb2646bfc9767f03a304dbb984491260f5c4b9a4fa
SSDEEP 24576:P3rd9CHKy7GZw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:frd9CHKyauLNiXicJFFRGNzj3
TLSH
T1B085CE90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9ee717e2185746eeda1e5b13596e6c32ce216f2bb428786450ff870dc6e21722
MD5 66cf921106db48b45cca3f4f760c1208
SHA1 f5248f5454e06f98ccabf43e43a519f4ca798d4a
SHA512 faa3ca06fec120a2e1892943d0ac344d8c387338df63e78e5bd3b2effbbdb957e1332b310176691d3937d26316a48aad5c80aac9371be7fc4ff293d1fa33fc9b
SSDEEP 12288:R6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D05523D3558955B1EAFC003AC6364428F5881E2DDB5618E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 61b982a007221a39c9a0f44cd2fa9781729b52effa990bfeeac234e6f68e88f1
MD5 8a8c0fc85e5847e24157f8343ec53633
SHA1 0761046961c843a7cab27090ef3f21e8ce2500ea
SHA512 8c00f3898ed9b40153d225c59b6fb1efa96c258c68fe0962581579e043b383fdaaeaea9594ce1612c5e35690f550ae4bb6251aad274db437e177450532d5f0c4
SSDEEP 12288:wMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523D2558955B1FABC003A86794428F5882E2DDB5619E3E3443D1EA27CFDBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 173c5a25b649990624ac4dd69443ad693322983425a972eed4785512dfc3b7a8
MD5 6567a217548cb0ad2746f5586e959415
SHA1 0213750c0e9367c0fe63ca47cf43acfa04758b61
SHA512 8b2f518026fe552c38d23bbe33412c4ed90bdb46932eab3c3b1f4f50f92bbdade36ec80956406836c0ce15accf74c124cc1e52a60574e0a2ed68cb217c85f1b2
SSDEEP 12288:pBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1925523D3558955B1EAFC003EC6754428F5882E1DEB5619E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d4c6de1f7df5fa813131f78954793e284452c2db20494e9494ca4d7f8b234237
MD5 57098ecd7bd098fcb4dedeb53b202da1
SHA1 8d364d9d08320df431bd483dcb0af8cb304bcaac
SHA512 8059131e8ff9c0207fd12cf7e247e80ceed552cc39bf0661725edd5efde233d659e25cf08b8748995cde6c8f78224a1e63d6646f103a76b520824d29d9d05b43
SSDEEP 12288:u/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3558955B1EBFC003AC6754428F5882E2DEB5619E3E3483D1EA238FDB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 800b703c6fa982e66cde0deb49681878190a2e662ee83e9f7eb2d31feaa5ff73
MD5 1e6a9823cbefcbee68c0464729df4de0
SHA1 67b4da02036fe4bff7d4561143280d81b3762f3a
SHA512 f5558b611ad916d11c914ddf193081c54811a3a054aba1e04848d269b4a8ea65a3e1bc127d3b61f2ce5f3b2482f5813a0a9964d024e8c002e744ed06e17a0493
SSDEEP 12288:l6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD5523D3558955B1EAFC003AC6754428F5881E2DEB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 eae98cc6faebef14d4444ee5effa774a7ff1181ccb16f4d7e04be83605611beb
MD5 54e21e38f959798df7713065034cdc50
SHA1 8aa4b7f23d48687b0dd07960b45e1273478359e2
SHA512 c09ae909ecca810b892800f066dcc31c08212c082be5b7a0a11b34eb808e9ef9bb94f7405ae2daf594456f61803e2dc2b9fcc3268c1791069bb3ff4eca3df581
SSDEEP 12288:DHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3558955B1EABC003AC6754428F5882E2DEB5619E3E3443D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0d765b8e55210b57b9f93a449a2635627ed174f1e1aca5ac44a96462f29a963b
MD5 1e64dc57467247e6f2eb21ebe15b32a1
SHA1 25f8aae58dde3e521916006c5c836a125d5f61d8
SHA512 f09a6add3ee7523815e73799897a5e98fb596f1d7146f8618c31885ef048f38e73a2a2ad52a025907c531f4a5f2ca6973d5884abd8839602513517e7c77f9b99
SSDEEP 12288:jViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A5523D3558955B1EAFC003AC6764428F5881E2DDB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f9244a7f9adc82e58b534729199d3d572488271956554e28bf5c992c092e6361
MD5 28a6a3a5a2d738aae9a4906d7e6a370c
SHA1 c8914958ff3e6612cf49ad0d9f0f59536299e2b7
SHA512 5ae2f9c4830fd6bcd49ca409243ac20fd316889e703b58de01e6df1cf44804bbb1131a4e14520fdc00e40f2e6983bf8948232c0e1ec408d3bf78db39ad614f53
SSDEEP 24576:Kfwvzk9RX6wkyAIH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xMnYIHLNiXicJFFRGNzj3
TLSH
T19D85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e17081333a41596c466ecd5dbe517a5cfa4fe373158adb123675e49a58362e62
MD5 75858083c423ceaf2e6d4b87a1e87d8d
SHA1 df96ebfeeadccca216d573d5e735c5eaee33777d
SHA512 2895a5535161bbe6dd5d7fae0abc5ad61d5b7adf51bec5c558b27f5fe7179b4ca2c3a9d7bda5c476360e43822cb2285ad4accd298a53b819cd1f75f8fac4eba3
SSDEEP 49152:sYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YLNiXicJFFRGN:jySzPw7wRGpj3
TLSH
T169066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cb87c175874e935340558bb9ae40c8102c8b5461f0714fb932fc23dccd0f485a
MD5 3e7fca7d780fc33354b1ba5282ab076b
SHA1 691278273569e4716ff15764243074d74f4f466b
SHA512 ebe14d81e395c4b776808ce085c1a2555481645c3c37bc124f4205aedf26b2ea5d7a63d71b5581d1d0f9e2c90fed26e0412b17a2c72102ffbce81ed15fef1ce8
SSDEEP 24576:K47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K47JUQjqirIhCnDHUPfF/oLNiXicJFFS
TLSH
T14165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c1b17fafe46614e7c25396186fda612289c9a17d543373b24fe4940b7d305383
MD5 10eb26bd040f0113552bec277aa9bc71
SHA1 22eec35a0cd02e2017797daa3eff27b91cfbc809
SHA512 3bdc95367e9a54e3ccf1d9af15b339e2aa8673b2e30ee9dfccec966fd079134696064ff5bd839158810bc89fc00582f1c17e25191f288412bf061b2e62d0a6d0
SSDEEP 12288:DpsfPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:k7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B65F15AD28802E8D1AE5139C7664900F3633C2987E193CB53D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0f452657b7f7e52a873313f2362921ca426594f567039bc02b1b823483ef0ea0
MD5 688fae8d71ae6f089c1f5c8b7bf2c701
SHA1 983b48b856faed5eb4b2dc491a8d3e3d05505e41
SHA512 be902af51b000ab809dffad6f341b8d615d38e33162394194737e8e8a26c7e0a8ada0b68ed386b363fe20f58c7f42d47b746383a5a28946547bddec534962a7f
SSDEEP 12288:Q2ujtvxU3f0y/XgCMyeEeysoQU9aCoECJp8jNF:Q2wtpUPOyeEvQU9aH3Jp8j
TLSH
T1B63517017626DB4BC66940321E37C6CCAB70BD06FE499B1772CA473FC576658BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 cda07ff9158f90cb5c16b515b4d744d7ca8f8b78468967dbaea5f6f4d120224d
MD5 e8e0b74dfec6376d037078cfe84c2cf1
SHA1 13af75db8dd7b8e6c0238beae01c99961cbb8b8f
SHA512 051f9f92a5046063868ec3a64b53751a9e0e5218e804bc4ec01ef7058b6dbd97ab34515f3b4b06d657eb393ef5e4aa7cc71246e100792ffbd6029749f7a6ed05
SSDEEP 3:OlH/lB3CWZ6k3Hg/G82XCshNl5l3yjJ/llS3mCllltGlslslslslslsl6IN/:KGelA/V2XCsh7OjlEmCtEEEEEEEx
TLSH
T1208112940F42461DFE3664B150AC8BE55329E000F5D4FFDB3118B8915D023EF4C26775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 16da2624f3d5a71b74651da7680624dfaa999c6ddfd2bec5ac3adbce3f9f870f
MD5 139315e11353d2723d55cd42ad253a42
SHA1 9ea3c2f30323300c4133050003a3a1f9e90f1b30
SHA512 cebe53357906e55f65b48c0ddc30b33d470c1ce622dfd3271891bcced4b51ae22ad14419633917029490c81e783e781bea4944d839ffa0b50add034629748d70
SSDEEP 12288:3ZHe5G5kE13KutvjmD4zON6ToeeCJu4/y1oEcxJIH26CD0qmf0j4eDQHcifsU:JHHFhjmDJQc/ItsqHM8ifsU
TLSH
T194854B029577EB4FC5BA80330332968DAB78AC07BB457F057385897988A795EB5F23C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7812e68264b25031b1346f75f3515c85b6d3f1d34814c197e646b965ef4c820c
MD5 df2011431e95ec6fcf13255ea2fe7a20
SHA1 d87485f1caf8373bed9fc91175ef6295816deca3
SHA512 607e4cf56b9b46bbb0516a250ccab4ac61a0f7969eb5a5cc903fa42a8b7457a97cf253ede68c5501a26991b9aff40c9b255774bea5402792b7d08864370c899c
SSDEEP 24576:nj/TwSfVcYG3K/cJHlnFR+IGNe8j3IzW:njLNiXicJFFRGNzj3
TLSH
T1A7552393528959B1FAFD0039857A8434B54D7E2C9B1558D3E2043A5EA138FDBCF38627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 439b5e2815784edb8e367d755e437625370a113037906f4871e0112b5cefeeda
MD5 12a5da57b0d8179017eae78bdc8248a7
SHA1 c79f2b6668d783c6146ad37fa6630b0f72c11b3e
SHA512 200b455357944ba2f54968386cc5eceb924316ca8a86b1c5b7b707728ffb58240973c1d87a0c657b594d9d5e1b6d9679e89dca6342afa9698afa2f84b99e54db
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Vgb4mBIBhGF6LNiXicJFFRGNzj3
TLSH
T11765AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e296ddf2caa1028cd66fc09b01cf985193c2eff8e0c939070254b82a73f3c609
MD5 02750485281b60bc108a010d4040fbad
SHA1 3d2d9fa871b661e9dceb3748b6e022736dc2565d
SHA512 603c2fe2b9cf3f25823b844d3202771f5e640bf9da009c0a08cf8031ec482b3c0951e784ba433da7664e8c61b2eabce7be69a729c964809c79307b00100896c8
SSDEEP 24576:PG88u8FpJqH1vzria7/mq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+7ZFPqVya7/NLNiXicJFFRGNzj3
TLSH
T18785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bc95452b3f57f4ac66a40ed89fd59e66b8d7a080e1db914a47ce19a75eec3484
MD5 47d09b2902b25befd491156081c2a9f0
SHA1 a84c6febf7df7c8091ab1fd0c01b7959f9e65eb0
SHA512 28c3f9d90031cfb74e0ac52f8ca80c9975b68f8cc1c29d907b19c42c703fc6546f10b63a27a1b6d2921ac4445c73d7817e5a55f8f86fb9dc76974b8ac715315d
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeLNiXicJFFRGNzj3:IG05lO43bv7wRGpj3
TLSH
T160D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 70cdd03237b7bd2a1dfcf62596ecc12469a854d6a3862da8ad02a5b67e36d505
MD5 6794e7c5572a36e6b65d8e91fc524fef
SHA1 f5da1e4df1f9f9355aef30bad92371192a96edc0
SHA512 15919cb9449983eee4ad0591d72bf0a09b1e27268779d6eb76931e8cca2e19271f8e8a2760d1138c4ebe37e915fac9d61bb89cb0c1bb2001921cfbf6e0985c9a
SSDEEP 24576:hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnY/TwSfVcYG3K/cJHlnFR+IGNe8jg:ha5POZ3lJt2pasx2+m2LNiXicJFFRGNf
TLSH
T17965BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 372f13ce5b41ed091332dfdea6fde29895b9ab9074ef912d06bd06e038c2924d
MD5 efada6489dc6f4adbdc5aa8a8e7548be
SHA1 02ed7681dfeaf040497022a50091174f6b791705
SHA512 8a43bd56c2fc39119fe7d3827ebbf35d13a4787a041778bec313c3e9c070b6cc06ce9a3413c2d80055191b378bf4b4e1e00b05c2b50f14f23ad6b855b55bd4b9
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gNc/zEOVHFtLNiXicJFFRGNzj3
TLSH
T15C858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a1536b5b1bdaaa7e9b57e2112d21ee908b15d21b96b38c40a40fa6053012a9a6
MD5 e6ad6b80a4564a7177115c606e2a330c
SHA1 620587a69f7e25531cc626c5d6105ebddc6ca389
SHA512 c7b04a00920e52c792a85f90921917c0c1a8a38ce5d0fad08704b56a96d6e9de5dffee216d914c403d8922880072b8fcf4c7da156330afee73e8965bea701409
SSDEEP 24576:azkNvNnaFeYhJNtmZBm0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:azMwBtOm0LNiXicJFFRGNzj3
TLSH
T13555AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b5a2734f1bf61907b87f70b5ef6a73ccd0cc65f7e3918b111a4a35c4bf584590
MD5 201b5aebf0334a759bf1714e19f6185e
SHA1 6b5e0d06b0d8f7eb6eeb4b9a882adbac474d2dfb
SHA512 9a5d49331cf1a461d4d26b3c2f0e63d04a5dc0c6a607c890c9af099e7366dbdaa2ef4afd1b4536c358576dd701f534e672aec6c561c5470527b040a770059a48
SSDEEP 24576:0PUr+NQu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JQuLNiXicJFFRGNzj3
TLSH
T15F65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d716c8fbd0ac51e47c9fc1600b700a19255e2fec155764575d17156051c041a6
MD5 ff204d7896249a98bdb6fd2e798604a2
SHA1 efa017c6db76dcfe0014b500175ac98dab6a5958
SHA512 1dc79a47f4db7e2e470f4a3e6740a78d76a401fd894d5433e2315af407e63e3083cc4ab02d3ad0f371889b92d13507c1f4ce19d9d96e7de666c87fa1c0183cfa
SSDEEP 24576:9D3FHshBIYQgA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9DVHeBIAA/LNiXicJFFRGNzj3
TLSH
T1B375E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1144-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1144-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1144-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1144-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1164-102-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1164-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1164-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1164-312-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1164-108-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1284-122-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1284-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1284-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1284-116-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1300-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1300-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1300-329-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1300-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1300-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1300-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2912-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2912-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2912-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2912-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2912-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3412-60-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/3412-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3412-40-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/3412-46-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/3412-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4264-0-0x0000000140000000-0x000000014030E000-memory.dmp

Download

memory/4264-87-0x0000000140000000-0x000000014030E000-memory.dmp

Download

memory/4264-8-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4264-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4264-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4684-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4684-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4684-309-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4684-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5004-78-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/5004-83-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/5004-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5004-310-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5668-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5668-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5668-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5668-315-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5668-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5756-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5756-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5756-23-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5756-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6120-56-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6120-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6120-50-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6120-308-0x0000000140000000-0x0000000140226000-memory.dmp

Download