4a0aa0de012341f183b40f3e60fb9b35976ed8b428e4f7b24a6aed6125c37d1e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.5MB
Sample261110-q1c2vstyf1
SHA256 4a0aa0de012341f183b40f3e60fb9b35976ed8b428e4f7b24a6aed6125c37d1e
MD5 87bb054eb9a44768ecb352e18fd94d3e
SHA1 a9ae515b412284c66e8159aaf3299cf07e1e2a77
SHA512 0da6abefea69277eeafb2cdd22c1976e457ec12f30667350646a2fcab9d2d7aab73c6ad387e6da949ab9f5332acba22af10a20b71827a606d1b04f78e9ad8620
SSDEEP 98304:JAx/bFEo5Ljlznw+sMJeQywiuZ3D527BWG:JAx/ZEo5Ljhw1uNVQBWG
TLSH
T10FF5AF1F72EA40F6D876C1B8CD01860AE7B3B41543314ADB16A4556E6FFBAE40E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2748	elevation_service.exe
2916	elevation_service.exe
3668	maintenanceservice.exe
3012	OSE.EXE
5548	PerceptionSimulationService.exe
1640	perfhost.exe
6120	ReFsDedupSvc.exe
4404	SensorDataService.exe
5368	ssh-agent.exe
1844	AgentService.exe
2308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3557e2a431e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\AddGroup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a7329801971dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077b676801971dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dd20b811971dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd0a4a811971dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000989695bf1971dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0efb17e1971dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	6120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6120	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1844	AgentService.exe
Token: 33	2308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2308	SearchIndexer.exe
Token: SeDebugPrivilege	2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2748	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2952	2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3040	2308	SearchIndexer.exe	101
PID 2308 wrote to memory of 936	2308	SearchIndexer.exe	102
PID 2308 wrote to memory of 4928	2308	SearchIndexer.exe	103
PID 2308 wrote to memory of 4116	2308	SearchIndexer.exe	104
PID 2308 wrote to memory of 5604	2308	SearchIndexer.exe	106
PID 2308 wrote to memory of 5376	2308	SearchIndexer.exe	107
PID 2308 wrote to memory of 5476	2308	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2916

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4404

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bc83f55c7fc881611cce787fcd98d29c02becfa9463bb604a7b73860793a141a
MD5 2ae51b65ea48140ac6fee6db513a99ae
SHA1 040c773b92445bf80e5bd600200ff41224c35739
SHA512 9ac2c1dc4b665ecaa131c7454861bdf732a8d683726cd66c17a40c4d9adf82e3ca39fe76bb35dceaccc5e582ca0ea2dc569254079d7ac4f042f386fd4ecc24d8
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnGDmg27RnWGj:L3q6sjBlD527BWG
TLSH
T12FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 113b6b1f7cc27780e8d5841941b70a3e3e62011518d4d3ee952688c299aedc70
MD5 9549b46c8e8ab7615b9a6fba6ed1f211
SHA1 a4729abbe58a8d4f250a863ebb35fba0d75a45d1
SHA512 917cb9540ad14d640d742fa392a7b3f88e2b18b54169249f7fe5cb2903c9591c25c4ebc6798d3b778e448d8abc06a0c59ca00db27a97fba6afb62605427ed2e9
SSDEEP 24576:QXYfDtczAtsqjnhMgeiCl7G0nehbGZpbD:ntcEDmg27RnWGj
TLSH
T19465F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 50adcacad596dbc2ff0336800b253182b30d36ac5bca676f9c05e68bdd6f5fb6
MD5 e2ca65e582f195f64a52cb456fa74737
SHA1 2ff9e2d9329e9e43bc6cdcbf337385e83acb2002
SHA512 f736bff34b6e325040a0757a97430f759905ec62501a1752861f93e3e0718d3fa152a52225c82d3dcebb6411ae23dbe4c15613521190500081a9a2ac3bbfc2a5
SSDEEP 24576:Q0Le5ji0hmxxrMKsqjnhMgeiCl7G0nehbGZpbD:QPji0AjLDmg27RnWGj
TLSH
T1D5859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 14ae6b54717bc398fd9192fa9e4d8612b176d6db9d0fde86d5d28086356bc7c0
MD5 53398deb0ba04530c0fab3b323773743
SHA1 aaab0e0add4592200a512cc46d6bb15ab280451b
SHA512 8f2e9fc742006ab87dad9cd92535ff428b7bac968203b11e22a6756397af0c4e5c0e033410fcbe56a2d1e0100be3e09d645be3ccb35b38905676682635fba333
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyuIsqjnhMgeiCl7G0nehbGZpbD:6/ezSC6vUzPveHjy3Dmg27RnWGj
TLSH
T173755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3faaae6dbfddf272b8dc49de9a1842255420b98d8e4394522ad470b79f866602
MD5 1bf05f354e0ba2ab70f8970f1f3bc699
SHA1 91d11e113f34e648263d01a74036f9cd282e9ad0
SHA512 6bbd31ab234a2f285ddbd1045101ab1302489c33930a7e480e97d6cf340a55e7590254e63b7b89ec3a4911eeaa1f8a60517d442e9454b6762ab14e57e1aa0919
SSDEEP 24576:CVbqPb88hv/l+YBsqjnhMgeiCl7G0nehbGZpbD:CVO88hXl+8Dmg27RnWGj
TLSH
T120559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7244049669e3252f2fca470d792709619a4b841ac18b08cfcb4e45c7d4a46af0
MD5 998ec2960d89c32668227eb3428d447f
SHA1 63af92227de1d797b048540a11af63637500c029
SHA512 f1ed0a54331bae85fa10340f72e2173daac832e90de499a46c87deb80cf3fc97f86256789fe39d925a6e3dca6d6b02992433fab1df89bf13cae38948b9346f00
SSDEEP 12288:NLeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NLesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BF864C51CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f5721ac775fce85cd7484becf112a7652272c6a8512ce98d2a94325c02c98a57
MD5 da025a741c3e7da006132aa1cb139b71
SHA1 487ec1a96fb8ceeb82e10f3547e6836b358d514c
SHA512 298b8be6f7a2b6227ec7c7580b7ba8ab884da2f10bab608ebb65d09298b0eda353c6dee555cdaa8ffbcaf6b1d48aa2357a37f582a3a67350d3f0dc9fa16c3c4d
SSDEEP 12288:2eBNUbTVO86UpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:2JIUpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19965CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f0d95fb1ac1db076ed35440be61d0f86c8b56f02813dffef45e86e167118832a
MD5 65e942c569c8510b59b76f3fc26497a0
SHA1 d134523bce06b821549ce4c05bbeddae4f9c972c
SHA512 2e1f19ff2af33bbdd3335d8a613500e69620813c9882a0a6d2b0e59aa2ae235b1365ffe81b6075bb3e63b07d93401f152d94375fd94088d87233fbb2d58ebbfa
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:UQvGAdlCEL8c/DRNw5CkD527BWG
TLSH
T168266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d73ab46dcde349987dff9ff21d0270e1820aabefc519445883f63257a9b82505
MD5 26318813395edf2b33f13954983363e2
SHA1 eb96f45648cd71e916363592ea0640eb1ad5397c
SHA512 25642100448ba6801ae45520cb3e0f63c328a5584fdfbed23253ac9ff5f7b66ba32c692e0d4057f6fe98f866cc216f3df7b207264d76f5a8b4b08d3ba651c600
SSDEEP 12288:BAwSfxL/2Dc3RDLLmt0LDQewsAjnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:i0ewsAjnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE75E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8ffca59724231d8ae7612749d39e070b58c549375324b2a34c390d5bb5acbab4
MD5 329efdea5e3f8faedc835cb2997932b8
SHA1 710b32d86964a2e75bdba2c9f5b433404be9d36e
SHA512 054fea1b0f8b0071ab2d8e96ab0e7b1b0ec7dc6f882f0f9483a4e562aad7aaafbf817328e8deff75dfd1178b7822ba84e5f81ae8cc1837315f955c6a8cc8a1c1
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDVQBWG:7UEtQevvqc2W1cpV2tI326B
TLSH
T137474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4c303665304f9380ff68908773d5f37c853006e9304dfbf95b5e8db6f91cc304
MD5 eb6132dc60ecb7d78eb6e490d6f2789a
SHA1 a4c51c968e56bc878546270418d82ccb03c0d34c
SHA512 8e4a20f7dae1e1b8d8bc99658c7d2ea446e3b4af38163fd6701f02f9ed974c7d7bfffa42c23eac1a37938f4b24c0e03ddb83176555338498a3d1fc2d6912cc48
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/zbDmg27RnWGj:HoquVjnmQD527BWG
TLSH
T1D6D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 16c8a0f3130cd77ad4d1f0cd68c9855fb1be2a109598b9e786da032068e3f2fc
MD5 d947ef40eb5252f45d885e43f603a850
SHA1 438709df255519259d483861cde2b868bbbce74f
SHA512 8373a701d4da6181b896807596c63a283f1b769f1c62cbbe3447fe8663fd25ea525621768d09f4a40b2438093f052aba5d84b7696905e585b64fad624201408a
SSDEEP 24576:sAhGL3IFoiwtA5l7S53UsqjnhMgeiCl7G0nehbGZpbD:sAMUFoiq5ADmg27RnWGj
TLSH
T1E1359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 eb09e3446f0114da36b3d5ed5850b8263330e46171ece4eee52cef577c80854e
MD5 1390569f1b9e3e2b4da11d1b0ea43298
SHA1 c79fc8e82fdb6702f5b66ec0fb68e56705d08990
SHA512 457bca2c2f4a4e23681cd33e2508c5d17e6d55bdaca7e00eb4e59d9c41dfc3c221010cd6b0da8dcc0394750efb541a7bc69307f98532ae4aa5285c77dce4df2b
SSDEEP 12288:xmw5HEjsChNVBFgl0WDm+CoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:swu4OWTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19565F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ed64e5e9f137279395ab75b717bccd5726e517a763c0da48435cfc9cafbde86d
MD5 ad14f843b5f46756de37d622063b06cc
SHA1 77255a0dc066309b1af34fbc28a947a7fc09fa9a
SHA512 729254aa6e9a92a98e3eb88c65c70275585a682cfd0d98f522907944bf8e978ed6423410f02ed26f5edadbbab1a716a7dd1975be735ff3e059302a757fdaf8f5
SSDEEP 12288:EeZ1IyXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ZuysqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B5512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a15ac9aa55ce16d27b1cfee12a9b9fda57faa994491a46639285be0afc51a754
MD5 2f7c56dd8ce20804838e245489a0abb1
SHA1 e32cf343ce0c71d37c1c3d3967ed5d1823ea7f94
SHA512 30f48ccd839f71f52ff80d67634fd2740b816477af45092914e3e44097be48ed9bdb80853c72f172cbc63ae24f4462e4689dfafd9ccbc95cc0bedfca0b67fbb9
SSDEEP 98304:pQRQyi36YOcPbLvw2gAf+PN3JD527BWG:AQyiKa/X+PNZVQBWG
TLSH
T12B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0467f61002b998bf2ee2fdb5bf3c5f72e880dec9849e5e3603ebd3d4a8b33e97
MD5 22b2b4467f6a92477f06ea61af5b6563
SHA1 3471311b191b895c955919ca3d824a2b46fe6044
SHA512 2ddbe7ab518e258abb548d975b77036950babb81a8dee240619958347b8e210e1b88a59484b95587291e081fa468fa95533f86241dc3552c9b225563cf8fc3aa
SSDEEP 98304:VQRQyi36YOcPbLvw2gAf+PN3JD527BWG:sQyiKa/X+PNZVQBWG
TLSH
T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f5b84c22589c0c2850f3ffee978c9fd69caf672e2af6265b6a97e71600f2e2cb
MD5 d9b3dcf3076dea952c846457c18893a3
SHA1 f73609d5890203c23e93e19e31386ec9375e43b2
SHA512 e788ef13128b07e3710ef476071ffc01edf12306789835167d0a87deb7a6d0242d89a0ccbf07ffc0ef824a49632eab33b6d8fdfad4aa8d68670a6663bc6e317e
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0CsqjnhMgeiCl7Ge:j68Qg55nhceWu7PNU3/LDmg27RnWGj
TLSH
T1C2B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8e5573170026afb40c045662a64d02fc8a82047c5fb30f604008d6068b084ca1
MD5 9e121103cdeb69bc3712d048beb4a777
SHA1 6667211d26d1a8ce164fb09f3917d8cdd7d3b8e1
SHA512 7d51df9924f78c9e0c5f0563c4b0cf33da5c498dc6622f6740eb842a6249cd3e6aec3aba0755e30a7dc4324b7cdc5601e796c093884e178d66b7e4d514b0d439
SSDEEP 98304:gy5112gYy5azzVvt69nLKnhZyD527BWG:5LIHEWh4VQBWG
TLSH
T160167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fdcc6bcbad1593bd4e78b0421ebd6723954273ce6e96a61320c11a759b18cc6c
MD5 b836648a42ba67f980f2ecb065a81baf
SHA1 8b28cddb13387ac257d1832dbca257c449cfc2b6
SHA512 2fcf7fc54d331fb1a29dfbd5d5a8ee09418005f3f61510a26345e39ec519505f702afc158393c6592ac2cd5f26c41b902f6108d73fe5c7fa11c6ebfe79b6b2b3
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glhDmg27RnWGj:Ou6Jmdxd2dhD527BWG
TLSH
T17FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 584e0b1d8b658e039270cec687a1d1b0a5f7b1e6ce52621177a70c098f2336b7
MD5 5c3358101756fda60b5af522ccdc1e42
SHA1 a30a8d71b66ea01db9d5b10bf9e9382c2695c186
SHA512 429aa08b747dfd44a79b2760ff0090f4602ee5f1ec94efc645d7ac32e84828db527514154a082a9c6fd70eb1310a37ef2e8f39568912a3491743a07028f22f96
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xNDmg27RnWGj:+mifPWRQD527BWG
TLSH
T11AB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 70f7ae4e54b9502f34e5145ada8d2e8432530d0ba89d12d1798971cd65149119
MD5 ff8897d03578d9559dc020e607f838ff
SHA1 2d6ac625f2320f128d6134a2a2390db3e0a6efda
SHA512 b9a972cbc99dbd401c4abb0a1b2fc196f2cb88b9fc903b907670ae0c292158cb917631a78b7c1e681b620ed79c57ba831ce878be6413de64f8d419d38da8d843
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHq2Dmg27RnWGj:B5dKii612D527BWG
TLSH
T153C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f855c484634d7996b29992bb812ecc7b3abc8b6e89bbbe60ef9d3c23f18489d8
MD5 c7bcf144d679ee4c638fd3ee471abddf
SHA1 38f1cbbe3c4017de72bb9bee2986b99674ff9bdf
SHA512 e878ef0e48c1389d71a73c060dd4522e4553831597e8fb011fe13aa4c06a50a2cd8f1885d3054a5f80ace6449a9a6e507bc7b0fab61aae667ca8722764f01e99
SSDEEP 49152:khtSn8EApI0fig3giDn0AP5wRDmg27RnWGj:lX2imphsD527BWG
TLSH
T18395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0f70d6ca48ca7f3909e84ab48e63a58c28ab97b0d7364c609936a55a39b34ded
MD5 e80e6aebbdd3853fb82b6408bd6a0150
SHA1 701143582cbcc4cf487ac957fe8faa20dca04fb3
SHA512 609d3ce0cf6443f440a795b6a32d64aaffaccb2ef0b02b3e05f65f3aa51a6e10550edf1944d4e8ec5dd0a2fdbc45a0c99be91c011e7b1ed800df1ff0a78f4bab
SSDEEP 12288:amXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:amsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A577CBEFBB24984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9609cdd6275eb83a79009d41a1f2608bb54c0ef15bd5eedb9e4ccb83672f908a
MD5 a12d3ddad0f2bb92132282b8e24509c9
SHA1 67c3f815c161f92920c2c401eac26a915ecef3c0
SHA512 7249973a8542fbd0ff93ec55b31304d6f0c4480541460d698a43ed351ab9bb0690bb75c11b5cf5dee79a9ffd694e4477899f6479a541480e579e5b20d6e6d440
SSDEEP 12288:JrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 57a87e5d549ea242928f61806c402678e6e22ff22575eb0d99b022a5bc3bc7e6
MD5 a00c1380f497746b0fb59d914a47d7ec
SHA1 0eefc2d0ceac2bcbf9289f1f8d49b4795f26395a
SHA512 fc8d61a5da2f28fae5cc1304bb829e9255d885c3896c42543134459130607d7ee7824ecda11b3f6a67e892937b7758e37400a61aaa7d633c720883c3933e0a5a
SSDEEP 12288:YRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE965C41CBE52608B5C3E5F10DAC173E5BE9200483BA977CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a3a5d36fc207e27763597c4c8595d3c9e1115c68a84155aeba78b7e7e13d36a9
MD5 471763fc7815e9ebfbbf2fe2c7744716
SHA1 dd87d570b8c8132df65f09823e581f895b7c4d50
SHA512 643d55075c695f43d2e95b05985faa60e57f6d981b9d712b9e4e34efeec4b4191e0c34f178cede0898aa808994111e51c109cba333d3aef85cd58f2fe51ed205
SSDEEP 12288:/V0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D45236B675C01CAD83285B4C2F5E11DE8237D56EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 979d8ec8e6291dedb8a5bcbd234d9257761dd27bf829eb53f5f85f8f8574b19b
MD5 28a7ab1746dd9c3fb973523ad880c156
SHA1 9d95380563e6fbb32c45919eb03362b7538cbbb4
SHA512 85651a433e5eff8b5ba0ef7b1055a1bde9f495305699da177e7368134bc5a650802e00c326c2096549a2e09e1d66c4a2986bd2ad55d7978ed257e2f139bef0be
SSDEEP 12288:OsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7c3da4b3e5296001ad9da748793581d41f1c533acd98af1f62065b3a93a115c0
MD5 e7732a2b67a21f92919e96b4c2bd9745
SHA1 51152025a3d2bfdecce0f548bd109d61b509beda
SHA512 4962fa0bed8b1855da42dbbfd7d2d1da94285ccbb0e9e78d9920e9076bde2c82ea12f484793af9d7ccbc3c479fbb75090b87c691ca8087dafc87284ed5947b46
SSDEEP 12288:7PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BE965C41CBE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0918fe39e0edf163cf7a562b0b285eda026b4a0fe45ce192dac683ecc8ab3350
MD5 8b5a2c3b4d2bb6392d475d1996e19da9
SHA1 912fae7b99a6d39c3c1a6404b1320605ea043b0d
SHA512 24e598ffc6e9f205f2824f3e2873ad2142a4bdd74ba72e24f6d3b4f070cab2e69f3caf538f5314e48eaab2b8cbdbf3b6ec40f40de1336e90e1df393146d787b8
SSDEEP 12288:ZjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE965C41CAE52644B5C3E5F11DAC073E5BE9200483BA57BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 69bd7cc5e4b438e7623eb4aa11e7f4c6f629f2c744891191ca32c7b7c5b43260
MD5 4b2f2ac7a1083687448cd53522531aac
SHA1 1f1c4d9b42227491b78e1cc7e2894935c5624d5b
SHA512 190baf21ea63336493d6762316d8ef9f3dfabcc5e1d18148db776696d8cb7201009bbc425183be37874e4131f8ba49ceb5bdeab540d431d0be085751d5241c48
SSDEEP 24576:NZMRzFVSOLsqjnhMgeiCl7G0nehbGZpbD:NZMRzfjDmg27RnWGj
TLSH
T1176501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bd3fa153a0032ed3c8f7e4431107c28c36ee66f9c043fddefe05a15b43eac6d7
MD5 9703731376f51da83d307c3efb8df8ac
SHA1 94074d65bde6dffd57186642d988b82e771e8bfd
SHA512 0e848ecf7df165cf3599aa4f56dd90430479038b07885648c1b1a2576fef66907376522659cb2d9a469a353ca40e8eee359cb53cf2eb000c7c24743057cfc138
SSDEEP 12288:NiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8b14cd5812fbd871cbab8c72b162d1a329e1920ad8c94857999fe5a739813052
MD5 55d6fd3e04ad89d5e7f9de6b7403eb8a
SHA1 077e63c20c91a0563f977a8cd4a4cda7449a432f
SHA512 b6bfb616a57a4839560fcda8d550819bcd52961a182c0484adb23c6a249090709b4e2ed562915fae8e1fe46eda4b65ae1273530379075f8720d7c8233f867248
SSDEEP 12288:UOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 cf740cf980cf3de73a6266d08ef5c589dff370b20f4b0a6d06057685f05c71f9
MD5 08c85c449c5f8a1012b9a564fe536329
SHA1 a2685e887c68c039672b7e6201e6f7ca738b1305
SHA512 cfae45ebe0884cbcf69f923292522ed9e5d2feacc22ba129cd3b084540bf939074bcde278b4d0d477a38f426524fba0bd35598e5600d9ceeaea4de0f1f833efe
SSDEEP 12288:YyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10255125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f4eb20163573c7afaf4f43450b67659c2c9a17b40497c34bf4753b29c93db24e
MD5 502be9efb006e3a4547ee833ff9bf6a5
SHA1 aeb21f03ae2117b0b1d926615760287667857c2d
SHA512 6857fe59eb29e91a9e372d47c4d50610dc2edea9fb3a3e95f011c358384c2b0bbfca0cab1d4d55994f06426e6de3b7b3cf6527837061958cf47430d5a67a69ba
SSDEEP 12288:9iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9isqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0984d623d647aa99a752cc9e397341a4b4dab4ada878e1e530e013a6808630d6
MD5 0bf2ed6a37f3d94164ad0ec5e1c3c565
SHA1 bbfc61b3a59ce0fdf2bdfd6af9e34f0f60008aa6
SHA512 ccc694cdae4f93b9c0b400f3b43e24aa505387fb2f96d7641a6328718623be9e78f64baca6c44d031dae18f0e1b059af837c9f685a201a8bbc70d02d6f288b45
SSDEEP 12288:riXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:risqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF955C41CAE52608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cae5959adbc2662cbfc0f26c891ae821b5b4ed7f38bdd948c380ee0ab14ec6d9
MD5 76ccfa00a44c94b6026b8578438e58da
SHA1 264282a099cd8577ebea7ea3eb08fe199a0b9aa7
SHA512 fde7741de0a65e8bdea3e144c73420ab1e5d49e1db8fa8d1d5ca3dcb07001fbfdaf9574af4fc6e4ea50fff7a33d1a59e58c262f5b255412ba47c7a557fe5c4ba
SSDEEP 12288:dyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17655125B73A530F9D1368138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1cd86a3ceec20e359fc99a100e73764ca8398b1aa075d7d0abab47f733dbfbc8
MD5 4f9b87cf326f33fe834aec54aa02da29
SHA1 a490299b2175d780f839848f2ea473229cd6fde5
SHA512 2599d39532e27f9e51856be8053cf15674b8437d24f584dc5af3d8c158dc7f44eccf25b17cfb2af6c89834b50e2b1b9f76c23a29e77dab2ab7bc710da5fd2dd0
SSDEEP 24576:WTDaLl3z0zDhsqjnhMgeiCl7G0nehbGZpbD:WTuLlj0Dmg27RnWGj
TLSH
T1256501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9ae9f010da0b472782bbba6a9fe53ae387b488a9010b21db37e7f047533837e2
MD5 58f4b7623710462eead5e6d4d40af9fa
SHA1 bb77cf02a10990ec017d2cbab416f14d62c588ed
SHA512 09373020345d9f52ae19d59e2375f4b485ddaf88876324150bfc8d5f41b947c41cacb869b3d862b72736ee994214b6ce1d4b72a25fab60c1669f5ef9e6b8e5dd
SSDEEP 24576:B3vd9CHKy7GZ1sqjnhMgeiCl7G0nehbGZpbD:xvd9CHKyajDmg27RnWGj
TLSH
T17575CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c8edede7f7d108d7c50af5220ce97789ca9c2d943888da7f28ecc6f491a08eb8
MD5 0563a2ec28d25327c390c197f6c1dc40
SHA1 a6c55407fac8d8a85384fd282a9213dc7dd79fbc
SHA512 7f4f4c3c77bd66b084ab44c071707e201d9fd1bfafedb38e4d9978425461184ad4b102b926d0f44a59dd5caab7cf9b378ef2de9eb6e4186bca8bd068a808b219
SSDEEP 12288:txXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:txsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8f7cffff0a4d10691e7161662145d944b5ff3634799102c30d39f3a53a8e5174
MD5 e3836f2510df07a191d4f3992a6f69ff
SHA1 6afd807462619be0fe0ee7638eaa9a914160e4fa
SHA512 9330e593a5769515edbf9030bba5df47a7e5c78bf0342b624690f359a45fb3eb2af29602eaf6d8058e6f1082f5c59ae5e1ea527b1e9c57d117bdf881eff6f663
SSDEEP 12288:W3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1714523BE965C41CBE52644F5C3E9F10DAC073E5BE92004937A977CBAEBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 98d87dee142d3d5fe583f6626859589903290cdbd7c30cfae1a33a70cf79e1ce
MD5 1825a11063e63c9a95f45d6a53b7a89c
SHA1 91577cf45afe0eb6d8842ef455dd0f35f1ab36fd
SHA512 25e271939443f8c4d015023ee98341796f121fb79b312219903ab4af6fe6c9bb0b04f8a4168dbf2e08dd4d496080aaf7c8c813dfb739b4972f29542ab2a75d93
SSDEEP 12288:KgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BE965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f1fc0d25ae5401eec71c56ad40e0d5bee64ba2e62aceb898d8181eacd4d892be
MD5 6ea6c415e3f9cf2444b5fcf3e512e57a
SHA1 1e565b81e330a619abd9725710c5969104eab971
SHA512 744e4667f09e0f1f759a41c827d9e1fef767b40c6cfb59e3c75e9c33324750557e785a7a1e740b09564fb85c01e8d339a8bb7963457b0e46e09859c1f43c7d72
SSDEEP 12288:0iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 33169b72fcf4aa485c1f53a0c7f1536f2d57be71273e862432e085fb2c62d227
MD5 8b6183140b8e29c6cd42cddb1cdde249
SHA1 14fd20ba49d810ea73390d33196813bbdad46546
SHA512 ebf650ee9f7214543b24ed688c9ca5f99a0d43c3d337c0ca1db7e3ad6ecc27eb4e109ab9806bb4ad90f5a61fe600ba2f33912ea3697a6c4d86d7352806209593
SSDEEP 12288:cxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B4523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2e51393234f36a5c7817289e6279738226cc9f2ccbd3992e8c06882af8ca72a2
MD5 37b703c26ca3fd4929b09a88d73772c5
SHA1 d43ff39aeeac2eba9481332b0253ee016d00b2f9
SHA512 677bbd8409d4d0e187836c2c8b6311947738ecce801440e237cb3b1cab013815b519b2fa8db94c89f8c1a9ca045f1d368943b72150e87d504fc0fe5497cf4af6
SSDEEP 12288:caXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:casqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BE965C41CAE52648F5C3E5F11EAC073E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b386abb09b2037d4f0b5570acb9fc51874ee21af8e2de10b2f7a16e8c8c98039
MD5 3d1e677928c39f18c58d869295b83a81
SHA1 f68692cd4a328587f6e2def442b3eb054ed6b00a
SHA512 8244d476847ca1d38ddb3b2ef574dd126721208084e936d7581f4a3ab032e0c5c6eda4b259f0594e9d67882422203d98fe755433e9b4bc9f2eacfd7dc95571f1
SSDEEP 12288:UsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE955C41CBE52608B5C3E5F14DAC073E6BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7d53a891249a152095db8c164ac154c14dea5d0081b78bb3c2c88144fc4fc8da
MD5 812a9d5eb2e0a1500780f67b3b8007b0
SHA1 fd88608aa0b74fba53094621ad7f3e51a4526110
SHA512 7820fd29609384077931985e8ce5c8e03051b377a3f5a29849090a571cba3735a72e24a3002ee4f694a99854124fea22351f71deb6bc905a5013ef33acbd44f9
SSDEEP 24576:2fwvUk9RX6wkyAI+sqjnhMgeiCl7G0nehbGZpbD:+MnYISDmg27RnWGj
TLSH
T1AE85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c9022de9bf1c1d71244a1d7c094677ab47b26aece8e7dec3941fe6b2f5f1d861
MD5 0b0a18825810cddee185c6da8069fe57
SHA1 86c45cfbfffcefee45ba4dd04aa32972934ad0a3
SHA512 d004c2f4d94a96401575c8c7119dc966518ca8d79300d68f43f0a1eddc607165114d005172e723b0be69a2baf752cdc58bfc39d45f1ea4b5666a2a04a07dd2e3
SSDEEP 49152:gYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xDmg27RnWGj:nySzPpD527BWG
TLSH
T142066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8d7d1f635b5dbea4a018226a0c30f18411ec861227dea54f624f2e8d491fbaa7
MD5 53bd08d5e7476c3bf1888c80438192e0
SHA1 201aacb4d6ddb1ec2959de7a040bd3fb657f1732
SHA512 a67f028fe5d58017fe93f75cb7efe5ecf796d8183f7050d8708c18bc7181bc2b8d3d62d482cb5f296fea6dfdb09228b724a44c265541486adf4ebcf44037fae6
SSDEEP 24576:E47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY7sqjnhMgeiCl7G0nehbGZpbD:E47JUQjTirIhCnDHUPfF/hDmg27RnWGj
TLSH
T12D65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 827c36122af63820ecb9171d1388a7ef606c3bc3efe853c4f1fbd4667e21984f
MD5 10a8789d26b19f589b5b0a2823e2917d
SHA1 16332b11c313a7e05f09088a21a005ca68487cc7
SHA512 d4e12cf0f1bf0ecb4efcad99ffdde8f91894e482545f8ee03d6f0f0abc4c2fd0dda71c7340e42199d971fc080c0951d738f8b33e479f7aed2d8e4cb8eb4e4fd9
SSDEEP 12288:xbsfyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B055015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\2026-11-09_87bb054eb9a44768ecb352e18fd94d3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\log_00200057003F001D0006.txt
Size 581B
SHA256 2610ceef07066b57f404874a051c27195ceb47e7db4a37138e8dd763c4d187d2
MD5 45738eff3ce8c6d9b1313d6b7f1982c0
SHA1 860583471c3d0e1a07d9a3520daf50e75736d07b
SHA512 c5cfb881ca305645a82cd921953663448c9f5709380ea081a74ad30a61649f2b8cc5a1b1d2ac0209c2a5f918f6022ae5246bb827ce92a3b8f5159e8639a4505e
TLSH
T119F0F02BF72E325E1931A5E3F3A380FC6064C06193579C6C562C64AE80C5B32AFEB040
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 80c15392ba260b3e2d4120aedbdab9679f31f1947dd5b16aeedfb88a0ea89547
MD5 e6fae10ece06674aee9e7fee6c23d55f
SHA1 b993e0118c8e52a0a74d23dc05e789236c5f8815
SHA512 7ff726ef4ed1d2c4a14827b9964e0102dae5d00c2d0e87e441f6c9ab79c779c3116ec8f548d524ebcb01cb56fcdeb1895d824f86f7e58f3a1e33ffdae995df28
SSDEEP 12288:TP1+fJU3fxVFLP9nC/M5HKzUG2GzaYAvni0hwfbeQ7:TP1+xUPxjP9PpGziPiawfbeQ7
TLSH
T1E3451850766ACB4FC6A940321E37D1CCAB707C45EE446F0773C98B3FD576658BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 c82299f1cdbcb8583d80b0f71068e8a5cc047ddaf642ea9d9946b9acd6ae92c9
MD5 16d677d275ff2ce0ac4608f5bd24ce18
SHA1 afc11d733ad0e8fd9969b8d986d67641e24cf4b6
SHA512 5f24affac66ee917925085ed9dcfc0c90524e2d38474c8ce7ec10d9a42b8aa84e07b7da7da1ae8d728568a9be0c6e72347dfcee1316fec616ae3c03db99b37fb
SSDEEP 24576:iHbnLAlNb4GEG3HaUfNklkVRfyCoo3tiU4Uw3leHxt/F/Fq5L0a:0QNkuA
TLSH
T18575F9406537E78FD1F6203207265B8D6BA4EC0BB7496F26B3C5053AD86AB15B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b2558331a5b279acc3d4831221e51113237eca2a05eea1c3b72e5774667a8703
MD5 505917a7456857184f3887aca92c7a46
SHA1 e4302b509cedde15965f7da423b4914a2f68a587
SHA512 a6aa29a002094f09e3daf684adc9173d0131e518b4c27ee2aa8919cbb67523e18b505254bb7f930e7beb979c6c55cd76ff2efb0ce484a63402f4dfd5bdf4c017
SSDEEP 12288:L07qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D45237B934C518AF93605B482EAE12D681B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a6c3c2b1607161f77aa909d0fc20741fe9e3e15072c24d9ac16bb37dbc64eae6
MD5 f30fd490521c5336acc54dbbac8e78d1
SHA1 db61aeab6ee65751831c9479997ebbe88d069dda
SHA512 1787f0fe0c4e377dc9a4032ac1a1c0e427f78a6a3cf177f99bffb535f16144f32ef396c4793a5641be6692bbcf5e211acefb15d88dcdc78b4ee58af701157d68
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYIsqjnhMgeiCl7G0nehbGZpbD:0gb4mBIBhGFvDmg27RnWGj
TLSH
T1CF659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f886d91ef70d30a05d33f4351677cc79436900cb5d30286edbad143641918ed3
MD5 7beee76e890a5f6711d4fb722595680d
SHA1 8400a383ef2f6e8486d211dd233f1958c25b00ff
SHA512 a5e44d17ba6536ee4582a9adfc7a43de9d98e8b216c5989b5f0e32e1cad9d62d665f23bde3bae606567d73bfcdd476a27ca7af915d70b96068acc4913e70c084
SSDEEP 24576:NG88u8FpJqH1bzria7/mLsqjnhMgeiCl7G0nehbGZpbD:A7ZFPqVea7/8Dmg27RnWGj
TLSH
T10085016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2e3b2d479564ddc6c8bf1e82f1b42fea9fe6d24a18f1cdcf2521901d37e5fc91
MD5 aea197ea1d5cc48a068f6bcc0e83b5b8
SHA1 f87ab898933eeed3cf1b3a7f90557930498f311b
SHA512 f8eea9fd1c720dfc0447604a1f8153ab9c5a464100a29b35fe2bd98fe57e25ae5610c3efbdaa2aa08f81f4f9ff44d877b3e4e99dfeb20c88a40c7bee69b3a5b9
SSDEEP 12288:lHvUrBFrEjwaQ/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:lPUr+NQ/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4276f289e2219f33b060b46f5119e1c65dea6abfadeed1d9507993783e492846
MD5 a197758830d61b05c32f6e650c4edcbb
SHA1 e80b7944a19d00091a9a7176f765ba836aef51cc
SHA512 ca3a1eadc5bedf8f739c6dbed3bb01f41cc4a0bf9bbcc12debb745c19cf4e429cf447ae2e0a74750f1157c0ebd5c78a4e7a89ce452351cb19bb7feadd915f963
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzDmg27RnWGj:RG05lO43baD527BWG
TLSH
T182D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9811c1d4d4a2f883c79e2c526d8689afb69e63d1d5ffc1ed8354793ffc5eb881
MD5 0f6915ab28ed50c63e5c468879f79154
SHA1 92f71048c97e32ca72b840d7260a2843f8cb5c8f
SHA512 1dd617761a20d26d20c3393a75dd8663367acd2972a7900ed37198b0d7245f306d656aa754477a842fd45dcb5a068b9207abfa2611cb8f59c638b7d5797f421a
SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidnNsqjnhMgeiCl7G0nehbGZpbD:wa5POZ3BJt2pasx2+mLDmg27RnWGj
TLSH
T16865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e0ff07a87711e5d47e11a37f148cf91d31961882fda99a026da08b3f7893969a
MD5 db9cf1d894b16e8f129b4630dc052d93
SHA1 0f605c832002c300e2b1b0afbdc6cab3773206f1
SHA512 5a63f07c9cf576bff9997f7e7f8c0fbc39b1868a28b62f017248ae316f48533c5f5ce579ba90ce822b496bf24b511583c42279524fdb0ba4cd38fb3aa4fe8f80
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkzsqjnhMgeiCl7G0nehbGZpbD:gNc/zEOVHFcDmg27RnWGj
TLSH
T1C1857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a78eb50bc501b692208ddcf3bcac66b75813a2fea509613e06f14fa9c5446c7d
MD5 6a3bf771f97fc567d6b8923c14a949e4
SHA1 16fd99390204cebfdd79a7a74b58606e92499062
SHA512 3d05baf4c94c9f7d36225cbb65a70123baccc03848e6e57aa63a73d8a48f54efc4fa8e1ae54ae0b25e8fc47a510ce28d330f059c296373a832026abed5db9a69
SSDEEP 24576:fTkNvNnaFeYhJNtmZBmZsqjnhMgeiCl7G0nehbGZpbD:fTMwBtOmdDmg27RnWGj
TLSH
T11E55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3a07c7f2e66db53d0ed0a844a700ac69df9ff2dd7446f018759e3606596a447f
MD5 e96cea40bd6bc06c1f13ae2164cf3204
SHA1 68b49d8881ca7cd8c168bed56ab2a27b0068706c
SHA512 33b8d73a86ecb226fbd814da6bf51ff885a32b6ab5a47ed5124322dce5a6b70255867b9bdbfbb7616142ce0b9db438f9883ee48153877a47236879a6f3b00b1f
SSDEEP 24576:tD3FHshBIYQgAGsqjnhMgeiCl7G0nehbGZpbD:tDVHeBIAAKDmg27RnWGj
TLSH
T16D75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1640-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1640-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1844-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1844-128-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1844-130-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1844-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1844-122-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2308-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2308-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2308-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2308-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2748-15-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2748-23-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2748-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2748-21-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2748-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2916-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2916-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2916-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2952-7-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2952-1-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2952-0-0x0000000140000000-0x000000014038F000-memory.dmp

Download

memory/2952-78-0x0000000140000000-0x000000014038F000-memory.dmp

Download

memory/3012-266-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3012-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3012-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3012-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3668-46-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/3668-50-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/3668-40-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/3668-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3668-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4116-328-0x0000025EFFD10000-0x0000025EFFE93000-memory.dmp

Download

memory/4116-397-0x0000025EFFD10000-0x0000025EFFE93000-memory.dmp

Download

memory/4404-102-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4404-96-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4404-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4404-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4404-313-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4404-315-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/4404-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5368-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5368-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5368-109-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5368-115-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5548-286-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5548-74-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5548-68-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5548-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6120-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6120-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6120-329-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6120-83-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6120-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6120-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download