c1ceefb1bdc040c3ec336eb99401334faedb2012e2eb956bd395da739ddaf448

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 9.5MB
Sample260523-eet8gaez8t
SHA256 c1ceefb1bdc040c3ec336eb99401334faedb2012e2eb956bd395da739ddaf448
MD5 613be176fd75fe62981b90077e9f5393
SHA1 b48edcc955e25237f1c171f2b2dcf91fc1672214
SHA512 e41faaaa9e2738c4d3bfd77d2759c838cceba4b56b50ba262fc44d9ff68b855388cc58c766329643af8c16f1b4e394e8b8fd39302bb604f437d40790756e632e
SSDEEP 49152:L/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3h:YWQtZ/K0tGOFWVRuLftCT/BYzlL3
TLSH
T11FA67B17F2E901A8E15AE134CF31822ADBB2BC5947F1A5DF218072D52E77AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence spyware stealer

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 3 IoCs

resource	yara_rule
behavioral2/memory/792-0-0x0000000180000000-0x00000001800DD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/files/0x000600000002a956-15.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/files/0x001700000002b823-89.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3468	powershell.exe
780	powershell.exe
3188	powershell.exe
4652	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1052	Symbiote.exe
2676	Symbiote.exe
3216	Symbiote.exe
4152	Symbiote.exe
3556	chrome.exe

Loads dropped DLL 3 IoCs

pid	Process
792	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
3544	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
3556	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	chrome.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	chrome.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	chrome.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7E89.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Music.UI.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	chrome.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	chrome.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX6E55.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX810A.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	chrome.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	chrome.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCX7306.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX814A.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	chrome.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7926.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX84DB.tmp	chrome.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	chrome.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	chrome.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe	chrome.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe	chrome.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX7237.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	chrome.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX712A.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX72B6.tmp	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
792	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
792	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
1052	Symbiote.exe
1052	Symbiote.exe
3468	powershell.exe
3468	powershell.exe
2676	Symbiote.exe
2676	Symbiote.exe
3168	Explorer.EXE
3168	Explorer.EXE
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
780	powershell.exe
780	powershell.exe
3216	Symbiote.exe
3216	Symbiote.exe
3188	powershell.exe
4652	powershell.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
3188	powershell.exe
4652	powershell.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
3544	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
3544	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe
2676	Symbiote.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3168	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	Symbiote.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	780	powershell.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeDebugPrivilege	3216	Symbiote.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1052	792	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	80
PID 1052 wrote to memory of 3468	1052	Symbiote.exe	81
PID 2676 wrote to memory of 780	2676	Symbiote.exe	85
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 2676 wrote to memory of 3168	2676	Symbiote.exe	54
PID 3168 wrote to memory of 5724	3168	Explorer.EXE
PID 3216 wrote to memory of 3188	3216	Symbiote.exe	89
PID 4152 wrote to memory of 4652	4152	Symbiote.exe	92
PID 792 wrote to memory of 3544	792	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	94
PID 792 wrote to memory of 3556	792	2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Users\Admin\Videos\Symbiote.exe
    C:\Users\Admin\Videos\Symbiote.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3468
  - - C:\Users\Admin\Videos\Symbiote.exe
      "C:\Users\Admin\Videos\Symbiote.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:780
- - C:\Users\Admin\AppData\Local\Temp\2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-05-23_613be176fd75fe62981b90077e9f5393_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=0.0.0.0-devel --initial-client-data=0x35c,0x360,0x364,0x338,0x368,0x1403bb618,0x1403bb628,0x1403bb638
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:3556

C:\Users\Admin\Videos\Symbiote.exe
C:\Users\Admin\Videos\Symbiote.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\Users\Admin\Videos\Symbiote.exe
  "C:\Users\Admin\Videos\Symbiote.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 47.8MB
SHA256 773856a3c525f22f8675e1e536113ef9134fbcdd94aff65b6ddc3b911b76d6c6
MD5 a8fec48bc88378f1e43e3bfc8ef8faee
SHA1 081e79b3b57f33d497f6153fbfd21d0e63a975c0
SHA512 89cc905a25e5652f370dda39b75d81642da882a51faecaddda0cd8e95c1698fcd4e460eea952d441c4dfc45995e33bff949f24acc9ea493f350cacf79bb8ddd0
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJH4Bka:vUEtQevvqc2W1cpV2XI324B
TLSH
T10FB75B91BBE843E2E3AA953485B182B6FBB17C1E1F35933B1139F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cf84b55809229fe85abbb6943cdba7e3a7c249684dd7aa37e0bea024bd9c61b5
MD5 000165cd5b4633d6eed4f3d35583ab71
SHA1 1a306db43fecbc100b8dd7e67acba6349d4f22e4
SHA512 08ce4ad5ec276a61f8a10ad648a63ad9026a77f720f7092939074466f5a8c5fcadb15b4508fef492d1839f47663ac59664cb860a051ff2b60492b63a9a4fce87
SSDEEP 24576:rwukOW2HNKv+Y96tHawJecXYifCU5uIDvxZDdTx64r3Mf7:rw7OjNB/GgvvDdT
TLSH
T131658E42611D4AA7DC23783B87D666BADBE368FEE3706E5601FDD13428519B00D8D83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 13.0MB
SHA256 6bf01b16f7f7f95e109e240b035913e850d78665f694aa5e19f8bf2de43b813f
MD5 faddf82c44185bbfde199e05ef5a7d87
SHA1 9b1d52cb9d5a7395cc946c98810b93fbd336829b
SHA512 7e6acebab9e2ba77bd7208fdaea60b9f3d93dc56e20b11343d49cc5651b0c6e4dd1991390ab7da650c017f55b1253c52a9691b13a9246e96cef53f5d6d8fa12b
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd23Uo:fQRQyi36YOcP+Lvw2gAf+PN3C4aW43G
TLSH
T1E1D67B57F3B440B8E05ED974CF3952229A357C4A97B192EF258436E11A72ED07B38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 7.8MB
SHA256 4d381623b3de2914f164079ff88c235b5fb728a11b9abbdb5acb49dbdb4c093d
MD5 cb0dfe73b73214dcf588cc73de7c4a0b
SHA1 82d10067a67dd708d1505b32247b02dbb48d93f8
SHA512 0d3d04fc92b71355db5de6791fc501456c045d45757ca2a28f2fa6a1b91012d01a7b7afcfcd1e78309b4b65d06a8e298ab925aef2e39591c8cb759e9f22005a0
SSDEEP 196608:RLIHuWh3j0j/+mwO0D4iEoi4TkxX5iAulTsr9gCQifCMpc6GqcT1/:R+19
TLSH
T130869D23F69840E4E008D97543865332E9B6BC465B25B6EF0AA077562E77FD1AF3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 7.0MB
SHA256 99039b1dea4b41dca4bcb4519aa9c3c8f3d16441e469f64162774b4a097b14f7
MD5 0d1a5b66299bf6e0886808e2dc6d32b9
SHA1 062d6f6ae8d5a0ab9de59f7ff78cd80e1f71dae7
SHA512 d2b0764a7c6d468a48cb6f47e8feb088bc70fc21ba89a18858f76b6f0b785bf8d8ea2e3837e9359404bcdfe53fc3e8794b39daab66230e2c5b52e72be135edc0
SSDEEP 49152:IyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AZK1INkXRxfq:Xm7vj1BDlZOK1INkXRxfq
TLSH
T1EA76BF13E6D872D8D048C075C75A8239E623BC854F2166DF2A807E156E77FE62B3CB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 974KB
SHA256 93dd5fa36f9b9fdad6ff0cf15c6c4ce0a5ef505e70dff248a0f1dbbec08d1fb4
MD5 fb6ce059bed767226d83538a146ac66a
SHA1 b2948b3c4ce225b447480c9b625034585a2e0469
SHA512 15a8c3b9126b981d51bf014bd4d927738814fa389be051a8f4c323bc01cd2e69052213dbc62ae1fcbe45561ec10702d77dc214a2ad28f0563c01b393bba1bb9b
SSDEEP 24576:g687HPU2zVT8hWOcM94DRfraG1r5hPUQcG1r5hucW:P682BT8hWOcM9+fraG1r5hPUQcG1r5hB
TLSH
T1FA254BE372C9281FDC74CE7049403B9E6E14F4919BABF199B0948B87B58C7527B6E087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 974KB
SHA256 393be9ca7373ef6fa9ffb89c5e5a5fdc79270aa334847d6d87889c10ea529f92
MD5 23f26c48dce901186500a5ade985ffe9
SHA1 ff9b08bf061669f48b7b869862e168312c87b2be
SHA512 b98f4dd69bb93a164686d7e0bc398d7ede87d89a2fddb5bca371ef728c54f5d3f4f59a22492c6c5fb10769bd5344d488e6c4229e5843a09f973debfae45f2cdd
SSDEEP 12288:ZWb5U9NwHpeCJ8dS+zjUwSDPTLo0mbbYti6T5rRxnMdvsbuTGHDxsgcqQ3PA5sbO:ZWwZdowSDPSYw6ThMd8zRT5IVO
TLSH
T13D258EBC9F27A518E6C073FB4CF79BC063A19401A55CA97101D7C2076FB79E86CA8C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 974KB
SHA256 f3063777012b1f7f674043b2144ffb22ec8f8047554388e8c86df4682a0494a9
MD5 f2dfa5a9758e7058edb3c58f4ed0e29e
SHA1 3254c67b358d3c96df15ffae5237c9cd78d74740
SHA512 07092d4a152e07912f77ab509f954d274d9c83e55b984afd741d8903faf3fef6cb2d37b2b9299d77bba08a5b4149b677f4c6b85b53e2d7050f7ebac7538cbbff
SSDEEP 24576:yyOfcUkeZ+X+O+h+b+Oem+GEInexPQi1EDX1dp:mxIGYiwv
TLSH
T1DD2548FD0A5F5D83E064097CF7DF1D938082B5B5FA6997A72F850507820ED0CFA4A8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 974KB
SHA256 0b6703d47f3af94eb815b8a8267608fc623f1a9e2fd397737987de82695203a7
MD5 cc6e255dfbc12dc9177df50f3980c7f4
SHA1 4db54a85d6bb4b1be9b179790a351a87e23552ed
SHA512 6798c95f701b7de8d0726aa3ec292be6c2847a3d08fbcaa2e8b08e092830959102a2782c605d194c3dfe7ae0b0f0739b021f8d1dc405bd5626cfca661dd0cd1c
SSDEEP 24576:1us/K/fgC45/X8/xX/X2/y/6SwvfTxsO28det:ss/K/fz45/X8/xX/X2/y/6Zdsl8de
TLSH
T116256BBC333BDE73D03654F4593686E23215EE0BB9B970B29204B04ECF65F57628949A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 974KB
SHA256 81331f8dcd4cf9393e554f08ad6c3dcb6d08c3db048293f670be0a6523dd9e4f
MD5 4a045d22324483ccacb735789418b7e1
SHA1 ef416ecc19834fb66d45258c8908369d7687b6de
SHA512 dd48d741c9ba95de075186aa592db3ad04f9eb80892b015a258bd1a879edc455b35c179060d9637919b3ce4716f34ab7bf5d7d1f7c57400973a5c12cbcb8f5ed
SSDEEP 12288:i7ffWLuONW/odjyL6BAPqxkdnNnyD85LlyD85U8Qz8wTyhkR2JZx6EwhUpEFpSWG:ijf6ueunfM1z0idyTmk2SG2X
TLSH
T10C257C721FA2CC44DF8675B9C1472AA5F61CE89873231916737EC750AA0E3C960E7B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 974KB
SHA256 f7530eb67b6d34bb3da1d145bb6e2ca5fc62014b04a08361e791e9bee0ef6cc6
MD5 98bd673a02879fb4018c7b044ab6b013
SHA1 94cd3836bbd3bdf70c0476aed189b0575a83c610
SHA512 708526fad51fd08b1505fd69189b7d22138eb26e2173ee3b71571d55fa9f5bed7469e9902e10016d13008918ba16d8a10427edc6c75aed87b7a245c28753d033
SSDEEP 24576:urylVEgfB0zKLYbK9cq8T54bWqYKit2cjcAcZc7cEDXcPrigUDRAt4XrkkBQw8/1:T1/yl76W+e/o7
TLSH
T160256BD7EDB8E0ACDEE750307EBF890F071191542A1977C9A09B3D81D868DED064A6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 974KB
SHA256 5a394706f34fcd08828d611f1ae8b05146d64efba3f6c819f81b1e478cbb928b
MD5 13d857d2de3bf2bca4c3f99dd9bdb02f
SHA1 e5e56b9cb69abda653cab8768561919a4ad31e99
SHA512 3ebc05d36ec694f57139b7e2633916085f118e093244903d004790c587096f12191926933a1679c6a9ece240d992235fb85fc44d5d6ed800cadfdc92b0cf4c5f
SSDEEP 12288:Y+lKdpeyDfS80iFmXmSmJmnm6iqmKXz1VyZXjz9IQ94mj5+YoV9QUfRN7Ga8lAxZ:Y+lDKM2djGQqQUfRNack2D+vToB
TLSH
T1EC255C35024CCE51C847253C5CC93F4D9648BE3FB63ABA746256A8B292B15F4CBF24A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 974KB
SHA256 52a068ac3fdd113a3d06fb64c0eecde660f4bfd0d5daaa530f28f99fae28d163
MD5 fd409470ea3b1ba44b7096d7ccb9ca24
SHA1 a141f640e25cea2421c83e9f22c4e77c3d7e0852
SHA512 564ba17f86c4a8dc4bbddd05c339e7ff4749ae754fb338e914d9f8cdf429a2ebf9e923dcc215f727ab803e7928e067e2b84ccef6f00d0e224480ab7a25d77d6a
SSDEEP 24576:48zWa6gH3osyIOnShrYGBkm+Iu/ap/hMWwVj2b1mAuErgKVeeDQUuTtFYS3lRiB2:3zWa6gH3osyIOnCkm+Iu/ap/hMWwVj2n
TLSH
T167256B57758A6CC1ECD2967F9B76F42A87E48DE82B21F345608DC6C13EE22F49970183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
Size 974KB
SHA256 b5bcfe0008dfab946c2c8f3f5dd6d210ab883433e44f8df84fe3b5e32cf49704
MD5 e65abe0ad2274ddbe449c242271bb6c9
SHA1 6452737bf0be2bb914cfc91935f44221fc5a3d17
SHA512 fecf9e812e826668e301c507a13c71cab8d3ef32b89284219246f24ff5fc215318a25bedabcb527353661cce6c9280fc023ba8f1e6a923cf1827c59650d60853
SSDEEP 24576:fjnnOP05tmOP052PRp0vuUSDR3amOfU5jOfU5JmOfU5dkMQ5LC//7Cskt0o+nkhe:zOP05tmOP052PRp0vuNR3amOfU5jOfUr
TLSH
T104256B3B43C894A8D808EDF2E64EA58EB75BDA026B35562C18D17B33DFE546233643C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
Size 974KB
SHA256 0112bee66a5a6141248cba396b2bf8bda42ce5bb92678549b154afff4bab66e2
MD5 3d612c0f680fc2d24cdfe859489d080b
SHA1 05569df53d4d989dddc23b757a2d403f4faacda4
SHA512 59a7d7ad48786055f9c8b5b554c1de478f3600db8b64ffa661174a12b6b5f63b3597d605ada955fd014694b4f32bedf043c09d42cde2a626b64e88351f7d0577
SSDEEP 12288:8Js2RpFg8bhmtz4vBGSKQhEwWPGxi6ltl7DRAnxrP:8a8pFg8bhmtz4vbh75Hinxr
TLSH
T1DE254B2F43EA953BC696C2F76DE59148CABFD197011AD7F1286CA60DCACB853B3D2401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
Size 974KB
SHA256 ad14846ba2e4562ee2144f1d83e30e112e939e737346a4bd4b3492af52b130c5
MD5 e4db2cc7ba335e932304a2f12ff2ecbd
SHA1 84d4f7b09f25cdefe1bf7af48483105afb130edf
SHA512 0e42ff5dbd690f53d920a2bef9d08694e7ff6c479549fcdc757ef6af982d4689e12a4848416c0a0f33658e5a12dbe3bad2749dfdab4448bbc563a3e2cff37ca6
SSDEEP 12288:hNaEJ9bUcgWCk8pTY116Dwii2euXpqD/GrOnPNv2Ms6ROXO4ludlruUypmP:hzUcgWCk8A7u8/GrOnB2jjXO4UH4M
TLSH
T1A5254B6499FB9861CD34ADF08DE817C8B95B8D00BD6637948BE038BA4E047F12DE4DB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
Size 974KB
SHA256 37bcbf6e1248b8ba430ebb24843d835bc1061b12475f79de63bb01a0c2ab75f5
MD5 da3278f3bf5bf2d108cd0dd5e04729e3
SHA1 5c580877de7c1078b10a6b32c1aa6e7af22012ef
SHA512 5cf1a6d6121feab87779b9fce1aec98d414dede1a380a815bb3b75367c8e08060c6ecda81386bb4a8c8334b8c86ecdd0170f85d9bcdd4313e5311be844a0795e
SSDEEP 24576:QwWIkdKtbnrbTahqaZ5ihJRDIRd6IKnDZ6IKmIQJpYzmuSSVKbloKCPUEC:7bnrbTahqaZ5ihJRDIRd6IKnDZ6IKmIL
TLSH
T11C256D9EB1A86D2FCEF6C9779D122BFDDA08EC417C2520792266DA4C4025261F7E7331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 1.1MB
SHA256 609bd805211bdc98b54f8d9c898a8b3be9702831a6141e14f2d6565d760b8e6d
MD5 0a83d0f9af2a9e2648275d1a5678099f
SHA1 853ffdfdb777cfaad2046626af8d046816a60f5c
SHA512 b9534a91d4ca6a44fcc0e47c34c4078527b30b7410c78c1e2689e1d378813784e0f2176339689139e9c9e70491e7ea449ca84ca30ee3320ba465d746c59e2c86
SSDEEP 12288:pgx3vvWZ68WtnZUh2dKOZWlIgA3XC1E0G1zi1NhAaLUEeam8qugNvoWU7JMZmO3w:pI39MTmoxwLyG1IqCn
TLSH
T1FC355A76B3EDCEF1F1634432CE5FE994B86BDC1B24D7684AD322A901349CDA84617893
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 1.5MB
SHA256 50ebaf0ada89417e6eac8fe789dbb2f29a6227e188fbff649a63d408ece9cc82
MD5 91e2f8f0b981decd8d6f376e693657ed
SHA1 6c17813fa3f6db8c3dca61351159fef10309a4d0
SHA512 b9eef1950e73e0e66cd396c564dad62d26e648e29d69dc26ca122046f767a5f21b89287905662a8a66b18be176e67738e021940c20efc92ba3ee55d7483a6134
SSDEEP 24576:ITWaLl3z0zDZ6G7x8lzXotZeu7SdRgVKSzpj:IT1Llj46GSRi1ARgASz
TLSH
T19F659EE0DE5C15F4C6BCABB79C26A415CA38AC8336EC870F6A721BC50E2751F5116B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
Size 974KB
SHA256 8f96b425e88f72a4e019f1eb6ae392fe1dfdf776ea8114db87d2417af394ebad
MD5 a712d60f9e2842e83c0f44563c314230
SHA1 aae9de7dc88dd71bd75c44074b1611257c58274a
SHA512 d3ec819303b4c3ec9d2b59af657f4f12dc95ada6daf019e74fcf560681f327b08e3619b2e9ccd6c91e57d033488d3d2120c8e0bd9e051569a0438d9c53075f0a
SSDEEP 24576:b9NXEx5iYXOp8Ud0JXzNztmAcKdygWXEp:+DNztlcKdygW
TLSH
T1AC256C65C2D94761CC536B34DC4D3CAC509B760B38194AF9F3B2C92ABA57640EE0DAB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GRAPH.EXE

Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE
Size 11.7MB
SHA256 7e2a16f8d1d730207fc9eeb2e36ddeef60b895d000f689eccb08014a5cce883d
MD5 5a6966e0c79ff7c3e68ba2203bd509cf
SHA1 b425e6d4541fc5ade8e08d1438a51521b9dc41ac
SHA512 a97ba0ff25d4b9db9b44d8bb2520ed5c35a9db6aa4c6b5ab79d9b202877be86d3de4b45d754d24a344509a34e0ac5d1b73d67f3ed6f03736858312e5efc52c8e
SSDEEP 49152:d/njlklOSOKL96XevWtNEZg7+a1F7hl8nlGYxK9anf6SdGXTm42BTfzHhd6duNYJ:Bld51R7pl7obhnYRHOBMfW3Un
TLSH
T182C6AF52B3E580E5C466D1348D479A37FBF1BC0A1D24476722A4EFAB2F336606E1E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSOHTMED.EXE

Path C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE
Size 2.0MB
SHA256 6d90372313a8f31f56a7239c82b287028c976b54f3832978a8487d031480baee
MD5 f564539a83210b7af2ddc76a7f71361d
SHA1 2db6ec7e6208c0265ddc0897aa41e383f937700d
SHA512 8742731117c4d0da3dbb5d476febdc397eea811f410ad578a9bb86cfa393161a6fa04762adfd387abf3ce30accbea4b09e0cf26ab01ce8c3426a7f20307a708c
SSDEEP 12288:6i1UIgCHpyWsugBHHne1qohBVroemFnQpwm9uxu5XsmNJ+EZgre5QCqRkqdNEx/h:BHpytugBe1qaBVrKFnOx99ka
TLSH
T1FB957C2207E955D5F0A16A360838BB78A63E7DA305349C5FE567A20F1F3DC994CF4B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfBoost.exe

Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
Size 2.5MB
SHA256 3c43afd2d2801e0aef3a5479b169ab5e6588bb280b7a9b18c1998915ce95c5e7
MD5 a4759dae1d44420d1791000aa7ba5d53
SHA1 0d16f4fa8df52882b5654a32a2f59731f8c5d8ce
SHA512 2fa139d055d0fd4a4b141815e168c3a8bb72b9938f5773ddfa50baa8217f5cdff7dc3026b52a769b5e3efb61ad2da738e13f76897f7ab61f199a976c97f00b32
SSDEEP 24576:KzWj8PSeWygmNWZcb1pEKdUnHBt95t1nulgEa+KO8Lvo0b8ly6zyuZtos5RLUkUQ:KuygmUSbHDUnDt1nuba+P8L+zos5nN
TLSH
T165C57DB8ABE8C5D8F07E4534B471C835E5B3BE563AAB825F00748D6E1E3358C8E55722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SELFCERT.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
Size 4.2MB
SHA256 0d50d53609b453b0ced7d171a7cb7efd2fd9268fda9409e0261b42886501c951
MD5 6006369fab4695c78a83987ba709c7f4
SHA1 922a7aa2cc7d045343f669b69d85f701aebaca7e
SHA512 016475f048754ed63ab4c4a8c2d7a01455b84d7491c4a7d8a31434dc43da8ebed72fa7a8c378911834e835dc60b1881458a103c1e991fee87cba7d95068528e6
SSDEEP 24576:ERQNifrqWbooT4Xn9o6kaLch0G4bR+LU7Wod+UvW+8lGLEp3/L95zqb/2P+qp2xs:Es6G2lEe0G4N56Yi2
TLSH
T19D1618A57FE843F2D1264D3CC91581F0AEBBB8049B368D3E0ACF93175C2357055AA6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETLANG.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
Size 1.1MB
SHA256 8905a81f132d78ef1f28ea9be3c8df82fa4de7eb7d841856ba3e7db87554ced8
MD5 58cc572a172605dea30206c9e8ee6f4f
SHA1 d422e9a213f2ba7a1eeefb9d1b772a94ff34f613
SHA512 fd940c9accd986068519d5304a5c8c96938515ec4874022b2a011b28a072ae87f7e41f0a4ee5b9c3dd89364a630fcd61d875fbdfbfe81177dc51c7f43abc7f4e
SSDEEP 12288:UKHkUl3y8zVht78stDA8v25zhKdeaXVUvTa9hwVcgB/T/m7RbWTTHjmFhdj6JfoI:rkUl3yS73NzeTzB/m7RCPjmTdVI
TLSH
T1F1356C31FB1B964BDCAF4932C8F957A7410AED825810C26271B4721D8A3DE56F8F3A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
Size 1014KB
SHA256 49601f1d0a8ff15ae718451704866b2c78749233e908659079af18704d41d34d
MD5 8539f8d539135fbd4ce213052d8a18ad
SHA1 10eafb653262322ff635bd61b40a9edc588a6ee8
SHA512 280ba872588bc9db27a4e7fd14fc5c31945a673f67aeae0484239bae5509a0132456f4b9099c43f6cc0d7b5f5b13ed84c9c06e0e9e6b9993499d9246d477cce3
SSDEEP 12288:cwZHUEdbvE15F22x2zpaVr9ZD+RDoxW+RjPphhXXgNWKN7JwcptBCCEbrqCguttP:cwR9blP7RDoxZkWKN7JrtQCEP5gA
TLSH
T13E257C15233855F3D74A783C2E8487AC567C134F5961ABBBC1BBC7B24AD9A01A3E8D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DWTRIG20.EXE

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE
Size 1.5MB
SHA256 7ff5e709ebf8da161120fcf097ab3519b1384f7b22f3423e7e9fec81894dfdd8
MD5 9db27fca95411ad51ceabf21e96936ad
SHA1 3375470122fe8af64a085c46990e5f8b751ecab4
SHA512 74941388fa9e481217b6d6a69c4422ea4724c416e9591449e18b20e50f8b799ec40ddb1590c5ce7395e221eff95f44f892418cbb606568f495bdc2a8ef5b5128
SSDEEP 24576:TltdwqaBCCoDfQt12qjD7KJ6Wit+A6sV/5YqygsVrHb:T3dHsCCqyD1P7iq
TLSH
T1C2758CB56A7504F0F12DD17EEA65B9FCE927B5722C4883A7E098C1062E6F7208CCD953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLicenseHeartbeat.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
Size 4.8MB
SHA256 358306a68dcbe12c2978d95c6fb882cb833325806f9b5ad6682000829b953feb
MD5 fef6a2fcea207151f48d054e6f395a90
SHA1 fb0039815125e4b0c9a3db7c232841dc2ccde788
SHA512 979f62be533229267808666d22a8ddac01d03a453651f06ae4370e4c70063de7633370812053706ca73d45cae5875f8f34191a002fdff6e2165e1e213f35d127
SSDEEP 49152:4nEEGYQeqzzj3odEFQSSEfWfpYrU98xjqrATup:FpQVN
TLSH
T1E936391427E880E0F5FBE2B49AFA8979FA7A78D218749B0F1151865F0E73740CD38766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Program Files\VideoLAN\VLC\vlc.exe
Size 2.8MB
SHA256 4c6cfd11ee2269f483cf112a6fed6c0c2adef7ad1f5bdc3fceb5a00f90cde1a3
MD5 0dba9235f1e9097073bcbccfc9778cc9
SHA1 0c9c767837ee31811019e6ce07970981cf1d8e66
SHA512 96638e6b08761e8f5e49e7dc40f5ffcb04e4023d9133f8b69643128c82b0377049512a8873ffd8c926bb4cc6118ad30c9d8f38c9ecdbe7eee010d3751c79031a
SSDEEP 24576:be3xAibB85Z1HrWtB8z1L1O6J75zzz3zzzozzz3zzzzDgo3R6WjTeUf1I8ylOlWf:+xAibBEZ1LWtBzkOPR6M3dsdpdq5
TLSH
T123D59F17A35344E9C53AD13887979B336734F45D1E107F7B88B4C700AE62C4E66AE3AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5evybzij.zll.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5evybzij.zll.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PEStub.dll

Path C:\Users\Admin\Videos\PEStub.dll
Size 59KB
SHA256 5aab76737f2d9f6e6d4d225b12e1123918306d86f1ba5e0f629f97fd3f9710d1
MD5 f2ce20254995e4bf4d3cfabdbc83bac6
SHA1 f66dcc83217684ab697d7b4fb9e0e7efe9857ee0
SHA512 15248c1631347d9544c6a24c0352f97842f2f6003d99b7e81ba37bf1f295dc28d9ed3dd790eb76e91ef681b6b889248ca1a179bb6b21a8b4bc34a121e666df02
SSDEEP 1536:MgPxVyuElaILcRe/XLcRe/ifgla76mQ36OhxwHKoMxxHX97VAzSVORg5:MgPxVyuElaILcRe/XLcRe/ifgla76mQT
TLSH
T1094361B2675C8D60D42A50350D0ABE8CC798F94BB73973F3109AA61646B59C1FBFD1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phosphoric.dll

Path C:\Users\Admin\Videos\Phosphoric.dll
Size 868KB
SHA256 bbbf9287cbac6a35d66cd0ac5744298a62b1934cbc8cf2292e3f1efd43ab22fa
MD5 fd08d3089294cd4a2615c03ee25e9860
SHA1 8adf7c1d71483d8d168c66df2c60ff12e4324dc6
SHA512 733ef480584ef4bc9e2128a9a4e72e13faf361e758faa27f93a194c1bbd58b822db9432a3e52922120c1d7c3e49642eb7fbbfaf4f983b3305a097c78833f37f7
SSDEEP 12288:SPUT7wHIS08djtFeDqP53oDfGV8KxFQLbWCe5w9:SYwoS08dj2qP53oDeqnY
TLSH
T1DC15D737253C41D5E5B99439A91A3E50FEE0BCDA0336BBB790E444871F26B90A5FDB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsPInjector.dll

Path C:\Users\Admin\Videos\PsPInjector.dll
Size 21KB
SHA256 dd93e8ae016728ffcfd0dde17e67768357f909d9b09e73919838b394960f1a8f
MD5 55b589afd3f824702cd484e0b7521a00
SHA1 aeaae629061a552b38dcfb805e3967dc223beab7
SHA512 71c933a19bce1a875a88bdb14dd7c19850a6f7f105130b79b1c360f1f7b70053f63db815bc56c2af37311686be478fb677ff4521fc06aaa9a9c96f82c254cbc1
SSDEEP 384:aLkOXUH9XtYPAYYleHSRg2d+Q/WQGrEujk:787y2DQ/WQGr7
TLSH
T184A24B4763B501ECE1B6E53ED6574623E1B830455324AEEF6BA1C6AA1F329C0B03E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Symbiote.exe

Path C:\Users\Admin\Videos\Symbiote.exe
Size 781KB
SHA256 dd822836313f979e21c86489d4b2a95a68c258baccb3abdce736d298a2c7ad14
MD5 1cf9e78bbf12f12a633e10b889aba3db
SHA1 a18ee2e1bfa93d28bb9da056aff424b8c0984c08
SHA512 2b2a8582ae67073f8604ca84248dcc4bb00f0e5b98a29003ba7e6bf8e74b9eef07a6c4607775bead2322c1269f07eacad64663d5055b044a6cccaac010a74546
SSDEEP 12288:dT7wHIS08djtFeDqP53oDfGV8KxFQLbWCe5w:BwoS08dj2qP53oDeqnY
TLSH
T14C05C727243841D5F5B99439A91A3E50FEE1BCD90336BBBB90E404875F26B90A5FDF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3fe224f6052b84f423c0e6ae9e21b9e8a3bb44d90833dd3c0b590cb17940309e
MD5 0080de11901ba392b730cf8bafad7dea
SHA1 d75c3b26145d52130416d438c6a2c332d9ab5a6b
SHA512 f0b24c017b140c9a5fb24670c26b4a43ed8e93bd17bbd79b442e34e7c7de701d604ae02be5f374af4f648fa5b3d817525ce674de6d09a46457c60b0f84be3221
TLSH
T12E218933B7ACC134C8D9117A108CAD01B1B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/780-108-0x0000021DC2260000-0x0000021DC2266000-memory.dmp

Download

memory/792-489-0x00007FF605D20000-0x00007FF6066AA000-memory.dmp

Download

memory/792-309-0x0000000140000000-0x0000000140464000-memory.dmp

Download

memory/792-0-0x0000000180000000-0x00000001800DD000-memory.dmp

Download

memory/792-8-0x00007FF605D20000-0x00007FF6066AA000-memory.dmp

Download

memory/3168-34-0x0000000002B50000-0x0000000002B51000-memory.dmp

Download

memory/3168-26-0x0000000003070000-0x0000000003071000-memory.dmp

Download

memory/3468-87-0x000001E634A60000-0x000001E634A68000-memory.dmp

Download

memory/3468-117-0x000001E634FC0000-0x000001E634FCA000-memory.dmp

Download

memory/3468-25-0x000001E6349A0000-0x000001E6349C2000-memory.dmp

Download

memory/3468-42-0x000001E634CB0000-0x000001E634D63000-memory.dmp

Download

memory/3468-41-0x000001E634A30000-0x000001E634A4C000-memory.dmp

Download

memory/3468-17-0x000001E632820000-0x000001E632830000-memory.dmp

Download

memory/3468-16-0x000001E632820000-0x000001E632830000-memory.dmp

Download

memory/3468-73-0x000001E634FE0000-0x000001E634FFA000-memory.dmp

Download

memory/3468-72-0x000001E634A50000-0x000001E634A5A000-memory.dmp

Download

memory/3468-53-0x000001E634A70000-0x000001E634A8C000-memory.dmp

Download

memory/3468-44-0x000001E634A20000-0x000001E634A2A000-memory.dmp

Download

memory/3544-326-0x00007FF605D20000-0x00007FF6066AA000-memory.dmp

Download

memory/3544-511-0x00007FF605D20000-0x00007FF6066AA000-memory.dmp

Download