7ac90e868e8bce25b7a9463c07d2a48c07ca5106eac5fabeced183f1187fcf1c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 6.0MB
Sample260707-rtkc2ags2n
SHA256 7ac90e868e8bce25b7a9463c07d2a48c07ca5106eac5fabeced183f1187fcf1c
MD5 30577ddac137036ed14729ab0b0a0db7
SHA1 4cc8ea05e262bb6e7716db5122039b71dc0dd2df
SHA512 9d4036b92f32c29910be99a6c022feafb2b9578acb4990ffabd34734699b7384cfedecc65bf86e829132c2c020a670b374e1dc62e6ad3211cefd914b278866b9
SSDEEP 98304:UENX/kO9FYXRMF8UEt3KVEx83W4It859FWarWsHQQbtSR:UE5IXNn6Vk83IWbHbq
TLSH
T171567C13F29641E8D05DC1798B5A9232FAB2BC990F31B6DF065077252E76EE06B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2456	elevation_service.exe
3280	elevation_service.exe
3616	maintenanceservice.exe
2464	OSE.EXE
5972	PerceptionSimulationService.exe
4464	perfhost.exe
6068	ReFsDedupSvc.exe
1432	SensorDataService.exe
1364	ssh-agent.exe
5332	AgentService.exe
1744	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6493e14b9871ed5.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7e7d3091d0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000907706461d0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005c641061d0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2b01f461d0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be5858061d0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6c53a461d0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dae318061d0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1590476978-4004838454-3790292847-1000\{21198AB3-A716-4D70-AAB4-5A75DB34879C}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1590476978-4004838454-3790292847-1000\{17C93FAF-A449-4BA9-9F0C-771F5AAE028F}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2556	explorer.exe
2556	explorer.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3068	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5332	AgentService.exe
Token: 33	1744	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1744	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1744	SearchIndexer.exe
Token: SeBackupPrivilege	6068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6068	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1944	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeShutdownPrivilege	2556	explorer.exe
Token: SeCreatePagefilePrivilege	2556	explorer.exe
Token: SeDebugPrivilege	2456	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
6128	sihost.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3096	StartMenuExperienceHost.exe
3272	SearchHost.exe
2556	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1944	3068	2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	88
PID 1744 wrote to memory of 2780	1744	SearchIndexer.exe	100
PID 1744 wrote to memory of 4732	1744	SearchIndexer.exe	101
PID 1744 wrote to memory of 6140	1744	SearchIndexer.exe	102
PID 1744 wrote to memory of 2516	1744	SearchIndexer.exe	103
PID 6128 wrote to memory of 2556	6128	sihost.exe	109
PID 1744 wrote to memory of 4736	1744	SearchIndexer.exe	116
PID 1744 wrote to memory of 5124	1744	SearchIndexer.exe	117
PID 1744 wrote to memory of 3276	1744	SearchIndexer.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.41 --initial-client-data=0x2ac,0x304,0x2f8,0x2a0,0x2fc,0x14053f054,0x14053f060,0x14053f070
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3280

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5972

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4464

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3276

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2556

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3096

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fd47cd728e296c83b7d97ded321cde83705502504d45a72a3e2604cd0331934c
MD5 a45105133d5f805cd2d85da5174a2417
SHA1 8ca927b4045360884e9fbd755ad6fee468299369
SHA512 be7ad6bebc7bfbc6d5b781954c68a36f69cc7b5ecff66de8366628fb6aadd0239abe8a609e8106f15379a67853753537c4dcb9cddab79238445ca1859f767ffb
SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMuxyHQQNhjrGWSR:Y3q6HjBasHQQbtSR
TLSH
T12CD58D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a6fe4d43206d1e6a759a05cf5c2c8d42d34926895d4a6017289be75e3c9d1d11
MD5 326b5eef717199f74346b2f8fddf0d92
SHA1 04bf68f64c9d0173f686e3f507acf2670e012dcc
SHA512 f4d9564b9a06fc3a4674df0c4daa8786e5360e611b27aaae9929a94c25b15899d5b264af4c15afd85eb6e7f5b2cb415320754665c950ee507d1aebf10cce6a75
SSDEEP 24576:3XYfDtczAn/uTVy26yOJ2bQcshjGAdGWSeqiCC:itciuxyHQQNhjrGWSR
TLSH
T17505012867E109F9EDA78178CCA2C412E6727C554760E7CB03E496265F337C86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 53424a2bc143ed6cf72efce7a9fdd068a78472c2e7c0b7a45ccc42e3edc3bc45
MD5 ad10aad4b70bc1f7a50001e2627781e4
SHA1 ef384ddd5e2ede13c36f2ccb14a160a125623f2f
SHA512 c119331491ee77298134ce557b03ce9dc45e18a2d5ea1c5cd2298bfc7529fbf9a1f8b48fddf1a4f591e897be02718831a6e3f2d27efd738360596f19c5579f7e
SSDEEP 24576:z0Le5ji0hmxirMk/uTVy26yOJ2bQcshjGAdGWSeqiCC:zPji0AcpuxyHQQNhjrGWSR
TLSH
T13E35AE56F6748331D073C0B9C5D2A68AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d14bd6744e9e46b2ba8ef2f624c833b6ece5b36f6558069ef45f981c58c224fa
MD5 4479c56ed10c79116a18320df6dc5a41
SHA1 6aced82e73af85b7dc4a7dd2982787b0124de6a2
SHA512 af96dfa0ece9e559cb6584d6100d2c6663852e069c2c18d483201adc5a06ffb422d0b81816e8e5d73b8b848ad19f4542349a757d5ed98cd978e9196819f554ce
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyuS/uTVy26yOJ2bQcshjGAdGWSeqiCC:M/ezSC6vUzPvxHjy1uxyHQQNhjrGWSR
TLSH
T19A755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aca23ec5f7ae16312b36bd2a32d32c74f8e8049baacd21c12d482684c7a34ccd
MD5 33e13b7b04d7daeae1ec0e5c18fee583
SHA1 235d68f580c0bd0d8e52607e441544dcd361d6f8
SHA512 2c6b0d0b70816797a88a90752b569ae7f8681a2fd79ffb9f7c02aedfe3c1001f74280f353787b8673fe993d8577f0681adfe8eb9659e78d44a974b0df4efe9a4
SSDEEP 24576:hVbqPb88hv/l+6j/uTVy26yOJ2bQcshjGAdGWSeqiCC:hVO88hXl+QuxyHQQNhjrGWSR
TLSH
T1CF559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9a62b7c4eef7734085466de9dcd4bc6d33f788f1ddc5e0d37cc64ae9121e8115
MD5 8db54cf0762c2c87dc11f434bcc937d4
SHA1 d7d33e902d39c8837b91c30a3dc6d4d374691bf8
SHA512 9f4f616f94c547a6300938e19bf942b76bbbf2de1ddb2a26b697bcd102ef2ebc7e36711e0ac8aaf47aa197400d216e207e1a213e9deb1de54cbd2a5f05220d2a
SSDEEP 12288:vRfI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:vRw/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1EAC423E60BE252B6F3F409B08D57EC92D1E83C589C44A9C261C6B355A97ED49F0CF643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 97c75219bc54f29ecf72cade4f9f22f97276b930c6764d23f7cb45f797cf7fe3
MD5 13a42971487b7e4cf483e9ba966a7ad9
SHA1 2af86b3428bdc2be9e25ffff1c5baaeced35e2d2
SHA512 6f30f23ace6452d4dd0e716a0a77d0b0a9faa0dd8e8a27e0abcde38c25fd16f1e8781c98ffd1d9ee0e41ef37209162ab08f108e91cbe055a35155ca7466423f1
SSDEEP 24576:yJIUr/uTVy26yOJ2bQcshjGAdGWSeqiCC:yJIULuxyHQQNhjrGWSR
TLSH
T17A05CF7BAE28FCE2C27A4DB85A91C640D7B278304F51A3CBE165830EDE235D05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6bf478c787bdc564d9f84e0b96f3a8c029d11c8c71c9c7694da5fec286226eca
MD5 ab9136db23984563111738d80454dbf9
SHA1 87f0bb1f63b9f680d4a876d9f67236571b1c3bc5
SHA512 84f329cc8b9845778178a126b5a94d6928458505fdb41c293634790db20d3721619117c43d132831e9bbb0e12b7e09afec2c23588c299018b062d7ea161772fe
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:OQvGAdlCEL8c/yRNw5CdsHQQbtSR
TLSH
T162266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0bbc4b38108a0dddedab3ab65eb7020ac54fa6c7761acd96d846fdc2f779d3a8
MD5 af39f0aad245205d3fa3bfbd529e7cc6
SHA1 965b847f55b6515d4ba56109aeb4ad8d5c3f6cf1
SHA512 47086ed421a91cb466c39ff560d40e5a3c444d9654bcb2e189725efe823556294d8bd0b6e7a020171bb5515ecaef54c4cb863246dfb442cad44fb4743cb1cc43
SSDEEP 24576:rdewsAjB/uTVy26yOJ2bQcshjGAdGWSeqiCC:5lj5uxyHQQNhjrGWSR
TLSH
T1D415E031FE75E036C3BB0DB21B26D716546C7D204F511AC3E3E89A9E99346C2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b869f5ca1d8292cc7326b2fcd34c46280b38a17bdb42a7409572331acd4678c0
MD5 89531984142f835387765af070c4beea
SHA1 126cc40eb24003a12f6ac7c3f10a4ae6708a31fa
SHA512 178a3e92232f8b33d28476be46946ff67c1fc7ec7f49b7a0c32e80fa6859235e0f6551d74cbece697d944e8fa50ef22d4a7b2a67ea484d896ca939be5d0ba73c
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxHbq:nUEtQevvqc2W1cpV2EI32xm
TLSH
T165474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d0883a617ffc5ed1647d70e1a520bc2a28f676f2a40e7a55d686d12464bc2dd9
MD5 56b8f7c3f5ce4dbb7a02b50da3e40ccc
SHA1 04df98daa04fc54fa9c713ef9252bdb682c70f68
SHA512 0f2d7a9b105d78d86283bb845084b105f81d0b3ed2fb67da754285ac1f4946e754302738e8b8e242eab3a72e1f10653e8aacaaead748d97d594d995971d8fc1c
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zZuxyHQQNhjrGWSR:HoqtVjnmJsHQQbtSR
TLSH
T179D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e671d24dd4c5aa6f4ad750cab69e529a7d640870e029e9995d4f32bb6e987b4e
MD5 4e624f8a39964378f9c94a2bf8b3e2a1
SHA1 8519cf0c280455aca49131aae9b191fbc4686a04
SHA512 a0564396d6a7b64421753eb1456305da86d0f6fc308f7b5596b8281ed32b5c49ee574813de6f191ad270432dab16f4b519c370e7c09a76b00f2f82dc75cf62cf
SSDEEP 24576:aAhGLJIFoiwtA5l7S53W/uTVy26yOJ2bQcshjGAdGWSeqiCC:aAMyFoiq5uuxyHQQNhjrGWSR
TLSH
T19F359D81E7F955D4F5B3AAB899B69171EA76BCA95E30C20F2150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 96a317aee8f0586a488f9fb6d97b2a308cdfaed5cab4c2606c34a4ba8e4ebcc6
MD5 2a0f42c11a62b49c1cff4c3eb5e680ae
SHA1 75adcc47b3fbbb63bebcd80875f42765952762c9
SHA512 344e2a37d8c4140c1e13c0751db74e53fd8f54e7a3c16962d28e4920724ead29925bb707df245d6dbbd59b8c8229c708d5af082be958c6f273f12ff25d1bbcc1
SSDEEP 24576:bwuoOWl/uTVy26yOJ2bQcshjGAdGWSeqiCC:bwDOquxyHQQNhjrGWSR
TLSH
T18205F08A37E50CF9E5A641388957D532E7F2BC012A21DB1F13A0C65B6F37611BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e0976519aa00b97d05438a8f9850a2015a16ffbace99398733a1ab5f64254ad0
MD5 138cde5153e15655975320c36c5c6c7a
SHA1 b1a41e8308b7e861074c4578d2891a365bbe23fd
SHA512 b0e961a02d665f3482a31b4c889a36f165f5f89c4f020efd778e487b77c2ac8f7bdb8401384701c4170a166ccb27d0616bdf488d7f51a91ef22ed895c825410f
SSDEEP 12288:mBZ1Iy+I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:wZus/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T17EE4129A27E021F5E2E20178CCE29942D3B13C566B3183CF229553666F77EC56D3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 54f63894dcdaee25a572b0d9f0607ef124e79f1442cf8ac6168d0963bca0e824
MD5 b8345df5e6a966e8620c2dba1141f363
SHA1 50131b65c301981a24fc85a4401936cccb1e60cb
SHA512 b16c9d6ba71b81cd5c458f66c0df0b49ce89d9cf7c28ea7da68accf8513afa76438eed8a98cc3983d6ae6be29fbe624427a226d874ab2d64bfd2bc2b4d1b6496
SSDEEP 98304:KQRQyi36YOcPQLvw2gAf+PN3+sHQQbtSR:hQyiKayX+PNXHbq
TLSH
T17A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3dc1cb904b34dfc3f8ec04a96473165be11b2c1027ec03ccc138ef677236db58
MD5 d432ef1ba3f89d70de670cb095778973
SHA1 11ecf3fdba51c50db9e0780dc7c289975123d424
SHA512 04eb719eef747b5b3dcf1360f09f3c4dff2a7922df82cbf4b414e7c61a428b117ed8794d4d95d43f69a19b4078624f3f9eb4e1f453b7b0a466441a185cc19d32
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN3+sHQQbtSR:6QyiKayX+PNXHbq
TLSH
T147667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d59eed86e7db33679b287f77bf264f22236a4a23772c7215a96cd05f1128fe2
MD5 7775009c3661275527b8c255befb80fc
SHA1 ac60a494d6aad0e6dd4240137c1201e68f1420c8
SHA512 92d453e352fc6be48ef4864cabf7b89739a25727398a3dc5d238fadfbcbda2c7a2e1213be63db394455c4b72df8b64a76206b127da5773a29dc11ca50a358d90
SSDEEP 49152:J68Qg55nhheWu7PNU3/puxyHQQNhjrGWSR:XthWRc/wsHQQbtSR
TLSH
T1C0B54933B2F200A9C44DE1769F4A972196D27C758FE0E3DB815572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0125a18c9a715a7239583d3c879865dead6da29ad4822a954c04a334be8ec2a4
MD5 5ad011008c07a34a1a575c59497e38ea
SHA1 97208521160e015ee97820ddf6eea8b9757dd4e4
SHA512 3df932edbd70715b32e18a61fbfbb917057ab94b0e62b4453ebb379c21f0b11ace69ba461741518538fee6686047f1e4649805da0de84a41d88a8bf6bb9c0477
SSDEEP 98304:Qy5112gYy5azzVvL69nLKnhZ7sHQQbtSR:pLIHmWhWHbq
TLSH
T180167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4e3ad63992b19388e6c43a6a58f6e895b0d8548121df7ffe8733a86add599cf6
MD5 967833ad190afb2ebaf25e572257e5ce
SHA1 4e245dd2afa9bb7c3a7fc528e5c282b2fbc76280
SHA512 964e6da7e7e580b9710be57d2bbeb7586227fc5e3091ac0332eb12501ca780c69a0a72a7d8d1192f4cff57c2c40e6cc41b5e69ebede035fcab819a0d73daed09
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5uxyHQQNhjrGWSR:uu6JmVxd2dgsHQQbtSR
TLSH
T13AD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1f533789933128df4f642e1d6e43d4d4fab7a77e6283509b81861b37256b7724
MD5 af7d9e7524262881e7410fe703951c2c
SHA1 99410d65be4e0d89e6bc291fa27d35f2c0a1b5c7
SHA512 2a30689446cf3e97ecafba4aed550bfbc3df91b4b0e4a478a7517a1df1923dcb6f23b3f49d26dbc663acee95f1009345772385d0395bf593d7265507b46a71e2
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xruxyHQQNhjrGWSR:OmifPbRJsHQQbtSR
TLSH
T10AB5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5872e3cd0ca42aafbeef747d3d3c69eeba659095fa085e8db77c37df27f04ca2
MD5 923c4ebaa068b4757f63f507601b70a3
SHA1 f0f5e15eb5391aeb53a819ede027bdb69979981e
SHA512 26a31785ef1ee7c218c31f0711b0148a21112ba7675563c40ba15892323b3de28fad73ffcb8b1b5a99a2629cbd84324659170baf0649eb5e089fdfff4d74952e
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqcuxyHQQNhjrGWSR:x5dKTi61/sHQQbtSR
TLSH
T100C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6c0553027a6f57ad0e1ccc3262e9a8485e628a13f066a0519fe7d3a585fdd233
MD5 52cd1139983174a639d5495373ce57be
SHA1 9ff1116aa0814cbeeaf1fa1d10399ad7463eb03e
SHA512 ec712aeb7ea65d415cf945e73b855a52a06f195c319a98327006c902bacf03b20fa15b74ec5b3ef899e1baaecfa8e359d750b5aba243db829999aa3201fc814f
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5w/uxyHQQNhjrGWSR:HX2iyphlsHQQbtSR
TLSH
T11495BE13F2D901E8D06ED174C7468632E962BC150B34AAEF0A90B7561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0efb5f171376d0778b27966251e8527b2febac00137554dad444e3bf5cd5d8e1
MD5 11485c8f9706abf38f36414ba4bd2be1
SHA1 25035a89c672a62bacbd4bf9eee0bdea49d6b67b
SHA512 d781b5ebe343bbbd8dff8fcdb2bc764c3da3506fe63106ef80c343a76f42d6080d6e96f70b399d5a8c2b505da7d7e78a879602d01af7b8e0418bd796f1cfff60
SSDEEP 12288:p3I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:pY/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1A6C423E61AE352F6F2F405B08D57A892D1E83C5DAD40A5C372CE7311EABAD4930CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fb327b8e6b2d9dca8c77d2962aa222d4699e6253c7c5d5e55a0047a32e3612f6
MD5 842b1bb3bce1847456a3e3d7ab3350a0
SHA1 d158dfec5c50fdc16eae8cbbf1476de6f3823a4f
SHA512 de4340052ef17b623f5dde7fa6eaf501f9c9e06bc1ddefbf0a2f7c61e14798c1afc78e5e2cc7d607a2b152e61e794cacb8abef887a88f394890b7eb5787168b6
SSDEEP 12288:IKI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:I9/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T163C423E61AE342F6F2F405B08D57A8D2D1E83D5DAD40A5C372CE7211EABAD4930CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b533e97b36834fb7cf6d471d669ff61be5e63d59cb44f47d29a3bddacb1ffb75
MD5 b34be22b9fe76936c5ecc61c27c7f1f8
SHA1 47d2fe3c7befcd39ada53461bb9016db0e8cff41
SHA512 e90e81f9a6940457578997298879ee15663f8ce0fd4e2dece91bfd846a556f7deaf7c9ebad8c6584394dbf45973b75d2cd3a1bd140ab09175b67fa86f71fdf68
SSDEEP 12288:PcI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:Pz/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T158C423E61AE352F6F2F405B08D57A8D2D1E83C5DAD40A5C372CE7211EA7AD4930CF992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0d70d06123b5409214dd1c4ce9da1eefd59171880fb811a04c6620c926f8bf4c
MD5 451bf3b810683b3dc9895bcbf77a3503
SHA1 b35f38f769ff8e7cbe6b2d02d3ba0161e532db3d
SHA512 472f8b8a4e5c9589faf327317a9955a31e7b5532e994312ac1c5233be9e3cd541b9073d8261355d345a818f04d552e697ac592c5cd4d6ebd14eb0a03a9fa0738
SSDEEP 12288:3VRI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:Y/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1B1D423961BE602F6F1F441B0CD53E492E2F43C99EE10A2CB728522065E76F88749FF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c33636a923939822dad1878682100fc5e6b3a120c37677bd1126e9eaf1850c47
MD5 216aa50bf51f9606d7403473f21ebf0b
SHA1 756e89862daae171f1c703b96d0ca957bf8d9ccd
SHA512 263e47a20d9ecbe022f05b2a1b0c37749a9d24d63d01e195ed5cfbe64083a83455e1ea13341202371b9ac158628bc5349d64be9ccb467bc821b6b282805561e1
SSDEEP 12288:PZI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:PO/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T14BC423E61AE352F6F2F405B08D57A8D2D1E83C5DAD40A5C372CE7211EA7AD4930CF992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 4db249360b8715df64a6df0dd52486310cb3b99a5fa02b1e581275c42d120a30
MD5 1e66bf68c33835f129a9be26ed1ff83f
SHA1 ed615b695fe28ff53dd1b3ca593794691216abd1
SHA512 0ea6e02445a6827171e66ac8dd137f12400030cd1e1084063ee635ca57eb5c0fdf2c34305c6da65514c737effa89cd78be312b89becaa8c58c60d489f879dd2c
SSDEEP 12288:qmI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCCQ:qp/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T149C423E61AE342F6F2F405B08D57A8D2D1E83D5DAD40A1C372CA7211EABAD4931CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 376f6e47c26c451adb90ac534a98bd05b3f92c170996e65f444b3e6ebce98827
MD5 24f78c9ff43951228b60444a09739e7f
SHA1 b533e2f6a329e948ae7dd58d5abff9f983d187cb
SHA512 3969749679e01b80e71970180ae4af4f483f2a94b0e27aa4bde14ec8eebfd185f7ca8c52a28718afbca5017feb29fe398b7b15a3f1ce495188951850ad6ecc86
SSDEEP 12288:2SI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCCQ:21/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T188C423E61AE342B6F2F405B08D57E8D2D1D83D5DAD40A5C372CEB211EABAD49308F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cf12a6acf28548eee691216ad87f94c03d527eb4e42d4d3a9c0a2159192cb2a2
MD5 1353f2e18d142c920361f616f774397e
SHA1 00d5d8723ea1852c1a5fbbb74c855558d4815e31
SHA512 624e2863afcdf80e11e6347e6969a5ad63eea568d6e3d23bc400c17cdb0e2a69a73909de9cc4df15c6627b7c92b400113542ca9ee606d987d70b10a2f6bc5e23
SSDEEP 24576:pZMSzFVSOd/uTVy26yOJ2bQcshjGAdGWSeqiCC:pZMSzfhuxyHQQNhjrGWSR
TLSH
T1950501A573A018F8ECA7413ACD569902D2F27C5A4B60C64F13E832675F737912C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 dc4019dc35a0d214fa96849333ae736fd089ba2d81e0da8c32172b51972c8eca
MD5 6d9f17b68b0793bbfe4ae899f24f7042
SHA1 47a594a5ee893304aa8e0fe9aef2948dbe6c0b17
SHA512 05736eb6866480a3361204ad137b8d8becf79aba3a7db64a68e4cad1ba464cd3d8112bd02c3aa96fb40abcc0cae95b055a8e297e56274fcc1673155a99a46c4e
SSDEEP 12288:7rI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:7c/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1A2C423E61AE352F6F2F405B08D57A8D2D1E83C9DAD40A5C372CE7311AA7AD4930CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3dbba4c95c2675dcf63604b8d8e6a159338aaf77b846727572a786f3e3471e60
MD5 2c845da6a0634857b7903e7245b390b7
SHA1 cd17eabdb737a9c63cd2f9e5f85c2a8457630115
SHA512 bc41cf539edb85b3b7b9cea73b97259a76c3748d87c1e8f228e0146dfd34a66348057f050e288d6fbeb04366368c684b3ac4d8da5460eb1b52aee52d0f29c4a0
SSDEEP 12288:aPI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:ag/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T170C423E61AE342F6F2F405B08D57A8D2D5E83D5DAD40A1C372CEB311AA7AD4930CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c94e2463dc5e3446e0d1ed877bf70375b79882980e687141c511d54e108e959c
MD5 80c04f8f955722eca5270507bc22cb93
SHA1 1c41802b4af94ae582bd76be5bdfafbb130f452b
SHA512 7fe5961ba94f733241ca2c7a4c49dfa3f6c580f2bbf185f6436394ee0561df4ef93da0397f7bc3fe87e670d2f2904a022e41a084ceb440b9eff73672f41bca18
SSDEEP 12288:syPz5L8+I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:1zyx/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T187F4015727A221F9E1B64234CC625942F3B57C364B209ADF23A413762F37A806D6FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 52fe4d26c807ebbac3bb265b72d024cf9f19391c15ec9cf3bf2c9e51a2f7c904
MD5 7d7328f8c693e050a886d176efcb429a
SHA1 7610c57e2316c156a11dc5bdda870b2ac4677e42
SHA512 48e2a232f740fd88d643739a9f1389f74d55c26a8f6d377986fa9d9004aad177f464d669d47e7b345d9765dfc0b93d9f8f31543c39450b0199ea8749942f7746
SSDEEP 12288:/rI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:/c/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1E2C423E61AE352B6F2F405B08D57A8D2D1E83C9DAD40A5C372CE7311EA7AD4930CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 31dc7afca1085d46be8d9801b4ee46163571b416537efa1d654319ceb5b7bf17
MD5 b5ec55758e540942336391f57a9818b8
SHA1 9d0915763268144cc2e1d47e93c0ef3b4bce56c5
SHA512 d2f60189442aca75afceef91669dfd726d9c6dcc01f119357890524783fe5ec67587700e29576053f08e4411ed4c79bf6d0bcbbec59f40f898d22d15d6234cf8
SSDEEP 12288:arI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:ac/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1C4C423E61AE312F6F2F405B08D57A8D2D1E83D9DAC40A5C372CE7311AA7AD4931CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 961bad2da0553ee4cd320720e6e27f1916a9a558d49edc57b66b61920dd26b08
MD5 7a1c138d04a9dbec75256b5147d78009
SHA1 60602c364772a521b34d762000007964f056b2bd
SHA512 dbb1939472b9da005ecccfd840d689295305e0e1d92b41ee08da3ce6e3c9fda8ecb5afeeba7c8287f338687fe328b79fb1cdf87ad0011d03730a94ecff827ebc
SSDEEP 12288:2yPz5L8+I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:Lzyx/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T13DF4025737A221F9E1B64234CC625942F3B57C364B209ADF23A413762F37A806D6FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c399be0821a34814ac8f3392c6a8aa874181c9aa2172d794a8aebda5fa9b284b
MD5 849241e27bac543e0c00848d2f185c67
SHA1 234b35e7d2a74d8fb249f0bba94a5a92ccc801c1
SHA512 08fb77b7509a47ea89797f3068e81ce32dfb8ec820942b88a163b5afcbb7829d060e3c88835fea497cd3a0867484792892bb96af3ca424826e06993564ecf5bf
SSDEEP 24576:DTHaLl3z0zDD/uTVy26yOJ2bQcshjGAdGWSeqiCC:DT6LljyuxyHQQNhjrGWSR
TLSH
T19D0501A5739018F8ECA7813ACD569906D2F27C5A0B60C64F13E832675F337912C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 13462c774f3d370ee1ee82dee61ee00368664a7f9fb14239f32f7b51b5cf0086
MD5 59b77791551e760b832456ec34caac70
SHA1 1baadc5e233b71aa963d8f3b2b234e81f4c334bc
SHA512 ffecc3f111e7a565d0b156867db84789015e9272b05733631c1311dca88773815355504a7e138a23c3bfbe0ac918310bac4f9ad091d0f53103ff9664c0e997c5
SSDEEP 24576:137d9CHKy7GZv/uTVy26yOJ2bQcshjGAdGWSeqiCC:V7d9CHKyahuxyHQQNhjrGWSR
TLSH
T1B225CF90F3E410E8F1B79A358D769512DAB67C591B20DE8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9291a3cc2d0a9d81c08403faf34b7413dbea774ce6bae5c69a7a6aa32e38bc3c
MD5 0c24a0b9186ab37a12c0f784802589c0
SHA1 dbc995f4940610818c17561bd8a62d8f6d406f44
SHA512 c995f1074246ebc74b9bd27db6ff217779aae41f14e23859d105c605e56c9cdac4ce06a1745f7b3fa78b46082c30063aa2a3860a7aa4e657cdc39519036bbaac
SSDEEP 12288:p8I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:pT/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T130C423E61AE342F6F2F405B08D57A8D2D1E83C5DAD40A5C372CE7211EA7AD4931CF992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 83a18f03aafad829b6622c318352bd9a8d096b6e6d4609cc08ee7d97346f3ab1
MD5 12b4ea4defcb1a09d3c7e4e880eb110d
SHA1 d2a10582516064088d319cb5d576018588e5e73a
SHA512 614053cce58baa37e4085336c3cf5884a6bbf91f7aab68d330707881b991bbb33e882aa8cde80efc2d387be253e6df6ad44b61b1c670ad8df2eb5edddcd98db1
SSDEEP 12288:jeI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:jR/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T16AC423E61BE342F6F2F405B08D57E892D1E83D5DEC40A5C372CA7211AABAD4970CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3aaf802cd018cb846a040aeb851bc6f942fb0b487d27e1d2ebe527855b65817b
MD5 6639ae85a983ba83c6d592324366c9ea
SHA1 8107ff19150febc6fc72dca5d4585d6512d0cfe3
SHA512 9ecbc67a5dbb9074b09bc04273966c243e1047fa2b0177348b39657de12943d71b6dc3601c695229e9167a12df5709fd725c51518f9734794ee522604566b746
SSDEEP 12288:21I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:2K/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1E0C423E61AE312B6F2F405B08D57A8D2D5E83C9DAC40A5C372CA7311EE7AD4930CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3a70cf0784bc807ed3205bba53b08b50a1f0751561b90ce5e4c0d16fcea50c99
MD5 33dfce7119836cd5d62d10e95aa70853
SHA1 7d85456bce33b77aa6d8cd063e39893dbf42d026
SHA512 5b0bbb523acab286e585d38b836f3ca980adf7d4eef74c93ae55f38c2cfb7bb1bde827366fa452b949764cd3ad37f84ea394c95912e5ae81e157b5245277b59d
SSDEEP 12288:nrI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:nc/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T106C423E61AE312B6F2F405B08D57A8D2D5E83C9DAC40A5C372CE7311EA7AD4930CF952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 26c303622c7a782f4dba6302627569ef595074525f85cf7b6da141b3d28ae997
MD5 dcad413651ca4c461a8b6266b2dce8ad
SHA1 bcbd33c44b3e0374bcf28873258325a384e22dd5
SHA512 f3a5676ab4a5d5a79beae430b603d8a4a8237b72d784b05e823c9dfcce9fc3577537dd9f1fd493c1b704a4179451ad71431492c5184a788635c76257d94527f9
SSDEEP 12288:f8I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:fT/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T1AEC423E61AE352B6F2F405B08D57A8D2D1E83C5DAD40A5C372CE7211EE7AD4930CF992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a3e3a943afc49a28e3d92b5b5b0dc95cd94a8c740f5dc45a801fe13532a64481
MD5 5466dc433ca874be67fed6add8c06625
SHA1 6677ff973e9a0af3cb3f6461619f56271db06d20
SHA512 e208e59ca28cb036b86aa0b4ebb09b2b443f4d85b4f889e33e2c10a090f254920a76313d2535beb8293938974552a1487b617f2479e2dd1cff0c011244cddcf0
SSDEEP 24576:4fwvok9RX6wkyAIQ/uTVy26yOJ2bQcshjGAdGWSeqiCC:gMnYIYuxyHQQNhjrGWSR
TLSH
T1D435D029EBD844E5E1B7913C8DB7460AF2B178691B31C2CF129A536D0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7bd4bec9f39087c5505a8eb5ad7880b6daca680b6f2f343e90f27bfe848682d2
MD5 8985cf2130a36b93c3f3ce41fe556e8c
SHA1 4c93a49d789632f44946d4e4626175c4714862c4
SHA512 cd371b279ef3c9ff6c22f04b3933df92f7b0fa1ad826f2e484e816aa9ca4adaf5d04a0812febc8be5c453c6bcfe6665306bf5cf3301f797ac5c596a1bd9d6792
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fuxyHQQNhjrGn:lySzPesHQQbtSR
TLSH
T151066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 67ee29f05aab161c0df42a1941335c14a75e83c67dba0bf14d098631a011100e
MD5 214a93c6c0acafc2025ac24b2d244586
SHA1 d9543b3bcdef62ccd4c19792f43480eb5ca052c3
SHA512 55b00d6e61ff1c18a5379f8416582350749dbdc7f320f19bc9a29a6ace6e5e9fb618bd732c020b9b8a711aa02c0d98bed97574a59f691bbe520b534738672e4a
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYN/uTVy26yOJ2bQcshjGAdGWSeqiCC:W47JUQj1irIhCnDHUPfF/vuxyHQQNhja
TLSH
T11C65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6decfcfedcd55dcc2b832998eb8f372b982defa8330683ff9cf2a0ff92b9daa0
MD5 8b09dea31ac860fc511281028c90974d
SHA1 51b856d86f947b16dc96ffa5cf22a98485294a19
SHA512 195cc8775b03c3df37ad5909571f0e9579f7d69d96bf15300b42fe79bf0ea423e688080eb6c6e56fe83e39ce535d7ffe2737717a421252cda76de50694642210
SSDEEP 12288:+Nsf7I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:ns/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T109E4015AD29402E8D0AE1175CB569A41F3773C659BE0D3CB62C0F13E1F76A846DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 7d9262bb0455114540453b505fe47255400e0f781ba89d0e28b58f161fde30f5
MD5 3e7fd31b945733c4db0dbc77284284e6
SHA1 b1d7bf56318080e620ecb31e41f9df0d1800a418
SHA512 0f52e0901b305bce8ea6f05cb587278a0e4f8dde83ad1f369af18e4f5a78c09bdc41893074f238b51a8ae6f53f2519ecc4a84fa0cdcf2f2674b4fd3626fff74c
SSDEEP 6144:vsBC2naU1UxcotMxqKiA/PHVXcR6GUSGyI1B0ZDQuyKwiOikNWzcuI/uPikd9Q+:QGCJGUVj0Z8fKwiORN5E6kzrFJiasTn
TLSH
T16345F6107666C74FC6AD80725E33D1CCAB707D51EE04AE0773C88B3F9576658BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e6de9b2ce6c71bfe9ef52c9bf9f978b5f51289e2f153b31ede0a5ce0b4f4db63
MD5 edac78ed2ae42402343251ebdcd10f16
SHA1 e13be655d1a24b0acb41f7fe30cea37a378e1877
SHA512 e503233393119a65320f364adb79cc4e9166cf11b88aa590944a9519a8f060a5d834facf696a96232d5ebc69bea0c80c9a97d297cc44473fccf420b79e251585
SSDEEP 6144:J+MsLUczPVARY31GbUuKVbmBtMxqKYtMxqKDQ8Y2O/A+246qjB1DMWnt6bYPqo:J7cztEbUuKVbmH8Y2O/A/46wMbbY
TLSH
T17555EA406137A38FD1BB607207265B4DA764EC07B749AF22B3CC453AD86BB55A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 244B
SHA256 7d4a417d9838b9dfd52ade434406fa45bdb0aa736abb4fb2339c819d2683dde0
MD5 5d241a075279ba80495f79744be78dba
SHA1 5ad7e630a87fbb308964821bd359ad27c47ccc29
SHA512 f584a556a85830eb790674f7cfcd72e28b15289851fb3565cf720e81fadeb51c74baeccbc90ff87e13801240a8b2227908c210c6938d2ed87cddfe8047356699
TLSH
T113D02B334A0925AC205D4454324495C24540004CC12432B0D1970181320E4D0235FF09
MD5 SHA1 SHA512 TLSH

Submit Download

a6493e14b9871ed5.bin

Path C:\Users\Admin\AppData\Roaming\a6493e14b9871ed5.bin
Size 12KB
SHA256 e495391524a01444230dfbae74230b8842f0378cfd42fb529e4d8fe20be1ddbd
MD5 47a29f77c063c6b9193cbf00c8d5bb38
SHA1 61f5b510f845147a09e50f18cc0cde070c189d6e
SHA512 440b7a0b5631e2953100650b3b84ab2a5e04fd13f31eb1a63c7dd78a650756bb23831b51809dc186e0363e6d977bcc83ebd63cd283b1dd1ac8f933154f966b3a
SSDEEP 384:/+WLZyRhlk3miicqNFM0KJXLSJTHgGX78:vLZOhlN3pLDF8
TLSH
T16C42CFAB0917AB9B4784016FB21CB1FE55A6DD845F0DFF442939E20CB22EBC22697171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 6fc414fb8d314be4359475eb44cde438a46f13d2f9395a27de79b9a1f5056e32
MD5 fe5b9c374c0d131a3ff4efb2461ce288
SHA1 f4ccaaf11d772289ed6de45def4c6d85914a00e1
SHA512 e41fb7d3d34338887d7a72a048540ae302d9f39db28ab7a53ccd16c43fb6cfb4cd9a38df65f3ff1298237ed0827c861165a282f247b70422373f5259262fa2a8
SSDEEP 12288:YM7jI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:5E/uTVy26yOJ2bQcshjGAdGWSeqiCC
TLSH
T176D423A60BE656B6F1F415B04C5BE462E1DC3C689F00E1C3B1897355A97ADC878EFA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 68731623110e91dea3c223c7b2a407756503b870f201ac665e032ff1971aceba
MD5 b04c69d6ad2ef3d4ffe014e33656a6d5
SHA1 88f9352636468be17fb93d32faba9fa2e15a3bfa
SHA512 080c65e17d19cb57708400fd1001a3c07311087c5c493efa183c9b719506eac8e7876d863bbf2b43cce0753d0bba6239b32bce866aefee751f564f2893ecb24c
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYS/uTVy26yOJ2bQcshjGAdGWSeqiCC:Dgb4mBIBhGFNuxyHQQNhjrGWSR
TLSH
T16F65AE1E22E802F5E0F9D2B8CDAA4417D6B278161731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a4af63e8805d7584a90deab0d58b02fad57b90d9a7727b3810f213ed25efa4c9
MD5 a7b242e85025fb29763124a50353de9f
SHA1 f6fa34dd2f19b01ae51d4434060ed569a022a8b0
SHA512 41423723423220b7d4bfbf075521c2851eaa36205d5cf8697ae9e26ff39dd69e86c598f6d792f329cf77c92199b57dcb2156f6e3f77548f8d3145077334987f6
SSDEEP 24576:0G88u8FpJqH1bzria7/md/uTVy26yOJ2bQcshjGAdGWSeqiCC:H7ZFPqVea7/6uxyHQQNhjrGWSR
TLSH
T10935F16567E102F1D4BBD13889824663F6B2B8250364EBDF07A88B511F33AD51B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 24a49f3bd6d545d5f75af5386f2c6be192abfa4446bddaadee5d8d886158afbe
MD5 85c99a369958df054341232cf6a56466
SHA1 31bcf6c26958815e496ea9a8dd576edbf27dfe72
SHA512 dfac2cafd1509bc62f0dd598e1ef0137bf0a8993c0068c9e34c82668dfe42571c3cc8128310537d7922565fb78ef072add58adbd403718185368b4a07919cd61
SSDEEP 24576:rPUr+NQZ/uTVy26yOJ2bQcshjGAdGWSeqiCC:rJQhuxyHQQNhjrGWSR
TLSH
T14905E16F22E918E5F676A17C89828609E77178621711E2CF02D1817E5F77ED8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cf11b4f53ba1edee8ec46b91a159bcfcff262e05fa66bf7ca6b92bca9f59018e
MD5 49005b6c69c301e0433430460f03e21e
SHA1 cd8b494c4e58e1cc5a9624313572f1516c7489d0
SHA512 6411edd56be85112ce38d1347ef1140c15eaed19eb724433fbcc773aab6e3180b71553cc0aa408eeb673478a2ffe15a374e5df1af5c1479633c523163c59f59e
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRuxyHQQNhjrGWSR:KG05lO43bDsHQQbtSR
TLSH
T1CCD5CF6E62EC11F9D1BBD17CC9C64A0BEBB23815033556CB02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 41d2c9e505d6de7e5569e90878bef82523cd92a6b446caa80f49cb0de949d032
MD5 bbbb791c678c01209b7288ee5ebb7408
SHA1 71d80d0638738ed53e033d10204b622d8bc32d2d
SHA512 7df20090c7bfd74e6166461c0ab0a4be16f381e31ab01c9e859816836ad6bf36c5488fc74011804f0f7bdf10deb8d6403c8f8094085346ea3911fe235cd619b7
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnH/uTVy26yOJ2bQcshjGAdGWSeqiX:ea5POZ3+Jt2pasx2+mpuxyHQQNhjrGW
TLSH
T14665BF5EA7F801D5E1B9D17CC583861AF5B1342553319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8eec8cf47a1f47cba5a7f81521b4cfbad57d3f22b766e5377c9b51426c0a96f6
MD5 6adc9f725a0617bca2029ce60bfeae17
SHA1 e71fbadd947b863b4b77ed26fc5d2130c3a7bbd5
SHA512 c7bc41936d5d11acfce41c16ce528f4be07d8b18abf49b61e63b0d96226312bd87724e35811b014dd795cfaa097a1976547b29f77d356d3f0f223434a6b7906f
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkF/uTVy26yOJ2bQcshjGAdGWSeqiCC:WNc/zEOVHFauxyHQQNhjrGWSR
TLSH
T10E858C5623E901E4F1BBE1BE89779546FAB17865173086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3c5b5eaad7a358e61d60a192f454807d070b0f5714457de3e58381342f36504d
MD5 b87499500afd7c48f896e8234d22c684
SHA1 1296d17fd96d986d6bf71b18608750ed4bc5afeb
SHA512 c1677d001050be5bf7fe66a797bae03cc04265b3d419db42788852f0ba8e09afa7bdd4ea6158848d564bca84af8f8e199e80d9f5d925e97ab5ccf8d98395f11f
SSDEEP 24576:E8kNvNnaFeYhJNtmZBmV/uTVy26yOJ2bQcshjGAdGWSeqiCC:E8MwBtOmluxyHQQNhjrGWSR
TLSH
T11E55AF6E7AF806E4D1FAC6B4CD238512E6727861073293CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 c1ebc2d5b5508c71a4cdaf85b0f3f4cc58b1d4192aac324c43b7db0b9aa0d823
MD5 eb550c816dc891be71cec047875be4fd
SHA1 a05abfd978f7b1b6ea37f1f0f636524eb92e00cb
SHA512 33c64a38029cf5aef262793d63dacce07d1ec9f1714e4521ede90c4593ee6612f113eae71f10b378c2f37ef10d4e13194fe440fff4de483f06ade465129993be
SSDEEP 24576:rD3FHshBIYQgA4/uTVy26yOJ2bQcshjGAdGWSeqiCC:rDVHeBIAAwuxyHQQNhjrGWSR
TLSH
T12A25E17EEB9900E4E57AC1BCCA538906E7B138A9072165CB12D481B65F6BED47D3EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1364-165-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1364-126-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1432-323-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1432-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1432-114-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1432-108-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1432-169-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1744-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1744-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1744-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1744-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1944-319-0x0000000140000000-0x000000014061B000-memory.dmp

Download

memory/1944-19-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1944-13-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1944-24-0x0000000140000000-0x000000014061B000-memory.dmp

Download

memory/2456-47-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2456-321-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2456-31-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2456-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2464-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2464-73-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2464-170-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2516-338-0x000002799AA80000-0x000002799AD0B000-memory.dmp

Download

memory/3068-1-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3068-25-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3068-7-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3068-0-0x0000000140000000-0x000000014061B000-memory.dmp

Download

memory/3068-238-0x0000000140000000-0x000000014061B000-memory.dmp

Download

memory/3068-8-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3096-524-0x00000286D84E0000-0x00000286D8914000-memory.dmp

Download

memory/3272-369-0x000001BC03A30000-0x000001BC03A50000-memory.dmp

Download

memory/3272-407-0x000001BC14710000-0x000001BC14730000-memory.dmp

Download

memory/3272-364-0x000001BC001E0000-0x000001BC002E0000-memory.dmp

Download

memory/3272-371-0x000001BC03C90000-0x000001BC03CB0000-memory.dmp

Download

memory/3272-370-0x000001BC13F00000-0x000001BC14000000-memory.dmp

Download

memory/3280-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3280-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3280-322-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3280-162-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3616-65-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3616-53-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3616-63-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3616-59-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4464-88-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/4464-93-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/4464-164-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5332-137-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5332-140-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5332-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5332-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5972-84-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5972-78-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5972-163-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6068-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6068-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6068-167-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6068-339-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6068-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6068-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download