8dddcbe9a374426472abae9dfb85f80eb9053cde0099f414f10ebbd2f3d44f8d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260711-psep2sct5w
SHA256 8dddcbe9a374426472abae9dfb85f80eb9053cde0099f414f10ebbd2f3d44f8d
MD5 b3882b4793ac992af9aa6d13e3ffa7ed
SHA1 393e9b3a7c97e621d92353ced9648ad4da4c845d
SHA512 5b0f2af2bbd6f7f734e2d4ee65a5359ba5a98f086b4d91b5eef255ffb46e8c7b5a4f69e32f88d0db97c8254e11bbdad4b13fcba0d6a9462c44794423e92eb27f
SSDEEP 49152:FvmHGcnO2EvU/bMvo/SHEif5YL8NnjSzjNCWTPp8N7s8SJGtDmg27RnWGj:FTvUko/SzSj0I8NiED527BWG
TLSH
T14E1629ADA6DE00C6C070A4F4CD065795E2F2F864833149CB15E81A1FAE7FEED4E39664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1256	elevation_service.exe
2400	maintenanceservice.exe
2924	OSE.EXE
3120	PerceptionSimulationService.exe
5880	perfhost.exe
4344	ReFsDedupSvc.exe
1360	SensorDataService.exe
4672	ssh-agent.exe
5816	AgentService.exe
2660	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4a861434e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000932d4c53111dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000987f2cc83111dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058eb26c83111dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000387043c63111dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005337d0c53111dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5816	AgentService.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	ReFsDedupSvc.exe
Token: 33	2660	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2660	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2660	SearchIndexer.exe
Token: SeDebugPrivilege	3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3248	2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1256	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3840	2660	SearchIndexer.exe	97
PID 2660 wrote to memory of 4100	2660	SearchIndexer.exe	98
PID 2660 wrote to memory of 3308	2660	SearchIndexer.exe	99
PID 2660 wrote to memory of 5788	2660	SearchIndexer.exe	100
PID 2660 wrote to memory of 4484	2660	SearchIndexer.exe	102
PID 2660 wrote to memory of 5840	2660	SearchIndexer.exe	103
PID 2660 wrote to memory of 1528	2660	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_b3882b4793ac992af9aa6d13e3ffa7ed_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1360

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fc129bb873ae036f412a647d01bd42736ccf2253068f4b5d4ea56e71e5b01b2b
MD5 d7b412f66f747787a35348deafb666e5
SHA1 944004a104046b1a0a1acee860445321c7bf9f4b
SHA512 4f7c1a1cb806f2a542e180bf9dea87a11051deeba2582a751603422183e8ee2d65524bcc3adee5d7162be1d166768c246910646c7d05081470e3b44e3ca9a3e1
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnXDmg27RnWGj:A3q6sjBED527BWG
TLSH
T17ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 450c341dfbe35f01159c4896f9ee9b6840a762ba6261e1b909323f1840bff43c
MD5 0ce94bc5addbf2c3eec70cf2ae559d4b
SHA1 54c59e827b0a6f6149f9d589671ec721349dd839
SHA512 ebb2ccf4724b6dc5f00b687e5901df47a1a4feb89d8161f9f6ab18b641ae727d30171bb4074aac6c0578918b8ffafa897e2bc1800c64fd34baabc70a88b3e64d
SSDEEP 24576:+XYfDtczAEsqjnhMgeiCl7G0nehbGZpbD:dtc1Dmg27RnWGj
TLSH
T115650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a1e1058920760b50f2fd561ab6cda583cd4371ec964049e69007a6ab4f625c79
MD5 103f3d47534c0e7fc06e29eac0f9ce3c
SHA1 9fa0b552a735414ae114acb7d5539a76a2e74875
SHA512 671224adcafca38f55a9341e47287f4bdf409893e1ff340f4341fd9adb460ea993f9a748502027c0af2ff2601cf23fceaa6683278192e6a705faafde73bf954f
SSDEEP 24576:Q0Le5ji0hmxxrMrsqjnhMgeiCl7G0nehbGZpbD:QPji0AjaDmg27RnWGj
TLSH
T1CA859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5fd230d1c0933b2c3c836874ff4f44d41a135b5886c61274eca288a8acebb097
MD5 72ee415dbaad7358b50e11b16ec31318
SHA1 50e60968d156dfe295fe5e20b97b1c07fa44397a
SHA512 71dc2cf4582ecb8fe06af2f8b2a7a60daa0f8fa0de715f498b2836e32a3101d5174d66d3f082e45b19ad6866bbad6974a6765cf991cfa6b65a121c634691bd0c
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyuxsqjnhMgeiCl7G0nehbGZpbD:e/ezSC6vUzPveHjy2Dmg27RnWGj
TLSH
T1CC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 72ff85bb29f017af98c858b424fa29d75a857f5873ee5bed8500b8d9aa98aae8
MD5 568e1844ec15ff937ffcd8fcb149dccf
SHA1 58c0cdf8e2e73664cca3804aae9aad08f3a7300d
SHA512 846c9608e56a326793394faa2692814246b0b7024a12daa6ae01d20520f683461f49265e44f6c8ebe7684e64b95edb7076f7635292c26e46b3d67f3ba89e62d5
SSDEEP 24576:VVbqPb88hv/l+YosqjnhMgeiCl7G0nehbGZpbD:VVO88hXl+9Dmg27RnWGj
TLSH
T1CC559E66F5748331D073C0BAC5D2AA9EEE3234425B318ACB1246D76C3E676E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 07bc7da7720f7c99b1e25a593a9bb29f7d90527c0d9138842c02dd2796c63542
MD5 d55cd4a6d107abfd7a7411bca5764619
SHA1 b5d52422ea69a9b07464b379b9d91ab10b3eb546
SHA512 4b5b35e625895a6926e9d4f6f33b79b11c7cba2ddad0e8bd2fafa1e98d6c6ccca770a01ead598a688ba4bdfd8486b1496667780f57dfe0f141fc1e3b007c22c2
SSDEEP 12288:lLvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lLvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BF964C50CAEB7609B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f3d5082d89b59bea307ee7618b4edb35a709a9c639da0ab105ccaaa29661fe4b
MD5 b971b831fc1a9d2242055a4085c801a5
SHA1 3176b540c5452f6a33aec5846e7ecb842b08e08a
SHA512 889dd824a3b1221f298b084fc726dfac20feb7625699491967829bdb4b524d57a2ceccf05d3622d9af078501c4be5c4029f3fab42cce868439a6d82b9dfb16e2
SSDEEP 12288:reBNUbTVO86UgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:rJIUgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C265CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d0950179a9fb13e1f05c900931d5caa2c3bfae56281bbc56f267dae7490980d0
MD5 1e8677a7b98695560e17e9e05c3737c2
SHA1 2af25847e8a175d16494dca8f93bb77127808a45
SHA512 aff946cf822f12edc51cc7e0944bf1d37d8d25310e2354880eae6937aeac2673de6837941d8b7075cc2ea115ec1c4d7ff52aae9fd971db4c016630c33206b454
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THf:gQvGAdlCEL8c/DRNw5CVD527BWG
TLSH
T108266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 bf39394fe0b72299bd23b241fee56fa7ec6a0edbd47ff8070c8485b48717e980
MD5 1b5a1844ddef584dbaa48ec5273a8061
SHA1 4687c475985701561b50138c0ddf472eb59a90e6
SHA512 c75dbecafd72206d00e54483174457e516e95edbb4c32b941a605f681936ee834a0716af0cd3bd4ac4a637610d3b6e2d7c6c153896a438d241dec20c7b4b945f
SSDEEP 12288:gAwSfxL/2Dc3RDLLmt0LDQewsAjmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:10ewsAjmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75eef8e694c51433ba305408abaaeab2de51382ef8986ca98965256fb4e5cb76
MD5 879097b05d8762b7fb9996769af20309
SHA1 78753e9bd3cbb8852aec08f1e4d60f4622f98a77
SHA512 fdda466ea756d06f5bb69fd121c599ae33398d7bfd648298d1bcb0ceb8818eb456409d4489f61cb4cb48fda38e5592b88b1c497d28d7d4927da7249985c9a68b
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHCVQBWG:BUEtQevvqc2W1cpV2tI321B
TLSH
T10B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 183e89c72153577993ee74431333e98b1dc851b1c6fa4edc7a648e54de898c8e
MD5 a9b8a6b190d11b8b74ac27d60a3faedd
SHA1 a2fd3ce8316bf3e85b9f2d51fd435d1986f105fc
SHA512 4c31892c9124d7a37e7679b5041c806d344e8a0d05b8897d9a781641fb47f8531cd78f01b070e59e76b13323a6f1e3c9f85bfe3c892978de70827d2556479e50
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zKDmg27RnWGj:BoquVjnmRD527BWG
TLSH
T144D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9b96c02addb9e300f1c961fccfc7b0e9ccd4e9f161178cf00c44a8cd05c1574c
MD5 f5f508df801c714e610a9a9b1e12078b
SHA1 f4d8528726cc393f9d0bb2f49454cd8573a1e987
SHA512 e7a5b1710743b53eb7fa57c6e7b2b492cc940038b50b875c7d7df40efd78eb03fb8ddd89357084e69ef464659b8b61c30149b81d2822cb0894d90705b4517567
SSDEEP 24576:8AhGL3IFoiwtA5l7S53NsqjnhMgeiCl7G0nehbGZpbD:8AMUFoiq5hDmg27RnWGj
TLSH
T107359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ebbf92876b3df374dc3863100c4145e122ab2f332323c66f2351512826251cbf
MD5 18b64e6f89f30cc35a827a63c0f8df77
SHA1 7226bcb19ad1183c1c9f5f2956c8e823ee95fe6b
SHA512 07d13d1f979bc58f970d9f565364f030351609f25454a48cb7f3add2ba1445ab97a44daac32602615901e7d039f45cfbd872676352dc270ec8d44e8b0be3daaf
SSDEEP 12288:Wmw5HEjsChNVBFgl0WDm+CRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Pwu4OWSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13065F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d6839a8c9c26281818ceb246699fba96e8a2f944889334811cd93ed8f3bdc359
MD5 b8883630db757ca12a52e2cae591553e
SHA1 2cb9f6e911e7f79cb0973688f153603a9e1fdc44
SHA512 7c8f4a9b4d38a0a115cf1f4adabea0c4f6bf4a5df6e9756a0edd7876baf3964f0c5ccfa1d6d82735614c45526d8b37cbdb9680e07ca365e1083190472573237c
SSDEEP 12288:ieZ1Iy2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vZujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1945512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a7cbe10c53127ab899004b734dcbd747fc18e11db307782180c668926072168c
MD5 4a9ce4245268aacaf8051b837cd8736b
SHA1 b79b8345158931e857692e01d340d72abcd42a04
SHA512 c7245f335f391f3f6a0e21672b578eeffd78886aff2f593ec635b75643e674b4cf6ec7e2fa76148a6a86c1ddd8de23acaea46073e55e24e1769b813e26fd4529
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN3ID527BWG:rQyiKa/X+PN4VQBWG
TLSH
T18C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b8792afe9b8825d052a438085d8a2d8fc67fcbcda5a19df258617c2dad3be18c
MD5 4ef12d1eb03f6b9a1a69a034838cdb5d
SHA1 5b765599dfdf204e6792ae6b49bc489bcbef2ee1
SHA512 e6b8beef6cdb1a143d64b431da1ef03f552bc6b53a570169171d8e330d9598303b97d2fa345f574c1218af398b50208716e5563ad48af6798a053d035f05f30e
SSDEEP 98304:WQRQyi36YOcPbLvw2gAf+PN3ID527BWG:dQyiKa/X+PN4VQBWG
TLSH
T198667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ca91c7ad9ad8232ea5b6ca3b51961b009d26deffe4dd38ed24e3681f9a1a6956
MD5 50d7ad3c32770daf7245de5961b296b1
SHA1 498c5e95703e005e1824fa94a9ac4c27c2241ba7
SHA512 4a078c16c8ab71d536e10c7ebd6c094dcb3ab53d9327824401ace45f0003993b27909f1356b438a92d34659c0c9cf62e14bbf74fc165bbff3419de0969db47fc
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0TsqjnhMgeiCl7Ge:068Qg55nhceWu7PNU3/aDmg27RnWGj
TLSH
T1D1B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ed82007d712e9616154c63b50dd693ea3bcafe0d1e3d129f25deb8a3bb217f99
MD5 51510df1d675446b6e709673ebf03425
SHA1 0a69caa46f78b69586b8ca90ae3c954c451866c1
SHA512 e61fbb8344ddacbc25256ad154b1dc87361bacc18168898dffce356c1a67b572de66bbd03fe765c34d18419060d6f3ad6797face5c9a556619affd04f5d38be0
SSDEEP 98304:My5112gYy5azzVvt69nLKnhZTD527BWG:NLIHEWhJVQBWG
TLSH
T1B8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 46a774e0f750b8d21e9236ac8c088ea4bdbd29555df34682e5f80d542eff70a0
MD5 7bf8a6cbd6953b63ad49df0c987d5eef
SHA1 7a0785b732eca94d622f2e3dd6d04ff064894d9a
SHA512 235eac730462490e240d2ee97064b18bc420ecd61b13e342f885f38050c6f93b962df3d67bbf31a116f9750c4a0fd111bbc2c42dd02edeb214da872b05db778c
SSDEEP 49152:81hpsNoJpF1A63U44CwH7R4x8Dmg27RnWGj:8mifPWRRD527BWG
TLSH
T14EB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 262671da6b987f8efa7473760f65581e0a450978a639157c5338761a5a41e301
MD5 6655964684f2b8d722f522a8202f38e4
SHA1 e2e31c695f9fb191d99bd7083b176cfb8e59fee8
SHA512 46179a42a25dfc728a14d89ee3c78296205ac44d94c3d6ca83987db035abd676ada7b70664291a2314a56b9d82df50c79bfff582593afe77f160f6ed35939ba7
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHqnDmg27RnWGj:E5dKii61nD527BWG
TLSH
T100C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f59982a6a3f24224e480dca82f0bacf79846fbefe6008e4c1ff7dbb895798cef
MD5 07940158be335cca3763dba4bd21570e
SHA1 f50c4204a83206bc285a29cfc108d4a4fc068a72
SHA512 d4b51f9a084f0c11e5028a6155712b3122cc68cde8c0c6721752a4602fb9d6d4e1a6c17e67f56d434be6e6ee6143fcab56773d0d0dc98e7a33b46fb29edff64d
SSDEEP 49152:9htSn8EApI0fig3giDn0AP5wgDmg27RnWGj:sX2imphND527BWG
TLSH
T12E95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b0ea1e610b18747f33d35e91a355155d47121b0ae02533cb1f38547b7ab077d5
MD5 6ed99317e65cb1c53b1dc3fb1da9de58
SHA1 6f9d53468c98f372d3ccba4b72662de33e6bba85
SHA512 2d2e0cb4fc445748ba673cc88fc0c401c834d15c3845c14815b0394c43a6637de8c8acae437a628833a64508d240b529fb4469e54e0579f06f0e4522024776fb
SSDEEP 12288:dHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1674523BE965C41CBE62648B5C3E5F10EAC073E5BE92004937A577CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c760a6d5b720ee37e48e45237ff065611782c83c8e1771a269f4f7dab8afe9b6
MD5 b4b727e1bae822f65fa8c683b898a3ea
SHA1 19de340ad3a06566583e3d6cd11d99b07a22b89a
SHA512 9b40f8d5b715dc52c5f58ba173c29a99449a77b2041c2b2bd701223f71dbf2b4d3f5988b48849f326c27fb881a662ec3a55a52c855794e2ebcd919c9f1660bb2
SSDEEP 12288:taXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BE965C41CBE62648B5C3E5F10DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4e337eee94020f736711ae932e45c41782f0f2c4c4670778dfa34425eec3733d
MD5 4a2490d4bf8cc7b1da118885977b5a32
SHA1 ceb40d5fab8677fc9cfaaeac590d30bb0040b100
SHA512 1bfd827959ce75ed833cba452a789a580f58cb9025500c1a649e1deccb733d1b9e71706f20c83496ff53a19e18c6399181f0671ec76e64ab29aa0973a3bf5fef
SSDEEP 12288:QYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 589c49d7e0620b111d1809f8ecf03d0b15925a55ff774bb56b7fd0f53fe3162a
MD5 a21891087f58e61033e5bdd140d2b8e8
SHA1 2b7e73e4486e8407198e72004029c234886e87d9
SHA512 fdc918481c3a6e4587fa00aa5f83688fc303c42a122bfdd779aa7c8d33471f93e5bc42bb19970f002144458e6ee59faf5a5c225ecc73334194705ee23c4572b0
SSDEEP 12288:dVtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C445236F675C00C6D83685B4C2F5E11DE8237D96EB30059B6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eee722b43b2cf86c8407410aa016cc875ae47f0091c8bb372f8ab2a556655eca
MD5 82b0f9c23fb8c697449c6e003821f702
SHA1 9e369ebd61f07de1c0e8d97beb7c95d4e83331e7
SHA512 a7249b608cd36d4147993a608e025c62064b32a27ff9d6dd1df79b29053f55e48443ceec9ffe68673d758eacdce955044020dcffb8e5492d9801b81706e61eaf
SSDEEP 12288:V1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B54523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f63ce7a546aaf3e798aaf10506000d4f8a4195b867ae35d0b38c304e44099c3a
MD5 ca6a0255ef83afd404a3442d064b7f38
SHA1 6374e8d7b3bcc497f760a55c364c16801ce6a7e2
SHA512 c8daf649cae9711a2526d92b5336f05a6b4e76c4319918060a326907b2622014b03ffa54c5ebc090629e2c2e619c4391f73b923fd76e7bfce7af1edd994d3468
SSDEEP 12288:g+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 57254bc4caa7c17acd62a65e84ad50a3c7cf264a07565d1b85c4450e2218dc98
MD5 642930a89197e34328055e91215ea496
SHA1 bbc0056497b55a69d0e3d53c28e17cfc20b556b1
SHA512 14b4ba1cef9abd90d25fc1edc7a2e5c2c5f64ba835471845f88a03c36f6d6593d872510d82b80dac4b9b2fb718e6c585b8f99e9e66f9dbd7288262f030797062
SSDEEP 12288:nCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BE965C41CBE62644B5C3E5F11DAC073E5BE92004837A67BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 468b7d7bc0c4e2d7fbf964a8087ce8d8764f7141da6ae16d9d39e7ffb96aa8ae
MD5 c829b6c64ea0af1b707258330d9a761c
SHA1 05a6680508e18e0e5c188a61999b4306ca20d087
SHA512 b6b992330d24f9ee12c12633ae57655471671c9bb55c13a518f26dc0d3721a4f1b16114aec46ef666c271e9f1d8d2dc8adcf62844a0c4a5ba3adbe3858d45b9a
SSDEEP 24576:lZMRzFVSO6sqjnhMgeiCl7G0nehbGZpbD:lZMRzfiDmg27RnWGj
TLSH
T1806501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bf5a01a6d890ef5950b2178e1b25317ec206a788e1d8a6c27bc5aabc5e198f6b
MD5 5011931cbddb8449119cc3246529ca5d
SHA1 3e8d81c3d06de17a054427a480b80e033725f030
SHA512 6ec3521d033c62982549210b44b12f54339050c93f9e0ca9494ddc9de19e34586aa6646114e197a54b3e3f8a4a79dd39e54e0df9bf4b7809680f57db97f88f93
SSDEEP 12288:dzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BF965C51CAE62608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e7d75624eca04e88248717f92cbad0d05ab5f188fed0d16a7ea46ff2be36f823
MD5 8303186d96c14f2d099c9825d9e755ca
SHA1 7a7d8032abd6329029dc8d93faed32204027f8c9
SHA512 fa2e490f1e77dde9b64c4b23b256ef612e3305d0607bcc08f694b1cc4b9d8d501b2cbabc05382b40f2c9ba831849d60e214d6887fa3a5b84b4b075d4fb4f4c25
SSDEEP 12288:9/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD4523BFA65C41CAE62604B5C3E5F15DAC073E5BE92004837A5B7CB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5edd694a98dba3729d12e0000b228f839cd3e2756323acbabd1eaa28d3297dfb
MD5 c9f8414c9a25db1c38f9e3e54be59b9d
SHA1 cafb236a2b66511673fafea80f4a58fb82dbe4ed
SHA512 3a1771d494367d960de05085aecbc8b99a9902728ef253356d9956ab1c1252acdb76c1b3f3b0328ae8b21800d3e22d7fef99578e2f4139f158f8d18fd7503f52
SSDEEP 12288:5yPz5L82Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zy2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11255125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 53ea55904fd2236470da4218adbcd05f79c1757632b26ea3b5325e4b46d95b80
MD5 719ee0564022088ffe281c997cc84b63
SHA1 9c0a07f3a856249ea2a9727f5e01e7c2058c00c2
SHA512 6e8b4280fb1cd42ec4dd24ed1c9aa5fd9e0cb242c32ab95b0868b771f1aa4b39ca83c9051b90cf1f14b6cdc21985979e945adc317f61d62bc31655c44cbcf340
SSDEEP 12288:vzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d63ab5c31c071c50d2687169a7cf86bc540c228d466935df0a11ff08b960f49c
MD5 ef016a535968efb7b6cfb80fda087487
SHA1 0826a3bf9f1c62834ed0fb624f690b8e181825b5
SHA512 b146690db7eae765c87c8400714fd91faf70f4ceb5d615b80116792d97572713c1676f993c1b6bcac182a5250ad769e43364bee1e5710fee220fad907ba70035
SSDEEP 12288:hzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BF965C51CAE62608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 323f7e40eb811a09c3c8694628d2fedd9d8916100ecec1fd16b9c90d2c774aa7
MD5 2fb5a353cd623cca7e64c555ed5d8951
SHA1 fc7c1e13facc2a56fc3517b89893686649864b43
SHA512 6849d5dc1d0ee2f433235395a3b343f22f7a8cdfdb483538c3413c6c3b55da726bedeadde92fd84122202423ae0f34e053721b8ee1044f5b93e66189eae82c8c
SSDEEP 12288:9yPz5L82Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0zy2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13055125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 69687c951acbe70578e8441b9ad41573c9ecacaf0bf4817796b8f3594f3daab4
MD5 fd6ebc76d7c9dae73cce1dad30d6c688
SHA1 04b4bd46a6f3a19e1fef8dacd1270e0305131d1d
SHA512 d09c883030f5c790e1afeaa626a73e0ec36fcccdd6019918fd473defb60500cea86aaaec72afe4a1c3663a69f6c68d1ffe3f82e26182ab20f5bcf7d1ef93b00b
SSDEEP 24576:BTDaLl3z0zDIsqjnhMgeiCl7G0nehbGZpbD:BTuLljFDmg27RnWGj
TLSH
T1A06501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5f7b1ad369e8aa3f473eed2a423deb4531557ebf3e72c91a310e9a70f6c130e7
MD5 0ac33fb4c3d848b73a34a01486192303
SHA1 49081a212937f9a59d7a7e4252818a00d2d1980e
SHA512 2fa6e42165505a79946240275fea6bfbda2fc80f182cdc64c0e21394e3a522cac914314e65a0085a2545787ab68fc0d4bf31786ae6a531fe8695bcd92441e2d5
SSDEEP 24576:U3vd9CHKy7GZ8sqjnhMgeiCl7G0nehbGZpbD:evd9CHKyaiDmg27RnWGj
TLSH
T11175CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3d549ee485fda4ed21a919d623206e9c22bbd91df29895bca91b7ea62f317d09
MD5 e78d28ffbc5ce8237e4a1eb226562798
SHA1 1f851eeb6f82434557e767e66cde80688cb113ea
SHA512 512927fba1e66bda529562ada313a237cfcd046da2fdebb419aafaa893d713a76250972e968d081e9254b466bf1213582e51b5b252567f2eecf7afb9f93efdd5
SSDEEP 12288:s4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE965C41CBE52608B5C3E9F14DAC073E5BE92004837A977CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2c960e93b6611099c94048dd9610137e808083f1a7e0c79d76c1bcd4808c74ac
MD5 48017136d8c9c8b02b0a7a8593cfc30b
SHA1 98032ab57cedf88f6899baf2a87efca68f819eb0
SHA512 d1bd29316e49ca456efe4432f43704637e784d0a75e292d6b7331fb6f564aff20b1f81188c68b6fd0c3726342030ce32bc93500c21059454b29c8b65a21fefea
SSDEEP 12288:0WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BE965C41CBE52644F5C3E9F10DAC073E6BE92004937A977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0770e3f086af783155044bdcb2604f230c57d6a948acdde2bc7508c32b546f20
MD5 826e1903fdde89e76814f4927fd8f0a5
SHA1 8a18aa657d6d44f16cfe9a76c49746ac400229e3
SHA512 c00bd2e78a25583b5fe3a31b836f04039a2243ee4702a242500bf0f8d826327dde8b752f5ef81d5c24ce1bfd0a8146206e75a3f9ff144eab6eee900318f89f8a
SSDEEP 12288:mZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA977CB9FAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8f0878bb9b7b18b50feafb91eb2b9b3ebe4c1a7a15d2e4ac6708ae1fcc72007d
MD5 3b1909cedf79043beab2e48edb47d453
SHA1 08bacf5b882abe77f51b45fc29f575e3cee66d9e
SHA512 9b1e7f350ba0a73f428f67d4592913731608a0f6cec427862c164b0f5193a05168bd970f3920d5dc392aa44609ce876973e39da8a08c19c1db62dbed6e84080d
SSDEEP 12288:UzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 24162922f54bc0ac2ca7534db5625f783b86e236f9ec00a4f0bd787716804c0f
MD5 47887afb07e08d6e7aa337f90bad49c1
SHA1 25448497a384685fe1d6f8b856733fcee3ed4252
SHA512 5716800c1d026a768b7d39844a78e725f29b61e3077218a2d6d65c59c431e0985307e929110017594d10e822a8d38a413f3ae6bf087324392b2c69ff30348a80
SSDEEP 12288:y4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BE955C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24684B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 cf1de9d3917d114ce7dc50f5da544d60b6dadc360bd372c914ed0ca9e4753d37
MD5 1c4c71eed992ed0318ec38077ee33a70
SHA1 3c6bc4387657039b6285f4e6892663e06395693e
SHA512 c7b68c53dd30b401a3abb9e961d55ff467049f2e3da3a754e22b60512f368307e87fc3e4b2ee6ec53c9e388e710004d7386211419c3ecedb57a05ae9ddfe1f3b
SSDEEP 12288:GbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BE965C41CAE62648F5C3E5F11DAC073E6BE92004837A577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4ea79f5b90a517da21a04daad67976ace081ba6ac2653632c45f111a0dfc89ab
MD5 d7f00c1e3373efb59611f02c7109f5b8
SHA1 d320bf2a10875a4ad2dbe156e9e425c4ca8d2c54
SHA512 9321c7e338d06ff64b1fda3f959f7a0e0646e0b49120b7faddb08f98d32c87b71fdcffe4cb1b157d76a38ee0e535abde7eb0e30351ec4e25eb27df59468e25f0
SSDEEP 12288:R1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BE955C41CBE62608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14684B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 7a3d047642d80c28db44c5bd67b4541939ce1761d5ace24414832a7467d3e12c
MD5 d498d6d1a7e18c1e6745510bf52babb3
SHA1 16b6aa2e6d6fff4c95f7b6fe0e1a2764c0a88f25
SHA512 abb13d80add4e7fef2371b6862987eab6e61d05e6bac532175f938336674e982311227b4d5c6ecb5372444722f98a155a2626da18ecff2d15aa4d879b2e47e44
SSDEEP 12288:YwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BE965C41CAE62648F5C3E5E11DAC073E5BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 55a1eabdab6f6b4736facc4f73af70b3abd63dd1fd9e5bee983c9a8d6c16ec81
MD5 76080cda15e134df0ae2b9cb5f1378a7
SHA1 ddd9bbf100167906a44ce62ba893c261bdc4250d
SHA512 2c5986b0e592d8494d231db3a0b98d7d556fdd3f1d07a3a8c969d6e2d46641458d84ddf9a52ad589cb77cd3817eb1ef0c8c7e77958bab7142cf14124e3c00284
SSDEEP 24576:qfwvUk9RX6wkyAIPsqjnhMgeiCl7G0nehbGZpbD:6MnYIzDmg27RnWGj
TLSH
T1BF85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4d56b72868eba0022b0cdf4aa67153019549b93ae2cef46f02e0b2d31626ce3d
MD5 5d8b12aa4fa8d71e4d9d84033c720cc0
SHA1 9e3fc96083de7cfeb927e71d307d2b29f83fd1a3
SHA512 d611c1db3f45c5f0ad1d66adf23613137f613c98f977608f9075eff8d62c9ef74701551589b3cf7fa9c7f9fc3d69527492ee2055242a25aca7a670d77e0a392e
SSDEEP 49152:KYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ADmg27RnWGj:xySzPoD527BWG
TLSH
T139066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a0c2882d06d5dcbc381908d8518fc127d1d36895d31a3e17b0b7ec21e7ce8f0c
MD5 cc638d5d91bc2b8f4f1b72eb23dd8f57
SHA1 952b8e51d7fe5761d4e705600c4acb1fa9fc690a
SHA512 72584079882b240685dbdd6fe8c41fb269ec3e7a7ec98aa69fd687f3a863bd5997bf84f7939f684d00621a972ccea78d590010026432b86b402ef6be91c1f6f1
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKsqjnhMgeiCl7G0nehbGZpbD:M47JUQjTirIhCnDHUPfF/QDmg27RnWGj
TLSH
T1D365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 778c33fd310e12d982c6f93d9eceb9212fdb619ea8df89640fb688de32bb39b9
MD5 05654df918c507419ab3e2cc095ef59f
SHA1 80ad66a2dfd213f15ff4be8bf29f93c4ca3d9460
SHA512 2f32a1a937a7e156727ea23e8a3d4a1487bc335c872de9572fcea1e79f5c407063412e9da6ea91da1ad7b3df3c7003f3d44dfe97c80d966616030c5e7237b08c
SSDEEP 12288:3bsfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10655015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 34a206a6085ad7dba0fe0e43af858bf4b34c0512a1fad6759452d646f60a1834
MD5 64c117eea2766a8c6e48a03c2d3190dc
SHA1 b5568d5ffc98af27718f7dd1bf3a9cfc6ed28ca9
SHA512 bb57f23ae05e280375adc1cefeb895936577f02b826993bb14d43d8b897802dbe59d08eca24f84dfbfa71e1d708459ec135346eb5236964c3317ede959577a88
SSDEEP 24576:ti9dUPTf0Ti+A6zLSahL4NYfhygPncLeRtMb8gVj:UdUrf0TiKzLSahL4rgPnQwtMIgV
TLSH
T1B54517417627C68BC6A940321E36D6CCAB707D01FE45AF0773C9873F8476668BAF5292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8b18f3610ee137d120361b4cc0e079aa684394c10efa053f7fe49a4d1c859945
MD5 534598e6755e7b7621badc6ef64bf69b
SHA1 3b06d904a4ebec512571acff37b7eeb0e4d0503e
SHA512 b32fa803ea94a22e83459bbf9a9bdf9e207b65f7a65e3be58e5b5eac62588b78c6d904415ea2dd546387314eb507c1f4fb4304d710c7b84ebd32d532241fb1ec
SSDEEP 12288:Au1RjipH6GVWSAPV+pTUbpmc0UeeJ9STNJ+xPP0pnZtP8s:Auzu170R9wU9MNJ+x3CnZtP8s
TLSH
T1CD551A01A5B7E35FC9FE50370732868DAB785C06B7462B0573448A3C9877A7EB5F2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dafc32e292a180b4d5a18f6408f4ec409604feb2ca648cabd7fa387182a3578c
MD5 266c193a7ca4a4e97ede47ed4cca072c
SHA1 de532813cd475cb0afeec12b8a7fbf665c9cb101
SHA512 525fe94566a10e5ef3e53806629a3e13c9039df33e76e1e9476a88b21d32d4ae78231bf70d323af668c08fcb5a1700d8a72832438fdf8ec1be0262dafc8b0bf5
SSDEEP 12288:A07LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC45237BD34C518AE93609B482EAE12D681B7E669F1004C3B90778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ac21442081ff890459d9494f1b757695deb8215ca4128374dd0bd9cb12525146
MD5 16b4705651b40e3bf5dcd94cb995c2f0
SHA1 02efccd304d61a58a5cedeb6abe073bc9ccac1a3
SHA512 b557f9402ac26c74c2308eaea8769a04b50506cc963535c1f4d4b2ca514f2e65b9ae0673b58cd1566dbcdd02606be0d44bc8c9721076484a3eecc8badb5db075
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYxsqjnhMgeiCl7G0nehbGZpbD:mgb4mBIBhGFeDmg27RnWGj
TLSH
T15E659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9e9dfc42baaad74925a467e49dd094d6b8d3fd6fc23b2ec8ff03c1aed1187e2e
MD5 033034f316447c601d94fbe5ab1366ba
SHA1 4b4e182bea1857da0ec6f1e704ef5de52dfcd37c
SHA512 4a768c3c2a96d19726c8ac08825e6e8a49dff0f12337a273a5570a70cc4f29200e57a93cea71e3ed398e0cc9c27d0fc526d2675d0e118f9ac6e5cb920cabf7a9
SSDEEP 24576:AG88u8FpJqH1bzria7/m6sqjnhMgeiCl7G0nehbGZpbD:T7ZFPqVea7/9Dmg27RnWGj
TLSH
T1EA85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e1a65d7f5f6e129e0b5122315b50ed9a8dcd4604879290d5d5deef9d38d9f71e
MD5 0c4f3c7285781742dcdd277fd0ab1768
SHA1 cc2058f9d8946a60f7810e12a83e6e527006f251
SHA512 ac7adeb2fa9ad4b46217ea4202b38bd9d0b90e9e56a46f47190b6a50a39990cacc5f255faf648d90a4494ef1b6e088a6103f0568d32c31c42cfdae9691c6926f
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSDmg27RnWGj:4G05lO43brD527BWG
TLSH
T14CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4e29412eef993afae70ddc807658ba3be48f75e74ecc16a2dd9a25b3cbe7977e
MD5 050e1ef06e48ef55eedef0fdf725bc3b
SHA1 53fdb316394f928b18fa759afb7513610c5e8882
SHA512 2328e7bb58856f3d8c5464628a387f55c5cf083fcc243dd03c543dc43a2963a5c03c55a8aa621ab5d116669f1ac31f6ace5bb80353e702c50267b8d49698bda5
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnksqjnhMgeiCl7G0nehbGZpbD:Sa5POZ3BJt2pasx2+maDmg27RnWGj
TLSH
T14E65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d0e3cebb0483fdb5e1bd17b1295a1697fb02df386ff5391ca720f7e280e6fb09
MD5 6a34f5370f306f1afe7ac405bd907d8d
SHA1 02353d4b77d4de00d4c2b3d74496923967e231e6
SHA512 ca46dc6baeb227a5aabe85d21928986bf1862ebd953f48ed9d346a162c4478fa20636ccc1f0c211fdde99aab88c4725a6863d7332fa2b2dcfa598ff2cae4b640
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkysqjnhMgeiCl7G0nehbGZpbD:GNc/zEOVHFdDmg27RnWGj
TLSH
T1D3857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bd5bec399a4d75e5f63a9a11afab770872b63b64d0bf809f96e1091613748cc9
MD5 382ae0a45bc8cbf8668e6778d00b430a
SHA1 321d14ca303d820c2cf7f731e0a889f227455eed
SHA512 4f75251db026c6cbaa47ce9516f7926e1279d68946b0c9fdc29f05d97143bbb4cfd7745bc75665e8ebe3e53f344ca5dbfbf291b17577c68f7912d0fdce89c7da
SSDEEP 24576:1TkNvNnaFeYhJNtmZBmwsqjnhMgeiCl7G0nehbGZpbD:1TMwBtOmsDmg27RnWGj
TLSH
T14455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 416180c1d641f4c3bb1c6b2ce73e6a3ae54440a216c1471f7a69cc6d4b09717b
MD5 417acd5f8c9f093c33ff0426bbd75ce8
SHA1 63f04e6e97335e88afa897066e07b9a825acbc40
SHA512 67084d105ec6714d1abcb6249c87cea8f2cdff4d902da852ccb130d3d9e14d1d1b74430e470b5f76e2d45becb6a3869bc96ed86d822e920e114442688732277e
SSDEEP 12288:iHvUrBFrEjwaQOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:iPUr+NQOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13065F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e6a206916f80d9389c76bf6b63797e63231f5d7c0e4ed1768e7931bf928281cb
MD5 62c0a3091b0f35180478ab7198bfdc63
SHA1 bee807656ae7130737029fd1daf75c6df87d7f66
SHA512 300d67d55ebf0fede0afe67ac59c999c8920711113ec7551c66ce66c881e89c63738ace3c471c2a84390b2c1cca1d4cb997f71602df79305b42885c1fc90b222
SSDEEP 24576:4D3FHshBIYQgAnsqjnhMgeiCl7G0nehbGZpbD:4DVHeBIAA7Dmg27RnWGj
TLSH
T10B75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-14-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1256-23-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1256-22-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-84-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1360-92-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1360-295-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1360-86-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1360-85-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1360-299-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1360-297-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2400-28-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2400-36-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2400-34-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2400-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2400-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2400-27-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2660-126-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2660-300-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2660-133-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2660-127-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2924-184-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2924-46-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2924-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2924-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2924-40-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3120-56-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3120-278-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3120-58-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3120-64-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3248-68-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/3248-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/3248-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3248-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4344-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4344-72-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4344-311-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4344-73-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4344-79-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4344-294-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4672-296-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4672-97-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4672-99-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4672-105-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5816-109-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5816-120-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5816-116-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5816-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5816-110-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5880-293-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5880-69-0x0000000000400000-0x00000000005D6000-memory.dmp

Download