f012b3b665e8fd9776222c54121884aabce3d086e35ef09fc5fe12784816ae14

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260721-vesmmscg49
SHA256 f012b3b665e8fd9776222c54121884aabce3d086e35ef09fc5fe12784816ae14
MD5 9fbe2f513ebd9b4ba46d4c0cbf4787ce
SHA1 24e617a8a38bbe5a2c747b2792fd575406c398f9
SHA512 d2bd040718c216da34033b54ac675b84f3e260c4014181f352f4f9813c327d405cdcbebf1088ad2d85bc149a4d1df8d31cb14f97affd139064eff8915db87b86
SSDEEP 49152:cvmHGcnO2EvU/bMvo/SHEif5YL8NnjSzjNCWTPp8N7s8SJGB6ZU6CENlc7dpJLrf:cTvUko/SzSj0I8NiU69CEN6rV
TLSH
T11D1629ADA6DE00C6C070A4F4CD065795E2F2F865833149CB15E81A1FAE3FEED4E39664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4144	elevation_service.exe
1036	elevation_service.exe
1708	maintenanceservice.exe
2852	OSE.EXE
4768	PerceptionSimulationService.exe
5084	perfhost.exe
2948	ReFsDedupSvc.exe
400	SensorDataService.exe
4140	ssh-agent.exe
1284	AgentService.exe
5148	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4b8e1f0883806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008308e7b33119dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba9212b43119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c20450b23119dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000093f318b43119dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b199e3f43119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6e88bb43119dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caf618f53119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1284	AgentService.exe
Token: 33	5148	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5148	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5148	SearchIndexer.exe
Token: SeDebugPrivilege	2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2200	2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4144	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 2652	5148	SearchIndexer.exe	100
PID 5148 wrote to memory of 5036	5148	SearchIndexer.exe	101
PID 5148 wrote to memory of 5100	5148	SearchIndexer.exe	102
PID 5148 wrote to memory of 5636	5148	SearchIndexer.exe	103
PID 5148 wrote to memory of 4060	5148	SearchIndexer.exe	105
PID 5148 wrote to memory of 4308	5148	SearchIndexer.exe	106
PID 5148 wrote to memory of 2716	5148	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9fbe2f513ebd9b4ba46d4c0cbf4787ce_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1036

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1708

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5084

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1e6231df73625dd38e274926b7ca616fdf5691b05af42be1aeebcbb298003721
MD5 c78eb4f14e9e79f6870dc9b7c1a833c6
SHA1 f5193555a86a47ee6d237cd3d9b6aaa35d83d23e
SHA512 2f7c36a07eec8387833ba51737b24d934bbe1e54f1b09d043aa3638047589d3a1ec8675ae8122a09017017e5eccfbe7c04a6866b46055b106d753b012512c905
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnD6ZU6CENlc7dpJLrQWd:a3q6sjBo69CEN6rV
TLSH
T1ACD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 eb072c94e7399b900f6835471bc921a778e3ad25effa399dea5bb894284c8978
MD5 091fb664b741a8730643ea5c7d6c07ab
SHA1 b00e29a6cff640e898e4512dc6a9c41aee41e6e4
SHA512 43b096b750818a4683cf9b9330d146c63e6a836e43262c93351cbc18972d2ac2d1f07d5c197579b4aa35d0bdb54377c0666f3ae43999d556df0d94f344e7a5d5
SSDEEP 24576:GXYfDtczAP+L6VMRCPU6CENltmVVdpx7fLrQWd:ltcl6ZU6CENlc7dpJLrQWd
TLSH
T16065F22867E409F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c155d937e70cff5703bded58fe7cb8aaf5302239144ab25e0996407cd8355692
MD5 332ae246b86c335103cba566466d66bc
SHA1 6a6ce12d5f1be304ddebdf0d254c7fd590fdd2a7
SHA512 9eb1d0958f9a11688f732fac61c628b493367c63f80869997d682b0911f9e499b78945f8c42a5c6144c93f8e7c4bd1f2ac5c7ab8f048fadeb3bc0d1d195926f6
SSDEEP 24576:m0Le5ji0hmxxrMk+L6VMRCPU6CENltmVVdpx7fLrQWd:mPji0AjK6ZU6CENlc7dpJLrQWd
TLSH
T1DD85AE25F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dd3faf7bc5ec98b0ec87a0145c7781068e2c36dd0a5b1b38bd8c6ef84c754f8f
MD5 2d0a0af55def700b8c50fe0d6180b7a2
SHA1 1f3d53d55cf9dae935a2570b184e5b52c1e0d1a2
SHA512 32d169f061249ca8347c466b6b28455b4a98e14686e3c3d604679b5b302649150e1ad02595044d576252d0d5cbf5da46002a08d373aa7e28ea9db24e398065b6
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyuG+L6VMRCPU6CENltmVVdpx7fLrQWd:r/ezSC6vUzPveHjym6ZU6CENlc7dpJLL
TLSH
T10A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 683472926420c95fd92e1181febe44f638529a7370783140691692f4d9b6532e
MD5 65cff5d932d2e032a14b92bd874f905b
SHA1 9cb6560a7de88aa285fad5927d328eccf059fe16
SHA512 257d6b50dabe65a3ee8422c61dd366dec4d0b6ca40c24382742696d60cf2dbcf742c4e5e6bd0e6a365c62536313b4ca3f547614520e7d612487eab5643629a14
SSDEEP 24576:9VbqPb88hv/l+Yr+L6VMRCPU6CENltmVVdpx7fLrQWd:9VO88hXl+d6ZU6CENlc7dpJLrQWd
TLSH
T1AC559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 45de52d5c64e923138c073e0ad56c7561fb1bd7994b805398245e8756159e413
MD5 db6f8cb2c6162a657524602543cea560
SHA1 29bbdd58ee1186fe30894575d683959cdadef9c9
SHA512 8fe1d048b6e6da0fd32a83d35ccdb16f506f00f94eee5b86e5f64f841c9c7f07a66e4b7f35cee25bee0c60dbe1f90b1b107ba38e1959da7d86cbc4a34dcc69b5
SSDEEP 12288:0LD8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7e:0Lw+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13C45233487682D52DBF80238E1E691F1AD6AACD55B00AD1EE2777D0F0D398B4DC5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4de465a68e58bed9a84b9412d1c50b1537aa3918dc06c56fdc3a8495ed5991c9
MD5 f34ec3416d8884d2c863c6381f73c8f2
SHA1 a58eccb60808cfc743c14fcec23ed3bebde7a1ef
SHA512 ffb002581fb61b225497c3d4d5baee16b768c0fad66895a386df6864527da835bd3afdc3dd588b089dbc84624d94c7ffcec82c433e107cd028bc1c476a4df5d3
SSDEEP 24576:xJIUz+L6VMRCPU6CENltmVVdpx7fLrQWd:xJIUQ6ZU6CENlc7dpJLrQWd
TLSH
T1D565CF3BEE28FCE2C27A4DB85A91C640E77278714F51A3CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 74786d51b5a2f0944ec6e7b7e78b878763a8ac064dd5726f910b410b3434d4d4
MD5 6126293c38461625126a8071c5d26a19
SHA1 851ca9d4a10cb50929daa1b9b48ba86752c448ed
SHA512 79471a130fadeb97aa04fa2baaece61d8104858adce3e23dffa6996660e3ad25740b7ed8bad16f1f46b8ae1fe00fc6de93ddf548af96f64ce917c91b4e4cbe1b
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:dQvGAdlCEL8c/DRNw5CF69CEN6rV
TLSH
T16C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8e505b9e6de274d7c997745ce1db890d9ff93acdfbe10044fa90a87c153594da
MD5 64d984cab1082097242ca65849e5799e
SHA1 9fad4d1fdea072f87f513404f87e683a67844bc2
SHA512 064049ac4abff0d6887677e5ddfc5c186a1d8575351b76eebfeb7be2ebb37bfabd543a3e7ffe9e1285a65e7d6fb41dc5d66122cce6646557fbd4f3667f6b0315
SSDEEP 24576:/0ewsAjN+L6VMRCPU6CENltmVVdpx7fLrQWd:clja6ZU6CENlc7dpJLrQWd
TLSH
T1DB75E031FF74E432C3BB0DB61B36C716582DB9604B511AC3E3A89E9E49342D12776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1e0ff4c0e08b6a544b1d1b866ef7b1be7847070cd96ef624c5feb90afc556102
MD5 ddd92ac1b9b15651d3423376599a77ef
SHA1 26a39fdc0f8714ebb7758462bf6bb9ac161a4376
SHA512 ae532861a8a03f2a2f92f2e108bbede352a3e5e74fe23a7be53ee055c2cf4b42e7c22e2e7e13de79fa31ce9926a050731f08318106f1b0c46a6e8918f7868eef
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHiIm:WUEtQevvqc2W1cpV2tI32R
TLSH
T1FD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c062d6a1513fb9e4ba1bc597a17f5f39025ddb7e7a0d5f32c13bf9b68b863a9f
MD5 f6f78ddba220eb55d1e0f98dc83e7534
SHA1 a6d0785235cd9fdcf0572eca4000ce681cd1a298
SHA512 3d0d5c570c79ba4ea78f59b0b8d708af482b7eee052fc0ad239e01b215a3572419bba87fc4e167e678645da4da13a17b6169a5954fd9ff77518b49600c435f5f
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/z66ZU6CENlc7dpJLrQWd:BoquVjnmB69CEN6rV
TLSH
T128D58E1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 12807eebc14f0ae4f0d6bfc64ec47dc90800418abda178683bb77ea7ab611d35
MD5 f48bef299110cdff674feedef24f7b4e
SHA1 af046d8b4ac00fff112a12a35e6b9237c2a2c022
SHA512 816f80bd84864782f96232ce9ab97f3888cfe9b087f5e6a41ccc0983815ed106a1020c6f0768cc971401b6c2c91ebffd042864b761575cd2d48116245ff15927
SSDEEP 24576:sAhGL3IFoiwtA5l7S53a+L6VMRCPU6CENltmVVdpx7fLrQWd:sAMUFoiq5R6ZU6CENlc7dpJLrQWd
TLSH
T14F359D81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c4147d573612a8b36a268c74b9601c75a50537a11f91a1da6c7923e814c2c810
MD5 65fa347b54f9c7cda0273e4f8ddfbd63
SHA1 1b2220afc9381d712f7d9b34f8e34b38e962f69c
SHA512 7a01c78f63e90bb62b6c99abeab69e3574749275ae26033a020d2af2a1d1fb3097b3b0c4c9478ba196cf4aff9a0c64b9631ce4ea2c19c7eb8000327db02adafb
SSDEEP 24576:iwu4OWx+L6VMRCPU6CENltmVVdpx7fLrQWd:iwvON6ZU6CENlc7dpJLrQWd
TLSH
T10065F14567A41CF9EAA74238C597C136F7F2BC422A21DB1F5360C65B5F37260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e1aad3bd9478ce8b8f27f384e24fa6878ec499cd107e9faf0bb34998b192acb7
MD5 fd63e28c2551733ef54353f166a733ba
SHA1 17abc4c4db24d8ef4f59b5fc478dfb3270d08c81
SHA512 111d666f935f5199b926f48f5540c0b2f5546bf5c7ee18ffd38636033a5739a1c072d53ed287b9f26892307382092cad71427a527c2c40a90322ec5abf6f97ec
SSDEEP 24576:9ZuM+L6VMRCPU6CENltmVVdpx7fLrQWd:U6ZU6CENlc7dpJLrQWd
TLSH
T14755122913E834F2D2E6023CC9E29655EB72BC96273147CF5226566E0F37AE45D3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 74bb087175ded95a5be634032e622f0984de03baf60c9161d7f36a79641353a7
MD5 1abefb371c9b8a38dd340fc76e39e6c7
SHA1 51668fb0eff80304b9fd20f39a8e2cf0c9ec4a47
SHA512 8648f14a837a669f111603fef166f4aab76f144967c787e69ef6638d4d319508fc12bc1d3d8b8dcc429acac4196e0448e4d62e232d1f7894a44951ee157cd665
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3s69CEN6rV:aQyiKa/X+PNcIm
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7590bc7f0f5f41618adf1f9f8300827c184ad35c032648991a25716828075394
MD5 bf8ed0c7c9285315133cf6cfcca9b2dd
SHA1 2579ef0a857eb36dc6587e99eb7a4c9a5cbf72fc
SHA512 eb5ac8389f9edd1624df8c12efdaf516d27cf61c0c9ac22ab46f4a7e607065a78a5481661bce619dfd1427877a3847d6a86a29e4128fd342f2c51a015e6993fb
SSDEEP 98304:WQRQyi36YOcPbLvw2gAf+PN3s69CEN6rV:dQyiKa/X+PNcIm
TLSH
T128667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c28ff71eae8491e3e8f1c1e3274066260f3d3284700e34af33ddb074a537940b
MD5 f588352060d0dcbdd05b32a201fc0bae
SHA1 70fa5c23d14a7a43e27acb98a1b486515dd6d1cc
SHA512 8369a5eb0ed5abb380e2da8bcef16be91e0db1bdb7317937f6a7df52093148532def6fea02ee21626f383d7cc2d5f4b17309c95973869459aafc6373258b8374
SSDEEP 49152:U68Qg55nhceWu7PNU3/K6ZU6CENlc7dpJLrQWd:+thLRc/K69CEN6rV
TLSH
T1D1B54933B2F60099C44DE1769F4A872196D27C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d4b2bb12cade77f9d013e155fbcd159aee5618d07739f9b4649383fb2c159575
MD5 f2558bf5aa59f064c17afa58b764044d
SHA1 7a2a6c71b9fb02acf2b724c7d77c4e036d396060
SHA512 6d1ff945088c1be977f29c1c16e19846687b3f6cb9d0134c6c7174699b5a575119c8f6d568d4612a5372c8541f5ac198560ce0d0c14c41b046c65fcf24e57c13
SSDEEP 98304:Oy5112gYy5azzVvt69nLKnhZP69CEN6rV:/LIHEWhJIm
TLSH
T119167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 43682a2930ff54acca8fc57014157780ad7a2f1d50efb4413e1c37a9173dda60
MD5 72a7677bb756604ef0fb4b4689de04d3
SHA1 b50742200f4eb2cf667f7ed94c073c4ca7b92a14
SHA512 478da0445f9c02eb40dcbda7b6ece4333ae27d6d74f0d56edeee6431115e0416755f75230e4445876784f1b49be9e7e8a21b7d8df8f1d3aa4bcfef26d44b2834
SSDEEP 49152:FB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glE6ZU6CENlc7dpJLrQWd:ru6Jmdxd2dE69CEN6rV
TLSH
T113D59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 762d2fa34100d518d0017d837f91c12e674143bde6eea9661fe4728e3b45b921
MD5 635be9434f4b2156f16f031a4b4ec11b
SHA1 9693c6dc3db854f4f654935b2ee3e9e811c0255c
SHA512 b672b3232b07fd2963e5f32e61170e827b1768955ee12d0f2d0490223e9b36f1ea86a54e8bccb6475649971fbfc8841e68d943c7c3519e979cbf1dd64c3eadaf
SSDEEP 49152:p1hpsNoJpF1A63U44CwH7R4xw6ZU6CENlc7dpJLrQWd:pmifPWRB69CEN6rV
TLSH
T117B5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b8243961b30b8f35291dee927db667bff107b47900ec0fdf8a3dfa4ff3374d75
MD5 7b3b663ae3a7b1b4a7875fd0923db66a
SHA1 37bb5efe9f4ee150540999abaab010eb4d671a5a
SHA512 1402788f69926da9431b9685c9ab71062982dbf5e93746960842da401419b5b22caba691d54d0ca5884ecdc15d920e8405669a7804f1cbbd3d74d51ae9a436d9
SSDEEP 49152:ZSuZQIY0Be2KcRVtOnks6NMHqT6ZU6CENlc7dpJLrQWd:35dKii61T69CEN6rV
TLSH
T16CC5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1ae2cead35909aa5fc6157c7eff6070bf88429a9143a12264ff63910faf5e39b
MD5 9f053767552e25a63ce9d1f0d0803d2b
SHA1 33a9a89f6257ceb23e4bcb366f1c205b426caf96
SHA512 1b26fe78896a74a2bf0f14232e95b692ebb32acb29cd5c63cf1f0fbe25d0f98967fa6cbefead568972171ed0119a0b5a27d8ae9e3868d30f68d6271cc6a40974
SSDEEP 49152:HhtSn8EApI0fig3giDn0AP5wU6ZU6CENlc7dpJLrQWd:WX2impht69CEN6rV
TLSH
T18F95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6646a40bd8c2084eed111ddbd39bb7ff3ab9da81b7fb1cf7830c4b845c552dac
MD5 9e1a39ae7657e0d283d3e5844016408e
SHA1 11b47c1e475920d805488956da87c3449f7c1ef6
SHA512 d4f286663e8d79b6f538a8ebe09073666c344200585b4528a4273fac1a2072ed2dd7361441faf2dfe957feed66a677f6dc897a8855ea32d306e71e37b079026a
SSDEEP 12288:GL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7E:GY+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12245233487AA1D52D7E40278D1A291F5A859BDDBAB005D1FF36B781F0E3A8B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 301a9c210a53d034a774c6482e99ae2394324fff1c0e7ce03336d2ac0efaa6fe
MD5 766bfa1d307b143d5e951acd6f8c54a0
SHA1 c9826173a91106fe7bfe4e60f16ae86dc8c74f5f
SHA512 ca7e925bd61471feefb698efd5deb899e18e9b6d5f1a38abc0ffa0f332eb22b054ddf455fb67e580c284b6166f1fd29599c9f83de0b0d861df263091f76f9497
SSDEEP 12288:oC8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb75:oJ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17645233487AA1D52D7E41278D1A291F5A859BDDBAB005D1FF36B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 979b76a92914350ed693650766f2e1c38ab455e1c4a0645a85e03675c385fcc4
MD5 91893721ea925101899aab2f9e3766aa
SHA1 11705df6e3f2217742e96e4d38ebbd978c1b7728
SHA512 903d31a7c73425a1c5053aad4106e2f05decf2fa537185ff579d4304af98a9dc89cba5c5bd5537ffa29923cde98efafafb18d3020ac455f2aaa53494cef7f423
SSDEEP 12288:R48+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7R:Rb+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14045233487AA1D52D7E41278D1A291F5AC59ADDB6B005D1FF36B780F0E3A8B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 162592fe64282f2a2991ba4fe8f980ba969c1ea29d0a0679ac59d01f256b7e9f
MD5 73cc415be294b9ab0aa91d203c70d49f
SHA1 cb4de46ac934cd911e39f62f35dd3f355c241f66
SHA512 d3a6b25495f94cce4ba4a0f84de2707f879830c79a0b9cd47f5e2558d7926d045933406394d22eccaa38cdb439f787b24ae45831f7d8e643054bc0c09c9451d7
SSDEEP 12288:VVp8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7R:K+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16345233547A919D2D7F45278C1A281B1FA75BCD6AB105F5FE322280F0E35AB46C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3a171a0ac3d419eb19a90e7a0082058ed09d5e7f519e226aa25c4645a94de25c
MD5 9a33d486105b6d6cd1475f9ca965e082
SHA1 c5d22010ccdb27fff2a48f61076a2c787559da14
SHA512 c2b83442ce7ca32bff9efd40a098ccdc7a6e038bd0c40e1d16ec9b365609b245aeb573e2f4d13991b96199d1e1efc96ee467ccfeb934fa00429449169be46f8e
SSDEEP 12288:8h8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb75:8y+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1EE45233487AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B781F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f64245c847cebe9cf1f5222092d573ef06f77cbedb4d3c837c3beaa5f75d5e41
MD5 b0bfac41ae22aee53019bdca6392677a
SHA1 c4554f807fd5f5632f5c984908bfdd0d1608949e
SHA512 2d1fd76b88845deef53e8220f0699a7449b024f48dc3cfb6b40b93f544f51e08dff8c91ef3a4dfa49e01d5b727dab199405a8c38745fca6a6a4a316b515751e7
SSDEEP 12288:Gm8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7X:GV+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F245233487AA1D52D7E41278D1A291F5A859BDDBAB005D1FB36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 831e7fae30940649d15479659b54e707e7b9a2e6dc380e1883d981aa457c3242
MD5 65de4911809c237ee1c3f0ee0d477740
SHA1 ee171fa28939ebad85320e6de1c8034ba3605ecf
SHA512 8ceee7a6fd18bacb470a08dd47d1d8ddf53cd11d3dafd56717c66714e15e6f64a1161c7164b5ba81d0b19d864fa301e3c75c936b4b8b0e83e8387f9dfdb2c5a8
SSDEEP 12288:L68+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7v:Lh+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19845233487AA1D52D7E40278D1A291F5A959BDDBAB005D1FF37B780F0E3A8B41C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 cab59caa0ec7b84429cc934d387020ce48a620eb9745cd08053e7025ecb832e6
MD5 224d9a15c5eb83dadbc965142d27fe1e
SHA1 19a8685810d2fd6ba988a952dbcb8918a232f257
SHA512 dda311228069fa2bbadcc92975deb40c01e755b6744e746b5c1fcceecc615d301ca9197398f11d9ae5cae4aa15b185ff9f6461ad10554668d616f3288dc478f6
SSDEEP 24576:jZMRzFVSOp+L6VMRCPU6CENltmVVdpx7fLrQWd:jZMRzfC6ZU6CENlc7dpJLrQWd
TLSH
T1616502A5B3901CF5EDA7423DC9658956D6B27C5A0B60CA1F13B5362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cc7677f1946984327cc31787b113aff5d0a91a2f02f3de8ba5ad9712cd8d5784
MD5 91759d2b47b84f84fbb87fab941ea282
SHA1 65e9d70c3f68b06bc1c4230719e6ae678dfd20a2
SHA512 609d748cd5a63e22cc94c51eeff1de5981c57422b3d58cb50991dbcbfd7cb08258f0d8cfefb55d1b5dc7ecab748de7db5f5ee1a7ee25dc8627896850b6e2bd2b
SSDEEP 12288:5H8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7K:5c+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13C45233587AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B781F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6d9487d1c9c9b6bbfac710a88f2bc360c1bf14fe0a66e61743abc71e2d7f4c4e
MD5 3204557fc80072ed61e1ca7447b90e65
SHA1 c57a7e609edf4a770e3e6fabaac514f3816d4caf
SHA512 68b239392fbd0a1b5dc03a2e41e1c0fe39d3c2a5bd956bb67885e6ca1f1e1dbbbf10ae6d3d972f397a2d770cec6f7529751023b0b6447ad485de10fff0353475
SSDEEP 12288:Qz8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7b:QA+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19B45233587AA1D52D7E40278D1A291F5A859BDDBAB005D1FF36B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8b6ea32cd3b78ffbd901fcba9fa3f8b64fdf67b269659f105dbe194e1b8626cb
MD5 5e665119c123ec345af79b174e4a2c57
SHA1 7ec52e34ab3cbfe4660ca2c52462a4abb1e9c57e
SHA512 3340a0a01f0a740e9076fe834d03a4f66ec578310a0021ce79fa0a881ea07da14eac1f1b14c34b088ca67d3369cc6876299135477adc4ffa067057e8af4acd93
SSDEEP 24576:Szyd+L6VMRCPU6CENltmVVdpx7fLrQWd:St6ZU6CENlc7dpJLrQWd
TLSH
T1F055021763A530F5D2764238C8A21A52F776BC765B208EAF5364163B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0d3e99190d38018bbc1c10977c54f1924a3ababf2c96973b1c0ae1426474a25d
MD5 800dd32eb5770b35a9be5764fbbaa398
SHA1 61ff001397bf8b0d5ed248618b96e9e69e540473
SHA512 fd3a35437d20ff38f6c6688846bc95e732b773eb9a36922fcce267b3d2d3bdee05ba4db51771221f87e4c6b1a7f4622ee4cf8da36cef09bb1817955472416f45
SSDEEP 12288:+H8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7d:+c+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16745233587AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B781F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b8d44a5e5df0c1ba9b7a010a76aecc76c4b6dd473f08c48538fb4827807a7da4
MD5 55aa3af6738504cafdcb91078af1719d
SHA1 806e1a8c8e6b95f893caf02db5c4643b460451b0
SHA512 c7a202843b97e4d4355b7d2c2b543f0638df950ad75518c804158c8bfca1888d4a1da6a0e8e7a810321a917dba9bbfc2eed197500a4d0dadd92d37a4f47293ed
SSDEEP 12288:cH8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7u:cc+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E645233587AA1D52D7E40278D1A291F5A859BDDB6B005D1FF36B781F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7171d61bfc5e7decd9da3bf2c54661f558ef3fc3215870faea77e299de37a8e5
MD5 c167f8145a42cf6433a54f2c03daf69e
SHA1 d2da6c0632930b0fb9dc9c1e1fdcdc03ac42aaf0
SHA512 451b0d09010574399b0f6b7d74147175b2a76b64e630acc77e0a7843584f7513aebab98aaff1c66da06151ea5ba4c1823ecd3c3885ad9930d8efaff15a4da38e
SSDEEP 24576:Dzyd+L6VMRCPU6CENltmVVdpx7fLrQWd:Dt6ZU6CENlc7dpJLrQWd
TLSH
T11F55021763A530F5D2764238C8A21A52F776BC765B208EAF53A4163B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 754e9552343348045df3459180882a9628002507943ef923f065c23c9a282fe4
MD5 b252189a703625f276161dc192c05655
SHA1 4d1141b4cbff5df8006bda2082b3b31a6c8bb263
SHA512 d5234be2c171f20ad06f8631079f4d889ff5c9f3fa3ad2af0e8b5e162b6b58d96141a5a7dfb898164d12bc4def03ecd0cd67e606bc3d395f6f2b461345299196
SSDEEP 24576:CTDaLl3z0zDL+L6VMRCPU6CENltmVVdpx7fLrQWd:CTuLlj16ZU6CENlc7dpJLrQWd
TLSH
T1C4650264B3901CF5DDA7413EC9668956D6B27C5A0B60CA1F13B9362B0F337A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2ab57dec76bb24d1cb4c3a8afc324d3e96b3dbc1f5fbd2363d06197a8431dc0e
MD5 612660ec3fd3dbfb14635d664da1e2a1
SHA1 b4c9c4b3fef49a415e5789181eebe3ed317c98ff
SHA512 103b27c12592c4c7b9bf0bddbb29e4c2b21fe098d017849b0edcb3cac0f4be2e3b3f0388e0be39d9da07276e119edadd89a0f89cf5bc0a7bd46aaf34f1b47a79
SSDEEP 24576:r3vd9CHKy7GZX+L6VMRCPU6CENltmVVdpx7fLrQWd:Lvd9CHKyaC6ZU6CENlc7dpJLrQWd
TLSH
T18975CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A4251A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8f3007edf717a419347b4a274d1468e83249d3de54efe3d7957c2a7d1e1ff1df
MD5 8bcebcee1a06485933c8318aaced52ab
SHA1 73e7cd01b665888cf062d5309bd217055f3e9d8c
SHA512 588d91a6bd190cf4a6e4c20313dedbd7eef56add59a93bbb2c5155db85388f5e2692ed8c168d84d809e7e88dce3aa62ea4c5b0e213cf42d5b3b189deae827695
SSDEEP 12288:cY8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7V:c7+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10345233487AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B780F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 167a689c6625d52a6700fe253c0764ed22c3a94f6f8153351f92cbf977e6133d
MD5 09eaf75cf64d7c90839c4e8b5ff46c72
SHA1 f668fa9e3d35a068649f25273f3dfd12f27b1841
SHA512 62b7163c7c55fab686bc5ce1ff6cbef00354b9021b080f7758170c009c536bad394306613e57f5fbbfca4e0f394f375e0fd9fc1ef2376800fbcc93e4ed20f8ce
SSDEEP 12288:hu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7v:h9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11345233487AA1D92D7E40278D1E291F5A959BDDBAB005D1FF36B781F0E398B41C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fbde9cb176c7bf88ebae742ef441c484c902396dca2f0ac30c12f1c79873412f
MD5 e9936bd4666cdc0e2649248390bbc687
SHA1 ebd4df8c9a07be9a0ec85c5b5ce06964fc4dcee1
SHA512 ea428a5f7b17527d2e44b79c6b8ab5b4a5029c04621e7de3c8879f4681f06294057509cfb52a07b8179485eef1cf82f731d1c3e2b7b8541ac1ac7a768ad3fc2d
SSDEEP 12288:xF8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7b:x++L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1C945233587AA1D52D7E40278D1A291F5AC59BDDB6B405D1FF36B780F0E3A8B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1ad2212109b009b87d6e7e55190d7b3c9e711c37ffc1dd05478300f829a9c76f
MD5 160f68e0489c7f07c4f431abc91396da
SHA1 0534db57b98969599f793924144ee3003169b0e1
SHA512 a29f5833bf9e454fc1d85541ae99fb10b6be7397c13ff29d6f08cb91ec11c14f985c4ec6f0d088949a675bb5007b0b7697fb33931ba7d087eb964d9eb57647dc
SSDEEP 12288:gH8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7b:gc+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18045233487AA1D52D7E40278D1A291F5AD59BDDB6B005D1FF36B781F0E3A8B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 967245b06d64de2fdffb8a64534b619f246509b2b2886032d2f1145e1d219189
MD5 b56c2856120b39451d259514de30a386
SHA1 ea27a2ba07f896ad4ccba07358f7c1934d5cefc3
SHA512 5a57beddf5e4d04b2b1d7feef7575d561317363f319a3da106db72b74a2b831eb5bba5c338d9bba751300d6e63c2c7b64bfa9110538a72efb0ca235c587c41de
SSDEEP 12288:gY8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7S:g7+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B945233487AA1D53D7E40278D1A291F5A859ADDB6B005D1FF36B781F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 80ebf37ec4cb506d4cda974cd9f438339aa8affe945b9696dcc5c5e55aaa937e
MD5 236410fc12c36ee7edeffcfee8109ad6
SHA1 fccb59c73f74b04ef8dbaab7ea024398d92e2a0e
SHA512 2509ca65bd171eff3c2df746b4f2181dd2c4df142db637720a822dd00918f6a7c84f08725525c230ad32ae4d8106656043c1e963987fe50be10f2dbc7c45f575
SSDEEP 12288:w/8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7O:wU+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1834523348BAA1D92D7E40278D1D291F1AC59ADDB6B015D1FF36B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6d0056edfc6ed3986aa03593a762c4ce58a68f7fd9e859a8b0d8aef1073b9da0
MD5 e71dbfba3b12f6d6d0e29563e83d348e
SHA1 c9d69261b13a07d823a7f2d76a2236d4d66aa1e8
SHA512 06e0965c6d8dffb7435b790a40ae10d0f7bb0a5e4e5b252fe876cb1361f891ab59c9398834d6abf58ca78cb6eb70b553608bb0646ec5575e43e1afbca12caa62
SSDEEP 12288:8h8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7W:8y+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D345233487AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B781F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ad9f00a0969a7980e887370277539af1ccb12a8a38ed9d9dae8b17c259296b24
MD5 14e52fb8414f43dba5d623bfc4a297c8
SHA1 618396561cf4196bfaceeec7537ead0f5897ab3c
SHA512 2380724fbe7fd0a00551c3cad8e3587574ff6d8d0ac915e2013d7ff878e97862e498fe7e9c0cee505654591cde814353016d96e5cca37d4a7d1be6cec3635f5d
SSDEEP 24576:5fwvUk9RX6wkyAIQ+L6VMRCPU6CENltmVVdpx7fLrQWd:TMnYIv6ZU6CENlc7dpJLrQWd
TLSH
T1D485D029EBDC08E1E1B7923C99B3460AF6B178591B31C6CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 148dc8ec367103b285aed22cc3ea5228fbaae27d745c33155e7a43096ad1194a
MD5 16542ded09b06365042a98019a31f1ff
SHA1 bc8e82bf99c7613e67ac5a0a2bb5600898c22c5f
SHA512 311d7872c3a7ccfe73e14cc03eb6979ac2bcd59c35c3f98aaf26ea62a8f3476c5c37cf1ed9bdcb5f125d7f5df643557b8c9bd4ec80be7086d759b7e027f85907
SSDEEP 49152:3YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK006ZU6CENlc7dT:yySzPM69CEN6rV
TLSH
T104066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bdd59a957e28489a0d658932c87ab2811d2ebb3891693675782dd0cf1574bce4
MD5 7d779b014f89db05f3c7b78b5f82d64c
SHA1 b2596c1f6435cc8b276d24e9edba3423f733200f
SHA512 a51ce1b1d74e366faefaa9969cc217b8fe303f9ac9b0b669d18b1284c126b695f0543c1522d2b45dea24e2482ed50947abe1cf319f42a3302b5134bc6f9ba0e4
SSDEEP 24576:847Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY5+L6VMRCPU6CENltmVVdpx7fLrQWd:847JUQjTirIhCnDHUPfF/E6ZU6CENlc5
TLSH
T17865AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f5becdc712cdb2c343d233ff924f8963a3ddcf969c9f3a26a55a4d25b7d3c1f2
MD5 ffde176f845d6802e724a59f368b5411
SHA1 1199cebbf257eae5e007dfde05cd0dc8b75c216a
SHA512 55a69d65e235ab7d72cd0745af37bcb4932d77540c2fa21372ac3335f55a04f965ffebd85b95f402abcb4f32397a96b453e52bbae04342b52dca874114632118
SSDEEP 12288:sbsfX8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb75:jM+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E855F019C39802E5C1AE2278C7928691B7237CA597E1D7CB62D1F43E0F366A05DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 e3f7ffe44a4f446cf162602b7f174af471dec4caedc5269dff740f6170dcb724
MD5 70073cf0feb9472828cbec74e3d5130a
SHA1 53d159e85b2086dc793079800e969c281c8d2cf7
SHA512 cf74cba8909cffc0f8cbfbafb18e0800f0db6c849b12385a4268ee543b9fc1aa5bf7ac624d488c0adb84406cbb97bac42b4d2a8c67561f0509bc0ce42cfd8913
SSDEEP 12288:hZqQU3fnOmRAvem2O60i1HOIQER9NWlzZ0Wzm3E2X2Z:hZDUP6WhtNhN9NWJSWz2zmZ
TLSH
T147352800766AC75FC6AD44325E36D2CCAB707D41EE056A0373C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 85e47d8cc9fa1c87646245dddd18475d47804c792f12fe94d408539c4c0b76da
MD5 a8b62a6c6b3c12a5fa5f925cc9ebaa49
SHA1 5c016a4529f34b05b74e3ff4936bc321da829e1a
SHA512 8496829cf2c2298649f9ff48bd0cc50a45a5795c503401910c0a766d9e2a300806a88ee8fa708b9c56d2eda8ad052071137f190e9bbe6865755dd46eab56e6ce
SSDEEP 6144:Z4teS6eTiyUv/0c4SkRj9DzmcM78+dbYcbVtMxxcbVtMx12C3hqkSwcUIZ4O862T:Z4teSQEzmcebzdQS+WPqmn5/gj
TLSH
T11E55C7815537A3CFD5FA6032072A5B4DAB64EC07B7095F2273C8443AD86BB25A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 760bdae1c249af8a388e13b06fb3e27da66f57fd81abd14fb8382a730efe6723
MD5 c90d97eec81bd2bb985ac21aa524a08e
SHA1 c32a24023141d046526052dc8e1400a8da471949
SHA512 9414e5e418d8b65f7b8bca9b53260e756e56b8abba9c35753b2937b29ec46d59acdd15249c43215b973315755be32a79883df2d11a4e211e1d7d501bacae6215
SSDEEP 12288:W07P8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb76:vE+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1EF45233187A92D52EBF8127890AAD170691EBDEA5F0099DFF226750E0D39CE45C3B31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7e8c6bc1663cb64edb3b5d35d7b0e7f675cd681976c6da1f8d4c1051530dd768
MD5 7722eedb05e8c5be562dfbfb0183d479
SHA1 9bd9a58912dc930dc8a264559d8a10ad6cc80914
SHA512 438062d23a344b8822a8a773302c20a4608a4d821f28e3db99cf5713f8c48cab761998f340233c8f88e4999d60a38a862754c4d8d3d3785e97ced00e23572b09
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYG+L6VMRCPU6CENltmVVdpx7fLrQWd:Zgb4mBIBhGFe6ZU6CENlc7dpJLrQWd
TLSH
T1B665AE1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6ba2214d1a63ac13d301e24597010962cb0193cb83c732a9fc65312532b85e8a
MD5 6b3d8ea0fc16e4297b32bd7180a43df5
SHA1 cb9c3f0004ef46158ff9174930c2434f8979da03
SHA512 a520425abe6da50c5ab46f3cbcf4b0d34dc9d1bc73daae54bca250d3e79ef826840b1d75583498fe134c5f1b518b165f0fbb14e0a8959f9bd666110f18429cc4
SSDEEP 24576:fG88u8FpJqH1bzria7/mp+L6VMRCPU6CENltmVVdpx7fLrQWd:u7ZFPqVea7/d6ZU6CENlc7dpJLrQWd
TLSH
T15185F16567E101F1D47BD13889824663F6B2B8251360EFDF07A88A561F33AE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a38558537098054b709080e8e25e551d469840bc3dd1e318aab8cde71b78d73e
MD5 7731c9865cf5a312d5b2f5e2da68c7ae
SHA1 ddcb716fec29378cc630bb96ae01782d598dba70
SHA512 92525765d130153dbe5f0d83f2a1f50d8d72855bcb59cb5d184043fa591b4d14541149f38da7c0a9ce13c74cf61debd2f21ee367190daa3b9b198ae9aeffb9dd
SSDEEP 24576:xPUr+NQl+L6VMRCPU6CENltmVVdpx7fLrQWd:xJQC6ZU6CENlc7dpJLrQWd
TLSH
T1D765E12E63AD1CE5E676A17C85828619F771B862171196CF02E1817E0F37DE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a3f2352e2f2a130cf7fe60aaa16086e49d97294e926e18342f9bec0b58553883
MD5 51056fb8ceb7ff949d6439da13e0f648
SHA1 4fb180a8e34488f480d9254da5c1c25b851ce216
SHA512 506c5bd9d9cde42b5ea0d6038e3429047f5a8bb1fcd78217a5f5c7cb34f6b463af96101a7d93eba4680fa00267fa4b5b9bb02e4389741c0687a442e34650d3c4
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjy6ZU6CENlc7dpJLrf:7G05lO43bX69CEN6rV
TLSH
T1F0D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e6a5ac20478a1a87d8f08b7a36af67ec46c4d0c9fb293034845417d73f7c24ff
MD5 4c66d26ed4cff266ef13413a87f32531
SHA1 9ac84293c8e97b6d5e52a53ec81fee8fa2dce5ca
SHA512 86d797b9c111ead24f6a9bd9af79c981b1e13fc24ff9007b273dc829e6b6b1193b5bcedcc4223a5333c7bc01ad68643a8a741c650eae9f68aa91e49a29f8a46f
SSDEEP 24576:Ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidnv+L6VMRCPU6CENltmVVdpx7fLrQw:Wa5POZ3BJt2pasx2+mK6ZU6CENlc7dp5
TLSH
T12F65AE5EA7FC01D5D5B9D17CC583861AE5B1342653319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 50317edfcd75cab5f3c914f8fe4448ee7237fdc12853a2c0091db702d41491f6
MD5 aae6569c18aa948347dac10ed8f9ba76
SHA1 ee96263014d6872569414cf0d23015108d696bbf
SHA512 93570e0a0075fe7404c2107ffcd884fc1f4506bae73b3e4a5c8a2696f4a95c4095e3dbea5b0bec4e5428c229fa80a55ba51f4cbd96c5a4ce5cd5c94883c8db68
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkR+L6VMRCPU6CENltmVVdpx7fLrQWd:LNc/zEOVHF96ZU6CENlc7dpJLrQWd
TLSH
T128857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6d4a8ec2a7662b936d4e4c26aa8fb7b2dccf6e9f6cdf27ea8dd59b241b1e1de2
MD5 34c299c44ae63800043c2f396c77ef3d
SHA1 0fff7a20f59585cc44481fdb767e5841ff4015ba
SHA512 0831c141070f8148f3668bbefe80cbb4b81386c36f6cb6ab7b376e59e6b294364ee96bc2543453d1a3cc04fd290f38d7bd2bae42582d1f1fc57bd980cd45f3c5
SSDEEP 24576:lTkNvNnaFeYhJNtmZBmD+L6VMRCPU6CENltmVVdpx7fLrQWd:lTMwBtOmg6ZU6CENlc7dpJLrQWd
TLSH
T18055AF6EA7B806E4D1FAC6B4CD238512E6727861173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 45469a15edfbffc6c85cedb4dfe2caef0acf2bea5807fd6a2f260b16a28e7ba6
MD5 1934ef0dc1e56f68773d3ceb7531d653
SHA1 fb056743e7b41f1423fa51c0df70ed424c5874f1
SHA512 9f832942c28f726531dccba5faf7408546e322ca859380a68ed854dca1eb97a04c7b948a57d7e6fb49a0c597c805ea456c4f72616011fc8413a8a28739b6dfea
SSDEEP 24576:CD3FHshBIYQgA4+L6VMRCPU6CENltmVVdpx7fLrQWd:CDVHeBIAAn6ZU6CENlc7dpJLrQWd
TLSH
T19475E13DD79C04E4E57AD1BCD6638606E77138A903216ACB129481BA1F6BEE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/400-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/400-307-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/400-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/400-96-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/400-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1036-108-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1036-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1036-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1036-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1284-127-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1284-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1284-129-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1284-121-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1284-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1708-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1708-39-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1708-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1708-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1708-51-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2200-79-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/2200-1-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2200-0-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/2200-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2200-8-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2852-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2852-178-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2852-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2852-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2948-82-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2948-320-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2948-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4140-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4140-110-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4140-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4144-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4144-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4144-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4144-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4144-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4768-68-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4768-74-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4768-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4768-260-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5084-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5148-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5148-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5148-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5148-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download