9c01aff96d03fbd12abc47cfc0336e47d449fdbfe559027b5784d7b41a4171cc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.7MB
Sample260728-p2cl2shc66
SHA256 9c01aff96d03fbd12abc47cfc0336e47d449fdbfe559027b5784d7b41a4171cc
MD5 aec4812729316f87ba2a011c3d8c3d10
SHA1 87127ff5e1e16e7de2d91e3aa735250844a3b166
SHA512 ac50f680cf6f7c4e5d41f960ee6c42f4ba99d4fb4251c3a2dc5acee06254611fc175c0eb0e8e107dae918ad1e1d8968c6ff0c3ae1ed09012206e907945f6be3a
SSDEEP 24576:FD2dDlG3hXhN2jzWDwCmTPPk/z5Zf5hz0dNUX:oo3p3VDwCmTPc/lZfuN4
TLSH
T15E85E08AB39406F9D177D278C9520B12F6B2B8495721A38F03B4977A1F237A25D7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4876	elevation_service.exe
3444	elevation_service.exe
5544	maintenanceservice.exe
2584	OSE.EXE
1136	PerceptionSimulationService.exe
1552	perfhost.exe
300	ReFsDedupSvc.exe
6072	SensorDataService.exe
3984	ssh-agent.exe
636	AgentService.exe
3084	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4bf57747e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089fde8878f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009063b8c88f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b7f2c5878f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a68ea5878f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	636	AgentService.exe
Token: 33	3084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	300	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3448	2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4876	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3780	3084	SearchIndexer.exe	101
PID 3084 wrote to memory of 5660	3084	SearchIndexer.exe	102
PID 3084 wrote to memory of 4380	3084	SearchIndexer.exe	103
PID 3084 wrote to memory of 2188	3084	SearchIndexer.exe	104
PID 3084 wrote to memory of 2168	3084	SearchIndexer.exe	108
PID 3084 wrote to memory of 5500	3084	SearchIndexer.exe	109
PID 3084 wrote to memory of 4948	3084	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_aec4812729316f87ba2a011c3d8c3d10_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2532 2304 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2740 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2740 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2532 2304 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 514c8994d3c117910aca5bacf809282ac0c3c764c374584bbd4a10a413885530
MD5 fec256cf040d84ed26e8cd7cb6858bed
SHA1 1a3299d84a7b5ccbc3cdea862c4989252278e0fb
SHA512 7367361af88f4bbd8c769ea62a9d11c57be2244d06f410f2a24085fc8505c5a99628405979f936ce654f212fa603166749806d921079169d24e7d699425e2ee2
SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn9DwCmTPc/lZfuN4:V3q6mjBawCQ+yN4
TLSH
T1A6D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3c121f541974d61d62dc03f9f2211be4ec3a0f8be4f2bc8914e9a20f722e20ac
MD5 a1ae510f42ae31cecc55525f159e2b91
SHA1 0358377782b7b40d996e318945a705266117a708
SHA512 b97e0c434ffa9a24b3ec6d20e1d805775795ea323cfc00f5ead046b4f4821b9856e2af69800fe4fa13d9971f695722b1207a9ad3917487c112b8746b33913f32
SSDEEP 24576:VXYfDtczANjzWDwCmTPPk/z5Zf5hz0dNUX:AtcLDwCmTPc/lZfuN4
TLSH
T1A3750128A7D508F9ED674278C8B18112E673BC9587A0EBDB03B099391F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7ab5a6e0000874f6e9655cd6f06edc643b23de6aea4b7962536750caa5fdaf27
MD5 94dcb0a8ea4c755ef9cdf2ec0b1e3ec3
SHA1 71905e5a251bbf662fe613e3c74d3eaac4a43c26
SHA512 23a4be833a6560c7f517c7e4c4cc139540d4524f3b93a3ac3c0f8ad39c1392a5d3fee7aff5522ecb0f9950a8f008d949be688df5c16e3a7729aa63251c07a8d8
SSDEEP 24576:P0Le5ji0hmxhrMWjzWDwCmTPPk/z5Zf5hz0dNUX:PPji0AzKDwCmTPc/lZfuN4
TLSH
T16685AE15F6748331D073C0B9C5D2A69EED7230865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dfa0898cbc511f3f0bc215df077563250eeeaee0c845c6b72da10a9c4a1b81ce
MD5 4f10826d586df103ddd506284dfc8749
SHA1 fe99c8ae5b9d774ce98813ba5d6d9ec0aa38310c
SHA512 f466adcdf955a54295df4d4acf683956a8a3a39eeb698961b8459b2189a287e86c52190e051b850a7816ba9107b295eb1e0bb8e772a4de6dda3eaac21722a079
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWj6q8wyu4jzWDwCmTPPk/z5Zf5hz0dNUX:w/ezSC6vUzPv+HjyGDwCmTPc/lZfuN4
TLSH
T16F756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 62fbcb2493dab56d92df7db170f97431abcf8930798764dba6f21d348c9e95c5
MD5 f724e8ad28173453dd10eecb2ec97cc2
SHA1 dd20be87ac60319e1a51f256569414eb95d69f09
SHA512 5cc5f6d8549d2fe89f894b3f41e5dccf6b381416082e51a2552d583c29318b8ea4fc26fbb61122dd0e52bf8a16b475027a54e14c87cc207ddc76fdfc6483dead
SSDEEP 24576:EVbqPb88hv/l+BBjzWDwCmTPPk/z5Zf5hz0dNUX:EVO88hXl+qDwCmTPc/lZfuN4
TLSH
T12655AF65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 73599299762bdba9923f374528e336126b2e1c563546fbce703ddcbbf2e23da6
MD5 713c7d80269668460e454b8e99da69a9
SHA1 b13ad404c1fb2180d126c8b6ee730ead091011fb
SHA512 fdbe2c44a902dae43b19788703ab0d7c2416216658053542142332b361b87d9bc6f8a21d1df69aa60b304383c8aae7aaa82dd4ed6ea132176cf793f466341a05
SSDEEP 12288:BGKjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:BGKjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1B055235CCE8A0472E77A27F074F4026276A2CEA5D8841EE55671B92DAC7CCB0EC9770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 38dc1a2d7fba627de790d610e638e94b816e17cea983e52bd6ce8bbcce0418ed
MD5 b85b3d8739b5ab674f4ad9d2b77c8e21
SHA1 9f1af3cd8207b5aef43911ba605b2bcc1d78ac1d
SHA512 0e2894bb964d7f4dda07417137e929a7984c8a91f588f8a2e2d6414b0b5f3432620052f2fd84bf89156cc644f9b358980ef707f7f82c5394aa80a52fd5ed86d9
SSDEEP 12288:SeBNUbTVO86Upjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:SJIUpjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T10575CF3BEE28ECE2C27E5DB85A918700E77278708B51A3CBD175820EDE235E05D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 848ec162cdaf9f4081850484a8c7e093eca7ca86e807704031164d204ba86014
MD5 dce91ea4f3c3803241e3a775cdcfd8d0
SHA1 b30bdb97195deec3648e39324809839cbf4943ca
SHA512 19071cde450065573798539eb399eb6f0ee56606876e92c110a56ff2ad696b34aa1db436677eab65a4385260da3f557e9bdc65e0620627104016df9c08d0e888
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THI:dQvGAdlCEL8c/WRNw5CnwCQ+yN4
TLSH
T100267D656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ab5e1c3a3a7bdc7c29e37ab64d3c02e44505f75848481a52c820a3ea44f18dfb
MD5 1431c9452226085e294410b45f63dfe0
SHA1 04b17c0d54cb68eb14891e19fafce9b9cf0b91c9
SHA512 226b0b1a79d7275cd56a7a5ce89390df9a627ed293faf4c0a64ce12800c0419b645e247277a932b33caf362082f56e50d81eaa085abd009ba7fba3d6e45208fd
SSDEEP 24576:tfewsAjDjzWDwCmTPPk/z5Zf5hz0dNUX:xlj6DwCmTPc/lZfuN4
TLSH
T15A75E030FE75D032C37F0DB21B35C716247DAA208B911AC3E3A89E9D59746D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e937b131998bb3931edef73f7a900e94d852588465193d8cdda2cba5f9a3daee
MD5 a895cd865f60bd7dfb4ac173f25883c7
SHA1 079acd20aa928e06ff9007d1857438fb619dcff6
SHA512 c5e3faa50f6c22c642f84ab5cb6b29d5194f61e46be750f3c768bcd811bb50417047f0377db6faf84841d18af502ba8bab9126bcf0428472c6087817c5588460
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHf:UUEtQevvqc2W1cpV20I32f
TLSH
T126474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 779b000ea9d2d03ac5067151fb7f318acdc88344c8bf8f1f3d2f7a72a8dc3dbf
MD5 0d96786c89f88b467d128692feae9dce
SHA1 60f13cae44132ac57e8319ff7095ba16a17662c7
SHA512 f1088fb96c38d1278f9b5f7aeaa784aceb576a991024a9fc4243264a48ef2e2e68dd7d10fb20b9f3d921eb3c88c7fc73683552279a241e967dc5bf0d5e7d6351
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zaDwCmTPc/lZfuN4:xoqtVjnmzwCQ+yN4
TLSH
T1D6D58E0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7a1d2003b9bc1e9e513c65acb8df6379e72f22ff894b0504377673c8f8607978
MD5 44e4c96e0ff4fdf312edccb5abbde6fb
SHA1 d20e8db977d26a7a7b4e959979324e8dc820c307
SHA512 0e2cabf8011ce877b82e6f27a545152e1ee212962108a25281764b314a08c92bf6aaceb4387a8e445685dff30a6f4da91b4d4e8c2ae3fb3c514c69f3daa06cee
SSDEEP 24576:pAhGL6IFoiwtA5l7S530jzWDwCmTPPk/z5Zf5hz0dNUX:pAM5Foiq5nDwCmTPc/lZfuN4
TLSH
T111359D80EBF945D4F5B3AAB899B68171EA76BCA55E31C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 31bdbb67b1e8c1cae8678e261bba4ad8ae6c4fd726bf025ce746ab6659d61f2e
MD5 dcde80bbf62bf5a9d48c7910443ecb13
SHA1 9078444cd8062ef383ed3c3bd37a7e7a0fd1cfad
SHA512 77863c9bec7ef22e76dc600e3150f0d9ab29886dadfdd2caadcf88451052a48e7b27c8217cabaea51178c736f005471abdf8298ecb018b3ca2296598d91cc6b5
SSDEEP 12288:ymw5HEjsChNEBFgl0WDm+CYjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIs:rwuROWPjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T19D65F14976E90CF9E967523885978132F7F2BC112A21DB1F0370C65B6F37661AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4922f16f95206e0b7dec271d8d7441d30e9bb4bb9eb75855ce58bd44c344374b
MD5 7a43cb927d477e7601c16e38d240efaa
SHA1 41f956fe2efa50f2add9b9dbb5b4f2c44953d9fc
SHA512 e8762dcb4c43e869454e6c42f4d76fdac0608bb47613cf91c0f72252e9777cf41b76d8df23779f1092c705ca1ab1fab287d8ba5d36ce9ff273db8dd045364f0b
SSDEEP 12288:XyZ1Iyzjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:CZuejzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1DF55128D67D910F6E26713B898F00606F3B2BC66A77103CF123146696F76EE16C3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b295102e6e441550de183a1b89b6aa90eb70995d83cd26d614f457608f07b217
MD5 7b50dee0edf80ddb102cb7a7ced9fe1f
SHA1 d138ddfb7be2f1389768cfc5ca348b26083954cf
SHA512 59e00a0b315e8a0924f324a645cb3316084a875042568ade2f9a2a660dc09932734566b51277116dafcf944e0d37fe9395cd5ba358ab27232c019223ae76b7e0
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3OwCQ+yN4:qQyiKanX+PNV
TLSH
T197667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1359b5560ec45a384b057e65083cc866ad680111a102399ba0b1698c4b47fd81
MD5 e7057fa01f11b2caeb788f9c6c801bee
SHA1 c1f25b976cee99e9c065009a5409b0629d914565
SHA512 9b3675d2c241561baa21930c3e69b08d7bd214a03430cce8ab34aadb6d007ec8ac461eb3db97ae4a4772641ad834d7097c6f02bba1d5e9df9039db2a17f3657a
SSDEEP 98304:wQRQyi36YOcPDLvw2gAf+PN3OwCQ+yN4:nQyiKanX+PNV
TLSH
T1AA667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 909eb269087022e6c917a8b92ec9cf626998bd09e6ff7864b6c87ad877cbf9f3
MD5 32b2ba573ff7ee5094ff2ee3719dc564
SHA1 acccd7310a8e8bd0f98906aac883538ca949fc8a
SHA512 de47aec62c0a38849ae45de58fe03390aa33f1472b6a4e9f76659018c2d01f683aab2e0cc591000203f2d8880c0496ca5f67a402051a5c30cef925cfc4a7e6e4
SSDEEP 49152:f68Qg55nhkeWu7PNU3/KDwCmTPc/lZfuN4:ZthTRc/EwCQ+yN4
TLSH
T10EB54933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b0bfa612cf065ebc1a3e6c14cac79d3e6d61917b6e9244b8e17b9c9b87af3149
MD5 342e41118d5190a10a8eb9812dc56748
SHA1 30820e7633f1ba337c937d9968b8222acc62cf8e
SHA512 7afa3e068455beaa8c4867d8c8b8a79fba25b1a4257bfbb120d481d118a2b1d32633c338294871020461b2432a5763142855674691eebdfdcdbca895e8ef3c05
SSDEEP 98304:Uy5112gYy5azzVvU69nLKnhZBwCQ+yN4:VLIHRWhg
TLSH
T169167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e454f93f54580fccd4de1b1f8ad617a26908ecc7ea93d953823d34e2a42a2982
MD5 f2684040450da3481224e0423eb7ace6
SHA1 a48706a807b42296bc5a8e09790c1f34a375828d
SHA512 13592c164eb0ae208c3e0cfe033c777d40e72a3437399b0d5d3a794b9c2e102c2212b3f2231c6534c2ee825dd1b6095aa5d932398925f96b523ed6e6b7716bc2
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glgDwCmTPc/lZfuN4:Mu6JmIxd2dmwCQ+yN4
TLSH
T1E5D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6EF0A9072552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 02f8d5982b52836f2a703d9147ac6207d66b0a2d7d8e47768c0513fb0fa360ea
MD5 08746701d55515c7225cd326a0dea065
SHA1 c353ea5991cd421bd58b005ca2322d003b3000fd
SHA512 d7cd7e50efac2a33e7fbf3587e407bb895f1743e539a25f501412e24647d1905edced6405b303a61e0236e3dfb3126f449cffa85a69a2f09efb4ad7e5f86b27d
SSDEEP 49152:h1hpsNoJpF1A67U44CwH7R4xsDwCmTPc/lZfuN4:hmifPqRzwCQ+yN4
TLSH
T1E3B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 04702708d00a4f3509c1770b1802c5f2e11c6ba13c2617b44648e899be9cacc7
MD5 22107b8606b1ad696b11a077bfad3e8e
SHA1 6c90eca1aa29904e93791908bf330a8e83c6cb9b
SHA512 ab06a90b3067f6a49dc5293994603471cf871d17f4c1fd7f3625a0b2bff45c0517c80c73616629ad5c2fab2df340e10e8246c210eb66c59885512de7e4a48480
SSDEEP 49152:4SuZQIY0Be2KkRVtOnks6NMHqtDwCmTPc/lZfuN4:i5dKqi61FwCQ+yN4
TLSH
T142C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f02a5015b3633a26edabc10112f26fa34b86201cbc96bf8c3b1557d17f6b53af
MD5 4878005c1978236d8638ff12b452bde1
SHA1 c5038dd4964e8c39f8298ccb4ad4030b84b2a3fd
SHA512 be36e4fc9e6ad6c0ddb655b93521bf88f7e94f76050a9103ea5bd1a30ac73d252cfc4727737c880e6a7f9194989505c2218488ad3b600e12bc4ecf8a485f5602
SSDEEP 49152:3htSn8EApI0figjgiDn0AP5wQDwCmTPc/lZfuN4:mX2iWphvwCQ+yN4
TLSH
T1F395BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561E7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9246740969a87c82e6142a42279cac185bc835a4a3d732dbb8f50d8b134608a4
MD5 8802a8ee881073de4f4e7c48ac4d552c
SHA1 92d075dc83178ef3e37521d9a220e6cbbc53f24a
SHA512 d73b7cdb27627e3fccda168cbae8ba7ef4d938b38543ff3a456c39b2449b5160a8ac3b113e96a1bbb838ec863d0066390146c5769fd167691908a1f2a37267e1
SSDEEP 12288:Wyjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:WyjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T11B55234CCD8F0472E22927F064F4035275A5DEAAE5C11AE55732A929BDBCCF06C8774C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0c85aff6f5390763a1578e5a179ef7273641101607f75039ffab4133d4b0c32b
MD5 03a332e24633f74f68d34d9ca82c59b8
SHA1 a7a5fc4d67f95425c13385ae036cbb68d1897d48
SHA512 b3497b341e686ded6b5a149f1972d9c563e357a67a27e7c8744a1516f7f25553954d2ba44a38c4d60f6a8a9d9eb71d7677cf35148de1ed05d8048abd11f5398a
SSDEEP 12288:NHjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:NHjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T10855234CDD8B0472E22927F064F0036275A1DEAAF9C11AE55632A929BDBCCF06C8775C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c573aee5f1f0e69d8c012d8873ae7196e2ed1e7e1139d3e4c92fca4bdb926b94
MD5 d533ab51230c69a0bea387343c7b65cb
SHA1 3df20b1734b0437c7c4975ba4863f401834af2c7
SHA512 81a321649ec94fa833545746ef5b171112bf05c6c091a6823123c2b4749cf8bea0fb826f797ef2ee7d60e2ae4d849c0b53eeb824d3121b16aa1d628d674041a2
SSDEEP 12288:URjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:URjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T10355234CDD8F0472E22927F065F4036275A1DEAAF9C11AE55672A828BDBCCF06C8775C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 018ec72c37176a1bc6717db35db158bcab6c17632e672c541dd4a466288918ab
MD5 1043d48969e8ce6951adb120427c40a7
SHA1 e6503b69b30c185eedd17fe25d2e522b28ddaaed
SHA512 f096ae3b3741fb173da9d8a31305d2dc3b30f2c61636c6a69529e825851f16ad787df597fcc60f2f777bf372a73339098f31e743b1ddd7d104e152f18ca81923
SSDEEP 12288:KVUjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:3jzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1E255234CDA8F00E2E53663B094B10222F2F2FDA5E6511BEF5721592D6D74EF0AC66B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9e839805db0da3223d7ee2db300d4c054ca91f26e8ffc3f8f5cd86fd2ff0a3ae
MD5 e7c7760a10525c11a2b45611f9b8de12
SHA1 2be36c6affae05324e2d18c6a5e18748e1b84dd8
SHA512 5d0c1ab488eff2cabc9527d74e3dcd0dc8396b585f4ff88594d7692e61311ffadbd9aa648814e10b69ac7c8adacc49bc6aa631bab4c511efdfc40837c42512f0
SSDEEP 12288:9Mjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:9MjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T10F55234CDD8F0472E22927F064F4036275A1DEAAF9C11AE55772A928BDBCCF06C8765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ad0e3f2c586ba52cb56ef6f979cb58c37f24c5a7d46aad03406e807ae71bf21c
MD5 f0f4b7a28341ce3ecf754e9d6db4345f
SHA1 89d06f84860adc87c4c1952a7b9490a43879cd83
SHA512 c0fca06946abb6bcd17508e23eac45d560b7fe4b43168f0303801288713c4af50f27b45739153aec0b18141e90747ca28e50f7b109a0b3bd870250512a703871
SSDEEP 12288:rLjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:rLjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T15055234CDD8F0472E23A27F065F0035275A1DEAAF9C11AE55732A929BDBCCF06C8665C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0839bc74b1b6d0772336216b594b4903cd441edd628f61e7f1bc7fffdf90eb86
MD5 c8f34d623a28adb5a506e5cafabf7d01
SHA1 3c22aa8e58e06db6a0618e10711ab341993630e5
SHA512 0258c73adeefbcf3b4cf2224b6001992e9f2764cbfef183680e046b032adb13eb034a57f98f187079b6d68ff843a126bd706199ced8ecebfad8fa8cf573d976c
SSDEEP 12288:Kfjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:KfjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1C055234CCD8B0472E23A27F065F4036275A1DEAAE5C11AE55732A929BDBCCF06C8665C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c522213e69e971b0d8388d977ff977f664f2922bfea62bd47ac8d2699972fe04
MD5 9e9fa5d066159a2cfce883d85e7c89b3
SHA1 ddc5d25c546554182e8031b3b0e3b52115fc228f
SHA512 196872c1bcec91cbad5eb942a75dc7ea3f13febc57ee7ab73c6c35726d168ac3d59a778bc81b7853f07ca21c06ca9e2b96b456ce4e4c04ebaa7997fb7fcd4e1b
SSDEEP 24576:xZM3zFVSOnjzWDwCmTPPk/z5Zf5hz0dNUX:xZM3zfiDwCmTPc/lZfuN4
TLSH
T1F6750298B39108F4EC77427DC8654916E2F2BC6A4BA0C65F03B4362A5F777A01C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 52d10387d47b2074c1146986e87137d80eeba5709db93727b91b11c86ab3cae2
MD5 131ac70414bcfba483e87532ac1f3bd8
SHA1 1573efdf50345a0f225d1180c066ce7ff6f5af4a
SHA512 41d3312c5df7087214a6cfd74bd866fc51e6be67d7f9579b432cc9f98c1a4dd7109fcfff95b7f24ea09d90a4dbc3bb54a573b103fe6e2a0ea775f76404055690
SSDEEP 12288:7Ojf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:7OjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1A855234CDD8F0472E23927F065F0036275A5DEAAF5C11AE55632A928BDBCCF0AC8765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e71adb0bceb9dc7f35520b229d4a59a96e1ffcf125ad3fc0fae919dce41e27ef
MD5 7ac747076e31d286f40ed5a66010a098
SHA1 c9b829e0b73f10de419a0c9d659233d54771c538
SHA512 8f5f10bfc47823e6fa846d0609b22cd6fa616f2463b3e010a006f807ef63d2198868c0ec73f74dca6291afe7befd420ecd077b06122d36b5c7cddf3f3af1899d
SSDEEP 12288:o6jf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:o6jzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T12C55234CDD8F0472E23927F065F0036275A5DEAAF9C11AE55632A928BDBCCF06C8675C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7291627f692d5e51b445d18768dfad6ea1ba6bdc7a70f8e874d75acdf3d6e188
MD5 6ff6d3d47abe761e1897c4740b751977
SHA1 7224c31898e880e1c6b0f05b096d6ead7a3b5d63
SHA512 e7f2da515e1164ee1ee8c7233ba124aea88f12cc991b5386b80236574c218ed8c00f36a663a1a205ae5cbdfbe411c408f1eaaf95e312274c24b9878b856bb63c
SSDEEP 12288:AyPz5L8zjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:xzyzjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1A665024BB79620F5D136537488A10612F3B2BC7697604FEF1360467A2E37AE09D7BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b141445885ab66e594b4e7d454323be34680358bd9445449405437068e512a49
MD5 39e7b09e2173136cad869c3270e3867b
SHA1 3b7bebde8969c53fe1ffba0ccf8917942deebf5c
SHA512 573b78d8311660faf8d8fff752d423ad2807248dbc33d2ec2f91dc0da368940f7dbcb894b6b204bfb9ce26c136328a456e7493dc8baac647020a01829a22df93
SSDEEP 12288:cOjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:cOjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T19B55234CDD8F0472E23927F064F4036275A5DEAAF5C11AE55632A928BDBCCF0AC8765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c39775c8b6e428804907b4d0006d04094934018332da319f6b5ff893253510e9
MD5 dd23322e6ffc5d91eca85f3ebad97a7c
SHA1 20720963f47cfc7d560b72a4481a3f5245a6abf3
SHA512 87abc3a9d8f42e98194d2e6dfdd78c5d8ab17e63eddf5d8f439e36b1424d745c79994ec503b8169f43527f888860caa8221ef4b0a3af9546d80457a4969318cc
SSDEEP 12288:nOjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:nOjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T17755234CDD8F0472E23927F065F0036275A5DEAAF5C11AE55632A928BDBCCF0AC8765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6d597294a67d3bd9f8299c80a6d18294c76a39c1ee4902db4f671bf3daa0339b
MD5 0a3597f897da14b13fb203c174eef7b7
SHA1 fbf4e5e6b17c2a726ba6db6792c8f62ac3f20fca
SHA512 f64b8bb78bb1427dd54ef4344edee7793f48843e838b9fe554a69fb75e078d82b5b85ecbcd7f3af4b788e34a349a256d242acbe6f33428bd146a91d3c69d86b4
SSDEEP 12288:syPz5L8zjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+A:1zyzjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T18565024BB79620F5D136537488A10612F3B2BC7697604FEF1360467A2E37AE09D7BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7c6e4787be89a23365d90e57ec2c1c21527aaa3b776250c3d20496dc749c8bcc
MD5 16232f8334216980dfef0c1d8b0ea526
SHA1 38f13a6a8122878c86587837518d9f40a0d3bef7
SHA512 ee64ea423fff74dba25c715451f26b476cf209c8e76eef15635b690f5edcd5c444eba439c1c175060a9f3dc382576501468ef0dc1eeaf2d5116f5d1a747e5501
SSDEEP 24576:KT8aLl3z0zDhjzWDwCmTPPk/z5Zf5hz0dNUX:KT7Llj7DwCmTPc/lZfuN4
TLSH
T155750298B39108F4EC77427DCC654916E2F2BC6A47A0CA5F03B4362A5F377A05C2EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 580a6c37dee88b42fe9fe76b365999d6bc6d873a3bfa3da983b9713e3e7342da
MD5 49c2c655180da0f130f32c648444a761
SHA1 d355524e31865b115737258dd974197f2768e298
SHA512 66612cfde1c4f2cef14ce73afc6c5d3a164e44df55379b8f1312851e246cdbeb9a44fe6f515ac2c28a195c749c1efc494b0f5e440014bef91fe0401da074db2e
SSDEEP 24576:D3rd9CHKy7GZVjzWDwCmTPPk/z5Zf5hz0dNUX:jrd9CHKyaiDwCmTPc/lZfuN4
TLSH
T15385CF90F3E400E4F1B79A358D764512DAB67C9A5B71DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e0757ce5647a288838d738e6b4b6ea764de4dcd9f8da5cac0824928c2ba5c0b6
MD5 485c65c23624b1c27b3dc5fc871a58b9
SHA1 5ed75a45dbf0f7c4d3de92df77eada4e03c9f6bf
SHA512 93187088913217eb3466c806a15dd0ccc12fcbea464cbea7ae48666a970e85858ba44d64f8efc43772c1166d71e562d61ae7c2b6f6f79e47375ba035faa8486d
SSDEEP 12288:mxjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:mxjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T17355234CDD8F0472E22927F064F4036275A5DEAAF9C11AE55672A828BDBCCF06C8775C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 abd7aefbd7358680284ea342825351c8c4be97f2aa3ce1b8c0f6b9bcd5be4882
MD5 e1981b03038f7017d78412db6b56dcd8
SHA1 c100d1f6f6c8678b073cbadbff6edb049aee221b
SHA512 5d1229b618cf68a05afedcf47bca8a1ade2c316e3dfda3e30a046e984b5d41ed79dcd5b8884fb1652557aa71653e6e7e695f60750427403e48e559aabac2d890
SSDEEP 12288:jTjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:jTjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1F355234CDD8B0472F23927F064F4036275A1DEAAE5C11BE55772A829BDBCCF0AC8661C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 95ceed82d5de015b15f52417fd6066b2b1317740102025e1241bb0b8589673d2
MD5 b956854a7bc22c5a5c33b9d4fe61ffe2
SHA1 d600c097b2303da9aa1804fedb462bbb4fe867a9
SHA512 9c2fbcc1395481462789f8142adbda840a9045c96e9b800cf5e5daaf57f918ec8be8c9462ed51964b3eee066bf441be83a5a330c73af4b38acc57244b87174f1
SSDEEP 12288:ZQjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:ZQjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T12155234CDD8F0472E23927F065F0036275A1DEAAF5C11AE55632A928BDBCCF06C8765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f47cc03ef2123caecf6438be6556f3ea5d04e3c47056f358599ec2ec761aafcc
MD5 6db745127f8ade3e9bfba3c119bdb521
SHA1 364f53cae6b89dd048505d2ab37ae01ee32ee236
SHA512 bcded87e9671f67229ba43c8a69f9d3d2af31cd1f1fec9abcfa102c24753399c0e3bceaaea4ae2d250c838806a82051df2bbda11d5fe5e8883c252511cad5b09
SSDEEP 12288:8Ojf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:8OjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T1BA55234CDD8F0472E23927F064F4036275A5DEAAF5C11AE55632A928BDBCCF0AC8765C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 543e69d5ac770b044a1622e5752b5f14baf92859daddf49fa185cafb11f68a21
MD5 52f4a420e2cf0cc89f2e42b6affc2bca
SHA1 0461803bb69cdc05a8cd0fda656f8a9f905642c8
SHA512 11068c68e548f5ac0ee0fb0b8e7354d498df8822faa49daf8f0581e3ce5b24aaac715a9a674cb35841b51b7dcf9587d1993167a75942cc2974f59dace66af637
SSDEEP 12288:Jxjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:JxjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T12955234CDD8F0472E22927F064F4036275A1DEAAF9C11AE55672A828BDBCCF06C8775C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8144c886d848ca0221530b05afe8eb9df8e57e47410dc269a65a192212998919
MD5 2155405ea2c6473c854a936f3c3449da
SHA1 53b9213f1037aa226eab04497e9a42d8ce9c01fb
SHA512 3493dc067b5efd4a42bcdafc63917017b0417b52c033a2e3eb65d4477822d3c2e27f812c0bf32d419a90b40cd21ada58c7155b5edc0933bea049cbbaac0e2c90
SSDEEP 12288:pmjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:pmjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T15E55234CDD8B0472E22927F065F4036275A5DEAAF5C11BE55732A928BDBCCF0AC8761C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9740c7da122f8557c5a961a5157f8fa00e00718203be8bbc004952cde5057c60
MD5 51154f7b5ea35f3d3becb1af8a135001
SHA1 da8d7d887e4e1a21669e8d837a95f84daff8d405
SHA512 a211d6310f2bd437902a477bab48669f4e7966c546f89c015952d8135f63e51a869add00e46f256461e05a92fcf4718ce9ff33ce1fc751ea58426ef91e1348f0
SSDEEP 12288:xMjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:xMjzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T11C55234CDD8F0472E22927F064F0036275A1DEAAF9C11AE55672A928BDBCCF06C8775C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 602a9b52749daf779616f4cb07cc361c8bc557a5d04c6a65db70f94c5cb1d4e9
MD5 b4eb1902bcc70b421134590fd3d2be5a
SHA1 b3624c95cd74d77666e1f4e4d1ee7c142eb4c1fb
SHA512 3bf9c92cf2d0c8b3c7389971f18313b45e0ffc153cdb03ac9e7e464fb71335911fd4f647575f51386686a07c644dd256eaab83970b56fd2007e43762d4d711b9
SSDEEP 24576:Ifwvzk9RX6wkyAIqjzWDwCmTPPk/z5Zf5hz0dNUX:7MnYIJDwCmTPc/lZfuN4
TLSH
T14D85D029EBDC04E1E177927C99B3460AF2B178695B31C6CF025A536D0E37EE46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3df6015785fe8b5c8c80069aafdf4c3e531205946aa987e84f28c6aa29fd7bf8
MD5 2aa7e63787391188bc569f8340d8b224
SHA1 431dc70ff351a0f27a80d61015a2fdff40706de0
SHA512 7cb698b905d7daece2e492e748c9b3c2e4b38d58e445fcf99a4298a850d9b5c78abfa9763992b46b24056f73d7bf88f5d1d9e77d6a15b092f4980534af169917
SSDEEP 49152:fYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wDwCmTPc/lZff:CySzPuwCQ+yN4
TLSH
T178066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4641dec20f67557a78455e8e4be47531f86f17879319ff0ee642da981433a939
MD5 7bc87ec3a4cbe465daeae7e2ac1babbb
SHA1 057a31b2d3c314fbaf55f589d9c0c770e20576b5
SHA512 33082beed8bd07873d54da583d27a8f279490b7b549057cb0acea666bd009a3682e51e342834747e3cc62bc5814e2273c44cb4f7751076c491b21f8fab13ad6f
SSDEEP 24576:547Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYXjzWDwCmTPPk/z5Zf5hz0dNUX:547JUQjqirIhCnDHUPfF/gDwCmTPc/lR
TLSH
T1E965AE1DA3EC01E5E1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 30f7a5dae66cb4bdd4c98a1ab400ad9b0f7aa0f9cdc95c0b0f2b3843824b61da
MD5 464062a5b8f543fae65a120ad6e8da5f
SHA1 aa8b7906cb78112660fc0121b3fffbaa003eebcd
SHA512 33fc67c6ef26f6bfb7b1e75c62b2881d89311eaea1d2ec90f01b334dbac71f09061c1b03e95291c0fe286ed466be42cfb18ee21d06cd51ee522b2ee3e2e78a95
SSDEEP 12288:npsfejf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:IejzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T13E65F109D29901E5D06E22B4C7A50641B373BC6597E193CB53D0F93E1F79AE0ACEAB07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 7dabe8fe828c8563befd6f404376cf4396d0d58072116b419b1840e5b06589ad
MD5 4db7a2ccbc473b703e9438f6bae4c40d
SHA1 4278099abbc3b2db5e56205b52694ddf34e21d01
SHA512 8f07f85a262733ded0db2d3b64abe16b2bbfa0e8a001b1b10de81bf21430a2c537cdbf92e94cda0116307745d53b7ec85ab8a05f8e9000c297b34c5dfcb715d9
SSDEEP 6144:KVsBC2nareC7B9DLfwUAET92CotMxzDD1U3ftk/0IfnLSlLTgP04MEIYUeGyjtFI:KyyG+5U3fxQL+LTgP04segdT/4OjbyO
TLSH
T128250610766BD75FC6A940321E73C1CCAB707D41EE05AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 49d2eaaaf5d005808df7170eb0daea3d1020f60bc00681b4d7a32877c61534d6
MD5 9e4e2b16029dd951df6db4baf063597b
SHA1 997c5524cb30be5f8ff2bd242c27e90282f16b25
SHA512 e91950d1e5a4b5db27481fce7bf00a3ca41587ff801c48871cba1c211680f6adf688af678211addd795b9d46f0c2f4e801ffd4a02cdb028d4dc94b7c9e6015bf
SSDEEP 6144:q9DrlKFokD0xABh7bjnIar5+UrKCJIHAhhFRuV26tMxr26tMxQMegoAudhScDvYs:qw0xABNbjJ5+UrKC2gvTImhSsvYCT1
TLSH
T1D555D7816437A3CFD1FA6032076A5B4CA764EC17B7096F2663C9453DD82AB25A0F83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4ed0edddedad57efb34f367d12da2900d957b33a3ba2ad06c76d191da9305b6f
MD5 9211aea017e336fc245e5d7ec9f8ec47
SHA1 e76d070af92aeeedb3aed9135c75f033c25c53a9
SHA512 528840e2bc40ca2fba243019e2fe15e064ab26129a586982aed1e8b8692dba3f889b3a6204be28a699e3f4995125751069efc711468e32bf77f0d44a9ebde88c
SSDEEP 12288:dM72jf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:W2jzWDwCmTPPk/z5Zf5hz0dNUX
TLSH
T12E55235CCA8F0422F57A27F064F502317266EEB5DF801AE7A521652DBC78DE0ACB670D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 73a63de950552b197506f335d611686ad76738d22a74a4cb4edab21aee78a0d5
MD5 11aaef54d4c6fdaf4b1de02992a2d426
SHA1 b85f97bc85227c06de885383a07f0ff8d28d95aa
SHA512 9a38bc70a570e0f5b949586b8a2cbc90209a27afa92b35c4c89022de163a400e24a238c2ea9b61f9c5bc195d30bcec7eace0ab91f9d487c6ac1bc815c642caac
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bY4jzWDwCmTPPk/z5Zf5hz0dNUX:Ngb4mBIBhGFeDwCmTPc/lZfuN4
TLSH
T1D565AE1E22EC02F5E0FAE2B89DA64417D6B278164731D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4b5e1b067825f2c105991ece1ccb779391dc78f929ba32e6fa4c22474e6f508a
MD5 4ec56edf5dde2f5d3074de73557ec2bd
SHA1 e73577d402010b9798b7d2cc7455bca031d5b7c8
SHA512 95e3e8a3cf1e69c2a707f7dc6cd0b44fbfd9dc4b9237c7710aae6f4d9adb0dbbaec5556b3ddf2d912903a5ce09fb8958d7ac19dac44c7b24ea18e8a04c2cd432
SSDEEP 24576:WG88u8FpJqH1vzria7/mnjzWDwCmTPPk/z5Zf5hz0dNUX:97ZFPqVya7/jDwCmTPc/lZfuN4
TLSH
T1F085F165A6E501F1D47BD13889920663F6B2B8250364EFDF07A88B551F33AE44B7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 4abd5aa01582f2456fa0d952c38e4adf3dc25db237975b78ad02a9d176dcdcc3
MD5 4f3a9a5c7a27e0c34309c6f1ad39c464
SHA1 b7ebe14658fd109f7753d323ea6fa437c52b63a3
SHA512 870a035121e1ddd50fa5ef23e89027b659aace69539b86f65d0c61cad3c588d9db2bc13c94f053058d9b043e492d7eab54754cb0ad912c379f3582153f33732f
SSDEEP 24576:APUr+NQ7jzWDwCmTPPk/z5Zf5hz0dNUX:AJQiDwCmTPc/lZfuN4
TLSH
T11A65F11F66ED08E5E67AA17C85924319F772B862531192CF02E0813E5E77DE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3a8c8a8d5464c611ccaa93e1adf96b584d8a10c4180d96bbfe9059417fffa579
MD5 4855218bc86fd52d44023951093bdfe0
SHA1 78f06bbc07dc82da9b6b6dd1a480adf7e7d5e41e
SHA512 cda13d95ed59e7b7b7042810cfd41a737501774e40aa0e5d5106d507aba8694c7967354bf9677b632a8f02af20cb7b1b6efcee87f4f5d2c59ff5577422589207
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyDwCmTPc/lZfuN4:pG05lO43bJwCQ+yN4
TLSH
T119D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 33604230cf69fc91b7fe97fecd7f188bacc6357277e337135fd9547be0934a5c
MD5 8829285005e870a82360ccb1030a41de
SHA1 08550a7a1b1350662d4abd0a80b817e3311ceaea
SHA512 a506f60662585e346d03280418fb430687497b5abdceb33bd4aafca984d653f1a836c3d7cc311d3c6f05d51707a3f144f8dd24ea19b76ffb72fbe1a63c7dffab
SSDEEP 24576:Rfa5POZ3dpyWVM50JicR2hG0lasx2+47eidntjzWDwCmTPPk/z5Zf5hz0dNUX:xa5POZ3lJt2pasx2+mKDwCmTPc/lZfuO
TLSH
T1F165AF5EA6FC01D5E179D17CC583461AF5B1782653329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e115163daea312c876db92e9458ea4c92e3edc19b63c28e09d30ed4da4e1143f
MD5 1e3fbdbe78d1cddf9e8d1edb629e5946
SHA1 79efbae290720716eddca7ad3ffa4200718cfd06
SHA512 6acf9cce07c4615f54a0bb565a40098b245d27c065b5a97dd32cf4f3760b9729cc85029f2bd435858ed4921cf40f31cfa76e413e5fdc201d027d5d0fe94f5f9a
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkvjzWDwCmTPPk/z5Zf5hz0dNUX:fNc/zEOVHFDDwCmTPc/lZfuN4
TLSH
T189857B1A22E901E4F1BBE1BE89779546FAB1786553308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6008ead96b310810f210abc0a0864f0557a7bd1fa7446746fe28bcca32d30217
MD5 8265132b3c9feb5b5c220d8030acaea5
SHA1 8acc16cbdcf760980a6790616242b742d85b1fb9
SHA512 d5947679ee93593d8fa6251f935894cdf6b91c2d2504d01b06b7498c2ba4a2da98f1884369a536842e9ae524ee80b53b65e98125473764c64c8bf52fa763ea66
SSDEEP 24576:HzkNvNnaFeYhJNtmZBmZjzWDwCmTPPk/z5Zf5hz0dNUX:HzMwBtOm8DwCmTPc/lZfuN4
TLSH
T1B955AF6EAAF806E4D1FEC6B48D238512F6727861073253CB5390C13E1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 822e418bc862f4fb2a1d9df8e1dd82787b4ec0cbf58fd1b2866ac583575e4279
MD5 a8044af564262dd8ed17328a77826e49
SHA1 759c0da8a6e45498a661bf523bb49b518abe1137
SHA512 10ca3d1eaadff197e91b0ac41c0758f321fbacfc24f99907c3bae9ae71a1439ee5f893e82b805bc2b3dbf8599d0d0f48280901477c4667759f9883f2ba93112e
SSDEEP 24576:eD3FHshBIYQgASjzWDwCmTPPk/z5Zf5hz0dNUX:eDVHeBIAAhDwCmTPc/lZfuN4
TLSH
T15575E13DEA9D04E4E57BD2BCD6634606E77138A9032256DB0290C1B95F6BEE47D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/300-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/300-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/300-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/300-326-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/300-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/636-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/636-133-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/636-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/636-135-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1136-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1136-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1136-73-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1136-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1552-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1552-83-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/1552-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1552-78-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2584-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2584-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2584-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2584-278-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3084-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3084-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3084-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3084-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3444-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3444-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3444-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3444-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3448-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/3448-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/3448-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/3448-0-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/3448-76-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/3984-114-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3984-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3984-120-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3984-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4876-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4876-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4876-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4876-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4876-23-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5544-45-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5544-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5544-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5544-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5544-48-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6072-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6072-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6072-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6072-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6072-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6072-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download