5e7e58c025a5b613103ed53c6a9c6ea8d0b3bfb58eaa92e911b1a83f3f36c71c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.2MB
Sample260731-aymkhsab35
SHA256 5e7e58c025a5b613103ed53c6a9c6ea8d0b3bfb58eaa92e911b1a83f3f36c71c
MD5 02a025e4068e128d8b4984f531884ba4
SHA1 e4ebc560e91a2dfcd03ef3b63c3e09d61977d14b
SHA512 d8736c0de3f86b2fb76dde1f59bcd6b756f51fc20aff47b906357af513304d795e7d67f2710a9faf86849849f915bdbb2502590848be29bda086d2033d563ae7
SSDEEP 24576:YXBudxWZQZLZG4e9LEr7II1ReXHXVxI9Xozsr8zbhN6GwXOGIh4:8uA4KEr7UyXozsr8zlLwJIh
TLSH
T12045C056B3E401ECF1B79678DA611512FBB27886473097EF13A016570F3BAE44E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
2076	elevation_service.exe
4684	elevation_service.exe
2588	maintenanceservice.exe
5464	OSE.EXE
3604	PerceptionSimulationService.exe
256	perfhost.exe
5728	ReFsDedupSvc.exe
4780	SensorDataService.exe
4528	ssh-agent.exe
5584	AgentService.exe
4864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_f46cfa9aaf1c025c\mshdc.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_7c5144127b6ada21\hdaudbus.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF	dxdiag.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dxdiag.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dxdiag.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Colors	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b14125d88420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fe60dd88420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f99391d88420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000365456188520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004da167d88420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f92884188520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000222a2cd88420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{3C2FD62D-189A-47AA-88D2-5C68BA6AD446}	dxdiag.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f483accbfb42cdb4c42b0297fe99a87c6410000	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
1764	dxdiag.exe
1764	dxdiag.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
2076	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	5728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5728	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5584	AgentService.exe
Token: 33	4864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4864	SearchIndexer.exe
Token: SeDebugPrivilege	908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	2076	elevation_service.exe
Token: SeDebugPrivilege	4684	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
1764	dxdiag.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 2864	4864	SearchIndexer.exe	100
PID 4864 wrote to memory of 5396	4864	SearchIndexer.exe	101
PID 4864 wrote to memory of 4356	4864	SearchIndexer.exe	102
PID 4864 wrote to memory of 4916	4864	SearchIndexer.exe	103
PID 908 wrote to memory of 1764	908	2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 4864 wrote to memory of 1980	4864	SearchIndexer.exe	110
PID 4864 wrote to memory of 5248	4864	SearchIndexer.exe	111
PID 4864 wrote to memory of 4088	4864	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\dxdiag.exe
  dxdiag.exe /whql:off /t C:\Users\Admin\AppData\Local\Temp\dxd2977.tmp
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4780

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5584

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a7dd2ffb65a7e2276145b50399887f89b5e11c4ea3d6f831676d3c4915c1a801
MD5 05b5b2a148a002cd4de7ef6cc1b9a64c
SHA1 982cdfe79b3cb7e096d4fe5d88c3d23ea91d67fb
SHA512 4de11ffc63992b340c6c9a6c69abec6fcc9344c47bef401149dd139148f7721bfc5a318fa5b2c954424106d1c29db893619a76c71d0f66b1efd827aa9602c1ae
SSDEEP 49152:cb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnXXozsr8zlLwJIh:G3q60jB+wFRKIh
TLSH
T16DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 5592a1649a26e552703ec29ee5dd01b7398fa15924ba578177ddd2aecba07376
MD5 24503ddd9ef4836822ea060c5348f7ab
SHA1 3e3e5a6923ad58ebbe46f086d2cc7a012d8ba3e6
SHA512 35417e8988f339f1851e636d45e293e6bd6eb31f904fba23e258eda01891c70d7ed1ff37d68db0fda37e32384bb61e94d6f9688bf22c5a6f89bc0b08f3f10541
SSDEEP 12288:K1XLsswWkxy2lRq2czAIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:AXYfDtczAk9Xozsr8zbhN6GwXOGIh4
TLSH
T139850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 93833486b62003a0fb3c523f73abac0189973cd520949b2dc8a6fa406880aec2
MD5 986671acd40e288248d7cd8e6b83766a
SHA1 ad8d72ef4967aae14da0ab1c6aa08a4c305836dd
SHA512 42ef464cb1a1dae6e2dee34b559d2acd2d154fa98776ff5fc12e3b982da3a6e355dc3ddb2b29362c4245841a167e6bc0109d1b8622aed7f86e64c65817222da8
SSDEEP 24576:Z0Le5ji0hmx3rMt9Xozsr8zbhN6GwXOGIh4:ZPji0Ah0Xozsr8zlLwJIh
TLSH
T13CA5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bddb2c6a96cc2382d3ddbdc7c00f9b263d098f168ec1fab3d8838894ff8179de
MD5 f19fefe0617c5f962493c3ef164d38ab
SHA1 fdbb0e2f6b757250dcaddf48736e1f8852a90bed
SHA512 94ab7a3fe4939b649224e6e622df4e9e14c70f2f262963c6a5617f466d06d674e4a3e45a922a0a0ff95be2ca5adf6578d2e9fcfb4eef032d711e03058ffe0324
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWr6q8wyur9Xozsr8zbhN6GwXOGIh4:J/ezSC6vUzPviHjyQXozsr8zlLwJIh
TLSH
T17B755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ac99109003e811341ec6c344d8b622ac5196d4c20d490df17cae0336ed58da44
MD5 62ae589783fad6711afd3d096d1b5089
SHA1 a67961420e7be20b90757e9bb1dfa21e24eec466
SHA512 c5b8fdab4741aed802dbdea5c847aef0096bdd9d266241f291f525917547074550101fd2b20815bc4fd109f9f2b51870b07cbc3bdb558a6e3d6fe88ad4864c45
SSDEEP 24576:BVbqPb88hv/l+bY9Xozsr8zbhN6GwXOGIh4:BVO88hXl+mXozsr8zlLwJIh
TLSH
T12255AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 e55f3ad5752a23bce7707df67279a93be0f5a5ed460e07c688fec946e7f5b0d8
MD5 864aab2eab61ed38af00db31065b0b14
SHA1 466e4f31049b738165df9c7e2d09cfa7661cf260
SHA512 abdf55267e70e81205d3feb92036b220551da5c5620f80ccc2fb2191431aecfeb02f5058a074f30b3fbdc629f07e0d0edf1fd41485c330720c6818b78371c905
SSDEEP 12288:cRjksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:cRh9Xozsr8zbhN6GwXOGIh4
TLSH
T1AC6523F7E691A442EF671F3139916AC4DAA7FD9E49C11B8112382186CC7E476FE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2182f0a0262ebd78a3b4ee00d7673ec1f16b20fa14fb52e1ad62d0691e33590b
MD5 edf0b6a557b0c3ec0d36ec5509c6dc67
SHA1 ac547c6ebfd88d04013a9f7313252d987a0dd19b
SHA512 97848bb6a6af05d1102f88f3b1f3dbe682bf5536ba10976072315646e0991ba4f46dd76c8b076e8fee7bd36c9d149a981577f20bbf6f404b7307274a0356b018
SSDEEP 12288:+eBNUbTVO86UUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+JIUA9Xozsr8zbhN6GwXOGIh4
TLSH
T15B85DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dda8f1785ff137195891d26a362cc278732bf183873057937f2345998ace3e86
MD5 455cb669dd34c9131dceffcd07699301
SHA1 0edb756e2d21fb9e15047d07b5f270369a1ec072
SHA512 0355147e4405b9e022c9af8590e575545c0fd76d7051ca18811507bdfe1bb3a4b57665fb9824e01ed93aacd0d393e71247871f4dee5db3c08fe065cc38405b9a
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THN:LQvGAdlCEL8c/RRNw5CVwFRKIh
TLSH
T1A0267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 431388c2486802861f826a55a280e7f732bab09fbb74387373cee39add282650
MD5 22ca64bbc7f284faf00c0a7fe35331c2
SHA1 8514d0fd38c1cd16f4fb0e6be307093cb6838919
SHA512 ea3b665fb97a19ecba4b1034320504bb6b805767499e691293fdc5267fc3244cbd9ff9f72c35f792898700008a037c2a5cfbab66effb7fda24ec82c2298fac91
SSDEEP 12288:sAwSfxL/2Dc3VDLLmt0LDQewsAjSksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:R4ewsAj29Xozsr8zbhN6GwXOGIh4
TLSH
T18E85E031FE74E032C7BB0DB21B26C716587DB9604B911AC3E3B8498E99741D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 17207c5a8647d34664d4f438621220d55991fd110b21f0dbfdcadb4275d314c1
MD5 75d490101224858bac9a40d4d934b2e0
SHA1 b2f26bda2df1add4e40a799b6cf357a2b9f410cf
SHA512 a8eb3b1385b93367683b47d16d42e577f63cacc243a0bfdf83d56800080a13b642bbc6417f5fc44dc54ccc0275103a3986eb0cf8747e57af2aa592a71565ed14
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH7DKI:CUEtQevvqc2W1cpV2RI327D
TLSH
T14A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3759ec8a9fb1ede67e28d3b33012b1a52456838114381c0b8f661f9db758a126
MD5 37f562e0416ee0fc0dec930630464e3b
SHA1 d7ce503cfceeb7926c19c0c5ab98854017fa470c
SHA512 859dbd459f3236d0dc180325c3f281cfd49385afaed03092efc820369328607ed9d4bc874439fc1263004a6ae5a585303064399c5489d5f24af21b4e3c2a4d0c
SSDEEP 49152:ECbRquA/m2yL5zifFiV+XenmE3/zkXozsr8zlLwJIh:NoqHVjnmBwFRKIh
TLSH
T113D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4366f5cec6744b91d8b1e20b0e9fcdee2b8ab4006c602082783af0d62182e4e6
MD5 000e26d50e000330ae8cd4f836ba324e
SHA1 52b7a29238b83d0a205c96807315ee6398876d85
SHA512 d4f48475c2e13ccd9eff15133d25a42cdffaa18c6e82df748af4369a2010066f322d77e0f14e19323153275a140aca5e6c3966ad9c849ae6e070f5a1ffda91b2
SSDEEP 24576:zAhGL2IFoiwtA5l7S53n9Xozsr8zbhN6GwXOGIh4:zAM1Foiq5tXozsr8zlLwJIh
TLSH
T1F2359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 74b078c63130201b79ad327afe0caf2a7747fedc549b4676b0cfebf57bbb5f82
MD5 c292e64cdaa1d2546d71947d2e4bf075
SHA1 5c520861ab424370079025a5a111942d882364f7
SHA512 5440aad0baa5dc90ca8b68c3ca1085358f6629b106958365f2aab58e8961a02cf70d5507c452ffac3746505573a46b3a61f0fd8043ddbddbab841a5f5269abe0
SSDEEP 12288:/mw5HEjsChNkBFgl0WDm+CdksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:+wuVOWi9Xozsr8zbhN6GwXOGIh4
TLSH
T13C85F14A76A41CF9EA6786398587C535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 96cbf6572bef9d40d24e1ee014c0e73ad7868d95bab76e09b426406e37cdb575
MD5 3d054af6b4791853e0816988aac526b6
SHA1 80e0ace5f9ec147e083d66733c144861e42774e3
SHA512 fe3a21aaba6e97031398cb18871cef8afa0b440276413a1b02195e603449d043c6c9218a56244dc358d64f3a7e9ea215f1bcd329159686e9b253288fa29b79eb
SSDEEP 12288:XZZ1IyiksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:pZuV9Xozsr8zbhN6GwXOGIh4
TLSH
T1247512AB73E070F6E6A3473898E15A44D7B3B856577203CF123802965E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 11913140af099d3cbd29b6d4d64acbdcdc9cad9d5cb514914ef97f196848860c
MD5 1dad6545bb0b7d2d7487bc413b45a7b3
SHA1 42c415d18abf3489539cc88d4b6fddec00cd4e0f
SHA512 a09598f2b0abf55aba5871002783c8b1b61bea71113e4b35727d2c93cf368da0f089d029739f4115115b3750479dd5534151daa2671f8b71f7969dad2b8554b5
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UR:/QRQyi36YOcPhLvw2gAf+PN3CwFRKIh
TLSH
T101667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d6e8bb986ca12704f1c80cd3365ca36691acd68e2aa57463c2b57c367c202756
MD5 7f5cdcc7b4a07b1423ec6daea21de913
SHA1 79f449e0950ff47a3974928a63c5477870a6926c
SHA512 ee2f2cb8c3907df8869200df5d87a0afb565aedf28174aa06cef8b906cf878b330f1f74dc9e6918e1138dc06380f410fac0c9aac84c8c13cf3368d983ab18ace
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UR:nQRQyi36YOcPhLvw2gAf+PN3CwFRKIh
TLSH
T1FA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6a92fcaf49d12bd62799179b6dbdc0f912a375b4902d8723beef36430591d905
MD5 5e1db7501d769652ac1d3d811d2675b3
SHA1 91c1634041d32839779668078ff65d8d8a3e27df
SHA512 d55f1adff13133396647293e5f68ddc9add8a99b5d517d985b4d5dd875f641fc1dd2ef4c89b75d1d3f4b01acef2ba36d69f00282fd9ea537af1b1bd8e4928f95
SSDEEP 49152:s68Qg55nhceWu7PNU3/0Xozsr8zlLwJIh:mthLRc/EwFRKIh
TLSH
T138B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 14b4f037f363c557ed4e6c331e75c8c68c8542d399f2c2e1b7d432ab75d447d8
MD5 db7ec5e452c235554b234d313893d50f
SHA1 1bd780f60b991c8bdc0a2d9580cc5929daff110f
SHA512 322e6673a18f0147261ad4d3a891067d62794bcf6585b332734cb548eb7418fa02e25b5a0b13be88eac1fe38caa6e704fb3f5eb0c96a4e0b9fd725c4ec3faeb6
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk997:wy5112gYy5azzVva69nLKnhZzwFRKIh
TLSH
T1DC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 faa73235ffb101e817a003bfce1d4ad61d8f6923e8bf0cdc0b8b2ed023f96ec5
MD5 9495c12f93b856fa3ce22a1c0937c41e
SHA1 ffdc59cbb82ca7a2de6d1acaea311936dab205d8
SHA512 3f0a145f4889e3dd83655486b2bb528cdc9b6d787da5dadbbe1299d3921730a168f98fd2cb30849491c9b1ad7e594cfaf1443e36832ae2a7115e6d0a2f7534b6
SSDEEP 49152:3B+taZ3usBWOBr4tEG20bqx0z+n217aau1glOXozsr8zlLwJIh:Zu6JmUxd2dqwFRKIh
TLSH
T1CBD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0b1c3832226d06574b23a41f6cca154204356506b1eeb481b1a5a38781ac1a22
MD5 71cc4ac2f8b4f6fcb8d9649f397d4301
SHA1 934d36683579d3b33cd0f09b6948b3817bdc0c61
SHA512 ab34ca1458e9e138d2993f17189cec56ddb6463e230fc9dfc3e0acfe22a7dca1720e3aeeb20cb53df172d581a4b1faecd29c520363f7d6f77852980b4fc3c32f
SSDEEP 49152:71hpsNoJpF1A6BU44CwH7R4x6Xozsr8zlLwJIh:7mifPkRBwFRKIh
TLSH
T199B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 904f990287c5d9c620d927620e10c407694c27d95588aa32d7bbdd2434dd28ec
MD5 59b97e0feb74ca1faf6510b24b897438
SHA1 4c68e983c0fe529819d9d2075bdd6cab2a97f821
SHA512 7d9ad084ec12cd18335a96725b686ba9f0a8a61ef92a9e567c829bd9b06f7a05d9a21c3e8d6593b1e981ab23016cdf2a18dbce7c052b4f11ccb73f1be2befaf4
SSDEEP 49152:rSuZQIY0Be2KNRVtOnks6NMHqnXozsr8zlLwJIh:55dKvi61XwFRKIh
TLSH
T181C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3053c2c041688dde50ba0c298af86e33ecc13bdb61d5c519c224bc1ea0325023
MD5 dc36aaf19a3baa07f6fc3b6208df640e
SHA1 d1ff8d063b5318e5d4dd63a6fba718a68c1c0172
SHA512 b47aefcf34371f8de468095787ce2735aded8ded6121f358c1f1dee90d09b3c065bee88a533c313734331d7dab71fdf479d1ec08aa8f1e31bcfb6b13bb29ef50
SSDEEP 49152:hhtSn8EApI0figXgiDn0AP5weXozsr8zlLwJIh:wX2iyphNwFRKIh
TLSH
T1E195BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 19f84e4653d92226e57a1d1155d59f166baf7dcb880e76729850c1bb07027fb8
MD5 7792b4650382e117ae2c50603bf0cde3
SHA1 4c62c83e6ba58f2160f00f69ca0c49d74f193697
SHA512 15b490313cf014cb4ba9c8f271095768678fec682bd8c1429ae299a6d6a7d812870e73b0b6d7333e1d234451003519ddc0eb41f1a85d6f3c45248ac682b3b502
SSDEEP 12288:AbksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ap9Xozsr8zbhN6GwXOGIh4
TLSH
T13E6523B7F9A2A442FB575F31298116C4CAA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 b5264f69161b90676b94b64dace50f760d8de4db3c7686e4382eeb2ddabb7d3f
MD5 a90917e57505e7b957da7eaaf7f0ef4a
SHA1 f8eb9e11278562e6cd7474fa3fc6a1f82b17481b
SHA512 3ffbbce6d2677d8afa3e89e64140881ca030e155c6b62eb90a37bfe182fa7014f25a68d572629d845dc014bce9df92d0c59ae6c9cb4504f351f6c204e9464fb6
SSDEEP 12288:m2ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ma9Xozsr8zbhN6GwXOGIh4
TLSH
T1446523B7F9A2A443EB575F31298116C4CAA7BD9FA9C20791333C1042DD7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 fe2af1380e0d5dd4b6096941c9213d635eb55fb5a843532f21f462c2a591d11d
MD5 77a40d360e472edd1b458434c64ac9fb
SHA1 f83eaec315ac05f5060bf8bb458207203219963d
SHA512 7581eef29c0c98a4aaa2ce1312d4960bc20990cfd292df76e88573d3de94f638e767a4addbfce350a0f2eb9b72e67206ae778938a7127969facbca5a52b9b9c2
SSDEEP 12288:uMksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:uI9Xozsr8zbhN6GwXOGIh4
TLSH
T1586523B7F9A2A442EB575F31298116C4CEA7BD9FA9C20791333D1042DC7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 49b2b050cd4e25ff9c5b8d1e66b3fe5c57f497217517c628fe0e0bff464dc292
MD5 190acfd87c7f45e6b6d8b920f4feaace
SHA1 b13704acba27da1d0176cc536d23d467a7181488
SHA512 a8234158fa784c9b676c8a142ac656e8813d1f261670ad750f2841eedaf58fbaf826f8e5acfaaf229385e1e933d5cdf7323756a12f83d696547343ad92bcacb0
SSDEEP 12288:6V5ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:a9Xozsr8zbhN6GwXOGIh4
TLSH
T1966523A7F7A550C2EE679B3198915680DAF3FCDF9B5207DB232800468D76669BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 5dc3f136dd128270d5c3180b3f7895d1bdd5362c7f4e4d761f5b211969a44a24
MD5 b9de5522f783355a8cae8adb61acb240
SHA1 b8ed8a87df496fda6eb0f0fd129db8ef2ad108ce
SHA512 b7bb105d98012c20b32487ccbd06b5e046c0cf0e6cf0ce4df629e4b90a6e8053ec506e37ef195b924c0bfc477771ba7885f4c1292efa3addb0d3701ca4362c65
SSDEEP 12288:pBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:pf9Xozsr8zbhN6GwXOGIh4
TLSH
T1056523B7F9A2A442EB575F31298116C4CEA7BD9FA9C20791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 537cdb45077c641362a92cb618c1f7b5d11e9e285928028ab5bc86edda36ded7
MD5 6e8cf54c913959059d7fa1e91d75ab1e
SHA1 ba8a9face59d86e5a0d22feafa7847240727981b
SHA512 9960142b9963de39413fd42c8beb2a5e09e513b2e15d9b3efdcf0cb1090cff2a632d5103a7932c78974fa2d2b8681349d65fd41cb857eb5389d27efe2c363254
SSDEEP 12288:NKksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ne9Xozsr8zbhN6GwXOGIh4
TLSH
T1586523F7F9A2A443EB575B31298116C4CAA7BD9FA9C20791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 cdeba663bafc634590f5913c374cb12a6e52feec2f7be8065eaf71779c563cb2
MD5 d8391b8659bebc142624ddd46b76421e
SHA1 76cb1bb7c2e2becd07f19d8cc1411d9f0eeb7c47
SHA512 d0b17678274eda7f25b12d9587abbd13d4dd59a4fbd7caa6de232b13f7286d11e397219595818dcdfed524fa5bab3a039d220486f3deb81baa1ad7b120f7520f
SSDEEP 12288:MeksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:MS9Xozsr8zbhN6GwXOGIh4
TLSH
T15E6523B7F992A443EB575B3129805AC4CEA7BD9FA9C20791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 e7fdf7e4f06b9909f90dbab18ef84dc9e0eebb213a2a6e38bd42d09bf2ef73c1
MD5 efdc9549285a4fe36c9f80a1b4005761
SHA1 d2fd7438f46919dcfcdc85619ec29452f50d753d
SHA512 8b0ad7a38fa98fa854a427b87e8d488fa373ad348dc03222a527e7aa9834a2958e340140f573c56f7e42bebe07e77ade0f3d27fdf82c4e423fdc3cf77ed2aaf2
SSDEEP 12288:JiZwbWzzFEoS2cPvyWksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:MZMWzFVSO69Xozsr8zbhN6GwXOGIh4
TLSH
T11E8501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832575F333A11D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3b6cd631c42e9ce69a0bd4df80f7f98407f1031d71efbbe3862a30cbf0457208
MD5 b5495aa8c41b6510c59a376faad06f18
SHA1 1c71b77582fe76402fafc9b8c5d20147413893b6
SHA512 1a0cad2a2da154ac320631393f604ca88ce6590f68fe89f404f1d86721cf375927c217b29ffe476dcea2f493a66efe3b15901714c6368e6b101493e4379a321c
SSDEEP 12288:IHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Il9Xozsr8zbhN6GwXOGIh4
TLSH
T17A6523F7F9A2A442FB571B31298116C4CDA7BD9FA9C21791323D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 fa0c54478faf5da1a3e95366b8cc8af6f8650f4ebffa9ed90f47acd7539da4d0
MD5 d25e57a54e5c254e1f6bf6b24f37cb52
SHA1 b2433d51417ffb80b7cd73e21a5d75dd453a7370
SHA512 19a18c8d76352e15e80b1489e5f8daca01db424fe1986140641c542ccf6d1eee4d34d07c68c1a8098b850736fcc98d67997d98b79c3617130c995692f9000714
SSDEEP 12288:LzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Lx9Xozsr8zbhN6GwXOGIh4
TLSH
T1386523B7F992A442EB575B3129801AC4CEA7BD9FA9C21791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4b08d9ce8c70e8a90f51cf10e53e1219c1045cb8b0f7c279607608618b613cc3
MD5 90dd076f9dafa7acc836b33076f168d8
SHA1 d3cf296af99401edefe2fd93ce2e95076ae0b704
SHA512 0614199940dd42bb8023221e3b708faceab03ccbfd50c40458e37256e2fc1be2325063d80d71f4625696e9bfb2d3605f45cfc19965a0d5c5299cfd7389fa7294
SSDEEP 12288:HyPz5L8iksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:qzyG9Xozsr8zbhN6GwXOGIh4
TLSH
T1AC751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 a1fe5db9d760ccc8ac9546c583c18beba1456552cc7abc2d8844860fad68f364
MD5 e2a725a5668c4daec3353cde6dca9354
SHA1 0e88bf32f0d52b8dd88646adbc437d5ad60fc74d
SHA512 b947bc02418344f8a4759446d562537da66cfbd4c270b56dcfc4661c3a196dfbf9f254f417cd1baa6805c771d04391121c630d85fc5c4d1f0819cf861e98879f
SSDEEP 12288:eHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:el9Xozsr8zbhN6GwXOGIh4
TLSH
T1296523B7F9A2A442FB571B31298116C4CEA7BD9FA9C217C1323D1046DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 e94320b2e7ebfc9ff902a04b07bf6ddcd561632f55ebda33fde67e54aeb46c64
MD5 d010549bb39c7e8e8a6db60890fe2795
SHA1 9c96f340e86309f1b47281ad9a2b4a87027c2559
SHA512 8c46c7c86cd99b88586deab97fa4187c913fc984c4a428fe89897c71740e8abc0fed27437667a62aa3b122ce9f7c71be34837443fb9c8a1f17428ba0ece289b9
SSDEEP 12288:QHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ql9Xozsr8zbhN6GwXOGIh4
TLSH
T1C16523B7F9A2A442FB571B3129811AC4CDA7BD9FA9C217D1323D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 526aa565cf297002d33e4bb9fb0f80bf922c9718e3d4257b7082adb73eb4f1ce
MD5 7399c70a4d2a9ec3e360969c55b0e954
SHA1 0191898bc87efc307e2a90fd76793e8342c072ee
SHA512 a7186830663b28cbc5783da3689a2077e81cc3307c5d36ee342cd994fe33f026a8e962152fdb7a2cdfadebb0f0c28f6efd8e6cbee01e113e69f01e03e6f45c16
SSDEEP 12288:IyPz5L8iksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:JzyG9Xozsr8zbhN6GwXOGIh4
TLSH
T146751257B3A130F9E677833588921A41F7B2BC7647604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d79b94647adcd6fb0d5462dbc8d750dd151bff684e10e49815adaa3061acc655
MD5 7cf79a56862ea764a68a5bffe6925556
SHA1 f0229477be88ddb7f5a588e19932ff70db0c24d1
SHA512 df2feb2193d913368e4b982f12e71ee5ad93a61e1fbf731972e07676b87bc603c61534d82887e6aff50597646185ce080d80ed52ccdd848c38a3c3d653f24e76
SSDEEP 24576:NTHaLl3z0zD49Xozsr8zbhN6GwXOGIh4:NT6LljhXozsr8zlLwJIh
TLSH
T1988501A5B39018F4ED67863EC8518905D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 321d014d9d56f07eb6695fd8a1fa11ee96ce43000f442e754083f3fe2fd05b11
MD5 136bd8465e48a5e6701f2768706f9e23
SHA1 97fb217110df48715e3609124ca84009d8d9ebd9
SHA512 a51c271853357fd67ec6f9df8ed120a2a042bea1e0376b709794048b118d3a7b0f71764df7f548c94995b05acb172c753d393d761f306d46121e65df577e6a2d
SSDEEP 24576:N3Ld9CHKy7GZs9Xozsr8zbhN6GwXOGIh4:tLd9CHKyaMXozsr8zlLwJIh
TLSH
T17495CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 54910f35d0b0f7db9696edc915cf1529ad6b857010ecfa2badc42adc2d214e49
MD5 37db96888075456ea4a59a959acd6871
SHA1 2264ce38b269721b5c6fd3a9019062e35e54ccfa
SHA512 9435c0ad01f64daf262ed01bed21fba4cf862cb643c8f2d189d8755510103b56b93cf41920f32a3be5f2948ddb496d3b9922b4e640bf51921ff240dab998582c
SSDEEP 12288:RsksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ro9Xozsr8zbhN6GwXOGIh4
TLSH
T1066523B7F9A2A442EB575F31298116C4CEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 1092b64eb2ac74895a50da584a5cf04367a8bcbb328db46a5e317eb1393ec60f
MD5 a8924b83ef2eba06b6fc9517dd3f7609
SHA1 ae6f40940e43bb4b890860c43cbef305f90060c6
SHA512 56c68de39aeb01312f3303c5e72b5500b6094a4327c4333607910b31a99589ba2a549f1dd7b8b43bf8f0639854926eb0653619104693e8af4968cde57db65f2e
SSDEEP 12288:1CksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:1m9Xozsr8zbhN6GwXOGIh4
TLSH
T1ED6523B7F9A1A442FB575B3129811AC4DEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 c0b39bff5b35b12bb07f2f4bb691f8a37562b7ea1d7b2a7f922d915147b6188d
MD5 967a141bd9518b9d24ab153f832341ec
SHA1 4772adccbe6b814c655c67bd6e1709b7c4931852
SHA512 09379e686d810b261d905fbe55f3d9f0a9aa95bcdb8acf2d7c5cd4f9e8e42cca3cf5ceb8cdc2925406e32d127e1bbe7e7b9af8f6ed5b1879a44d63a5667a2c0f
SSDEEP 12288:XlksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:XD9Xozsr8zbhN6GwXOGIh4
TLSH
T1686523F7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 054695cb50b2cfa045c7f17072dbc6636fa9fe1a19ba7193dc39b8a2e412fa55
MD5 927e5236c9adf52a87d04067220f2053
SHA1 70215fba3a918e40d78d3aa74647ec2498174a52
SHA512 f0afacf2a099edb930bb11ec6d1e8be04ad0cc252a4b1c0e6db524dc5a7cf23a4b212ad87722f4bba69c1448c4b378f7daa0bc019924b3c862d95073aa50be85
SSDEEP 12288:SHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Sl9Xozsr8zbhN6GwXOGIh4
TLSH
T1A66523B7F992A442FB571B3129811AC4CEA7BD9FA9C21781333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 4d4eea3bb47b8b4308f78d0f82071b5f3e9850d5a711ec71fdde1ef1f9b4485d
MD5 7000155bdeafda495953a64c1786d58d
SHA1 b0ef699212f21a5244ba5cd5ee4388096118079d
SHA512 0328f80f585b79dd4a571d44f63367c7dafa48372a356ccaaebf94e40399a83cfaadad6e392274bf4bd74c8bf30680f3d4db3de167ffba5931e3bf5340ecf846
SSDEEP 12288:2sksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:2o9Xozsr8zbhN6GwXOGIh4
TLSH
T1D16523B7F9A2A442EB575F31298116C4CEA7BD9FA9C20791333D1042DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 425498cef993dd8b9dbc85775af1ee39c81d9f53baf36e5583909d30cbb13cc0
MD5 5748202150082998d18633338d6d9d19
SHA1 c406ba14b303e871c3d645144f829c177285d57a
SHA512 322481650badb4b942bd01d4b67280e36de6844cf7c5ea6428f29d2bb2eba080e4ea2e50b3503dc92a35700484d7f64ca4fc321f774128d7a818e670a4942e9a
SSDEEP 12288:6PksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6d9Xozsr8zbhN6GwXOGIh4
TLSH
T1796523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C30791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 5ebc65e3dbf7f055cca5d7dba87e802005af2342846a3203e43051a7e5c73166
MD5 95273c1210910b8d72d2935ae773c81b
SHA1 023aaa7f4c65c4408dfe7b0ea4e0964b7d933fe2
SHA512 5055ac743c409eec080bf4da12f88a94b0c0f080aedd4b6bd0d1f70207434c1ef8f22bfa1fbd9b592755761002a7fc72c33ac36479c8236eef31a2d27f57c0b8
SSDEEP 12288:KBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Kf9Xozsr8zbhN6GwXOGIh4
TLSH
T1316523B7F9A2A442EB575F31298116C4CEA7BD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 a1224e967751d80fe590d1b3e4a657f95d9d9ad801a04ba6ef7e4e2d2eb2a6f8
MD5 543526f3e5bf33a478a05deb9be201e2
SHA1 46e4edf720c72c1d5ad803b5d355d22578a00b01
SHA512 032122c86ae84e97094cdbcd355e82f4d5277f25f1adf5d29e79c433bd9295881b66c5498d66deba31588d1d6882e7347d62a6de145dad1e009232bbaa872251
SSDEEP 12288:/kksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:/Q9Xozsr8zbhN6GwXOGIh4
TLSH
T1496523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C31791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 b0f93e1b63a21901cf5dcee6dbb9dce2a9dc0779874cba792031c067d0a774f5
MD5 24cc92c80a41d168696646abd69aff32
SHA1 fdf042c2c514e5400a3b006e322ecd8cdc5d1839
SHA512 46bed785e44b8d30d60303e1c28766a869bf5c517e6eb610ba2bc9c248825edb1c4027dab86a204de48dc467a50c6d2066b60f47154fcd8a52a60edbabdf7943
SSDEEP 24576:rfwv7k9RX6wkyAIB9Xozsr8zbhN6GwXOGIh4:WMnYIzXozsr8zlLwJIh
TLSH
T11E95D02AEBD844E1E177923C99B3460AF6B178591B31C3CF125A53AD0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d23d61f7050925d96bec6ecac656a945aca2846026f74a5d1752ad902880e635
MD5 5c821a901f1336775ca959305eb5f0de
SHA1 15b08f82bddd37f62b8133b79f293844fa1e3245
SHA512 f4f7b6860ecd0aa558122e8ec25dc50e8ce46c97943f2d404cc95ebea484962452ff790810893adceb7c311a901ae423ea3e10d7400154902969c51c11303ce7
SSDEEP 49152:bYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Xozsr8zlLwJs:lySzPiwFRKIh
TLSH
T123066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7d23937301e4e8c689e441fc8f58d6a08c536a483f52b4d4c975604f322db038
MD5 d2b52ce8551133f8a45f1e440a017286
SHA1 dff5de1f7a217fca047a4113badae90be84104a0
SHA512 a4bb0077149fca81644949292a3ef0667388714e10b889bd01774047ba26168cf00351df33dcbe41cd260345b05b8533f3e450c1aa021fa124d9d7e66da1d44c
SSDEEP 24576:j47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYK9Xozsr8zbhN6GwXOGIh4:j47JUQj4irIhCnDHUPfF/OXozsr8zlLT
TLSH
T1A865AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e9ef8ae426694ce9642e45f2ecb7129199498e06619d3bb090711972ad7978ae
MD5 bfcf9e116399481d1fb9c80d2adc7d1c
SHA1 505f66f4942e02c1428cd2f1d51139f4f5d28e57
SHA512 f06109ec4bd5ab9c3e04fde9353c342997fda5283c94741813b443e1fcc4aa0de6cfac4c21d1818f0c3fac615b4185120910db0483a71b1f2cab98e0019c5569
SSDEEP 12288:4Qsf3ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:KV9Xozsr8zbhN6GwXOGIh4
TLSH
T1C775F15AE29411D5D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A1AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 622813d66448506328f001d2d65f9a21151a04f646eda814d6e4c7cc000acc88
MD5 ca65b3dd4f2c27b6b2d22acd397e6ff7
SHA1 c1973cab5bdee61d027ab00fc82d0353f8d0f9b7
SHA512 ecc047882d9c70e9514009571639f69b6e2af30a3b5e1f03d43feaee84e5c51de2d2e58ec8f43aab1dbd141bc1bf31a0be5f261d2f13d7fe41e3059dd3a4669f
SSDEEP 6144:rcsBC2nabsv589DN2UAE4U2CotMxBQuGU3ftkE3CDmH29ImxVQcH7/BSyMf2+LRk:r1eK+yU3fNyt/0m/BSJu+LR4Ox8KF
TLSH
T169252710766AD75FC6A940321E37D2CCAB707D41FE059B0372C8872FC576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d16d16c236eb829e369f2360df2bff358fa6073b28d8cfb08e28affb77c08d11
MD5 092b6049b487fae7825ceb166b2fd689
SHA1 f0fec7c94dd64b7590ad6b934b3616c46928e35d
SHA512 f9eb1e977dd0c3a469504054e0c30e2a7a0d40f83f018e34df0c8b35f61ef954dcd79693a1507a358ad59143fca2691ac8372dc0f878eae589c4d34369adfb15
SSDEEP 24576:TU24DQH1MWhCYWF2tpYob/7dkXfJzZajEFdrj:TU24DQH1MWhCYWF2tpYob/7dkXfJzZas
TLSH
T13155D6815437A3CFD1F76072072A6B4CABA4EC13B7095F26B388553DD82A725A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\ce5d9c084124bc90\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 4d4dfe2d571b2fb692a311daea5ad9fad6e7ee22f716691a05539075e63d33c3
MD5 abae757867b596ce42bea7cb19bb0cf4
SHA1 f5d3c60389e87a8d22eca0bd70cfa481c33961eb
SHA512 637c32f249993ad396d244eb543408215c6d448de296cbeeb623f493fa8dde31f7c0fe9706db56ef39737c5a0e3c022ae90f87f797a1735654845badd2bbfdcc
SSDEEP 3:G9pF/lGlll/l/lXp9ZjrPBY06ll0xe+l1ZP:GLF/0dPBY0Ok
TLSH
T13E5312841192061BC462433008C606403B7412044353485142105130D858B070162194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\ce5d9c084124bc90\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\ce5d9c084124bc90\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 960B
SHA256 dae63549d23b9f08ebb27d21f1e35b864f600d844bd96873644805f120bb745d
MD5 6d52438dc0c50ba54aed3c06a2b97cc0
SHA1 e4ccb3fb895dca552d3b4ce71615a07f6087c576
SHA512 d6bc69917fbaa158fe43a628cd628244944ae43b02bbb57af65cf40ecda31bd25ae2280dc08d0f4934898642ce5e8eccfc88bab0475cb72700166a810a6e93c6
TLSH
T178118C543BC72DB0E37A78354029A2101212B10248D2D20885C088624E23204E031FA5
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 0430e2311036614e29d4885dd61ba6ba6e4aafc72e28ef0d9b764fa4baf4cad4
MD5 deaa13f5f6dc382f5f8c16dbbab33650
SHA1 34096d25cc065c888d6a8e2548c09edd4b4b545a
SHA512 59fd0a38ca1d4df0f9cbc1322c6ec061c50cfdd76c5b0fd9ecee8d262ff7bb109c7c4101e2bb3a8fc6131ecc5b44236c417cb101bd36db38ec3805aefb14e163
SSDEEP 12288:Ud7/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kN9Xozsr8zbhN6GwXOGIh4
TLSH
T1D36523B7F795A802FE771B30288556549A5BFD9E4F8107C332281186DC7A8E6BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dae9cf452e6e98e42bf1e55820c35dcc51cdcf24a665f140967205aafa4a3296
MD5 5a2288add0791557c9fcd05cf68bc66d
SHA1 06ebd47b0e642f141ad592155e0f44e86104c89a
SHA512 2d017a013ae5e8b72a2084c962bd6c35f57e703f2f685e1b5e09fab3399b6c0c409f37a16606bb11c6c3765df219dc37c5602c32e121d643a355799a30dbef20
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYr9Xozsr8zbhN6GwXOGIh4:Ygb4mBIBhGFIXozsr8zlLwJIh
TLSH
T18065AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e8966bf99c906326f4c2c5bdd759548bbf9b52a59434da71f2432ee9ce8b1052
MD5 5b659b3afb7fde7d3c299f5b96cd4f1d
SHA1 5ddaad2ba2dcce9aed5dbafaa16479c7bd9a9519
SHA512 1e706dadd0d97df091a5559832281a3e3bbddef9ea232e3ffd7997cf64e0f5ded79f635dbd82597e65eef6caaf214d16557cde9f1a62050d6c6e832f61906533
SSDEEP 24576:rG88u8FpJqH1czria7/m69Xozsr8zbhN6GwXOGIh4:q7ZFPqV7a7/JXozsr8zlLwJIh
TLSH
T14EA5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 67b73406c29175765d7102022d6df019b5c0e5eba88dbfad86673ac5e801b26a
MD5 2c9e31a90aa4cb81351e8ea52fdb57fe
SHA1 9de0902b1322c90bc1b0e2c46bff2a122144cbe3
SHA512 1a095b9e35ec736ceef6728c1454d6d540a15d3a22600d39cd0dfb56dc80434282e7a36a3b0c5bd843d132d1d399c0c55a2884e7d2c5a184a04f21f11c5c6273
SSDEEP 12288:sHvUrBFrEjwaQaksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:sPUr+NQu9Xozsr8zbhN6GwXOGIh4
TLSH
T18D85F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5ec67905feba698a9e7d6f93139ffee01c937e2176472504e2a19fc3cfc05ee7
MD5 c09d12076ccd4cdc57e467aedf8ea104
SHA1 da767b53fc6f2a08ca5598af6aac2713c10e4053
SHA512 89815a21b24c2eb5a9df0e1dcc7d96f164b3088e68dea64383f539f69705bc6d7e84d6d7ca7ff408d5da8d6c4785374ba6632352c6033298d10c9a089e358455
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8Xozsr8zlLwJIh:GG05lO43brwFRKIh
TLSH
T12ED5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1bb2a667e542090cd8f057673cc0419e6344f5b76a519bd99147651b1d391eab
MD5 beda9d9aa179c99622ca8cd0669b1e07
SHA1 ad454d3d18f43a2828ce345135926c8c22cecf12
SHA512 accd7ed1289bb1c268524fb399c5d9d9abf0e38ac6801711af3bba0b11d222ded7b7a219921a0265eb96f62fd1ccc2a3822516a70ae7943a03fb7cc414bf59e1
SSDEEP 24576:+fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnE9Xozsr8zbhN6GwXOGIh4:ma5POZ39Jt2pasx2+m0Xozsr8zlLwJIh
TLSH
T16D65BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a3e8d4acd6cd04582ee8bc38ae26336aab97b775f189f36ee6c752dde789fa97
MD5 0170373927a56e972fc6a87f403c2247
SHA1 37bf0ba6e21f97bc045c7e20a9e2e318f6424144
SHA512 e27eb38941104400634bc00c84d3ca66749ee83bf24176a7d84fa7e25d180f2c62dab19eb9645dd129d79c7a0635c50ebd47feb507dd5972d53dd21f066966b2
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkC9Xozsr8zbhN6GwXOGIh4:ANc/zEOVHFpXozsr8zlLwJIh
TLSH
T14E858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5051ce11d3103d707b580fff7fc5d267862803ae2e3556a69552458f533a4b43
MD5 5363bf03ef8b5f838b5baab7a31ec426
SHA1 e15c818d89e200c839991e01e1d05b08fddb2c4c
SHA512 8b5b336e2fda8d3442687f9fda2d1b678ebc456289eeb1a3d4f9632d5e0ddbdb0c8cf6e734301e342aa6c7d98e3d812827cb27b210bc300c2bc32cdb1b0ef667
SSDEEP 24576:StkNvNnaFeYhJNtmZBmQ9Xozsr8zbhN6GwXOGIh4:StMwBtOmqXozsr8zlLwJIh
TLSH
T1E255AF6EBAB845E4D1FEC6B48D238512EA727861073253CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1b6ac6c4eec7edc2c412fb864eb37cded5814cb429de57bad2fe812a60eb2280
MD5 72313f6ea433e9b3f4f1f6b95fa970ff
SHA1 a5a4dee247f004c46a00e21d2ff8f9cb817871b0
SHA512 f3aa8e0d6567d786642971855c3af7de56282fdb327684fc68a217b55386ba05d1592ba1bc1b071477a770a57463018e5ab4e3eea064383079908427d92bd4bf
SSDEEP 24576:4D3FHshBIYQgAJ9Xozsr8zbhN6GwXOGIh4:4DVHeBIAArXozsr8zlLwJIh
TLSH
T1F095E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-78-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/256-309-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/256-82-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/256-83-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/256-84-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/908-87-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/908-0-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/908-319-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/908-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/908-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/908-322-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/1764-381-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/1764-383-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/1764-387-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/1764-389-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/1764-390-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/1764-391-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/1764-388-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/1764-392-0x000001A18BCE0000-0x000001A18BCE1000-memory.dmp

Download

memory/2076-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2076-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2076-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2076-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2588-39-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2588-40-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2588-46-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2588-50-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2588-52-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3604-73-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3604-294-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3604-65-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3604-67-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4528-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4528-312-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4528-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4528-114-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4684-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4684-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4684-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4684-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4684-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4780-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4780-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4780-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4780-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4780-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4780-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4864-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4864-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4864-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4864-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5464-279-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5464-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5464-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5464-54-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5584-126-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5584-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5584-137-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5584-132-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5584-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5728-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5728-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5728-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5728-471-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5728-473-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5728-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download