8189422facfc20d56dd7d7604b6dc49e50986c1a58f27b09ea74940dbdd6adcd

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.5MB
Sample260803-rl82esdk4w
SHA256 8189422facfc20d56dd7d7604b6dc49e50986c1a58f27b09ea74940dbdd6adcd
MD5 95afc9b75bd78c3635085e593809daf0
SHA1 ac96afb00905d0569f5910ed688fd2fad2cdbb7f
SHA512 01cde0d2c361dcee30c8595130767e95e80e91270c14666314e34582f922ae0483e1cbf3888aa10dcef9bac1f0a93c34213a6c5c3e0e6f61d7ec4eb04794570b
SSDEEP 24576:0AMZYYztenwcTJCjVPQkiwtSOMU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0jzDggV4kfvxLNiXicJFFRGNzj3
TLSH
T16275BFD9D3A801F8D5F7C27AC9216903D9B7BC9807B0669F0390374A1E3B595CEB9B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4884	elevation_service.exe
3580	elevation_service.exe
2992	maintenanceservice.exe
5548	OSE.EXE
2808	PerceptionSimulationService.exe
5236	perfhost.exe
4948	ReFsDedupSvc.exe
1700	SensorDataService.exe
2712	ssh-agent.exe
6132	AgentService.exe
2952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cf8a982983806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000723e1a345323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed378df25223dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4b051f35223dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1d2c5f15223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3e6b7f35223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000321720f25223dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d5acbf25223dd01	SearchProtocolHost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	4948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4948	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6132	AgentService.exe
Token: 33	2952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeDebugPrivilege	1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1008	2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4884	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4828	2952	SearchIndexer.exe	101
PID 2952 wrote to memory of 1320	2952	SearchIndexer.exe	102
PID 2952 wrote to memory of 3496	2952	SearchIndexer.exe	103
PID 2952 wrote to memory of 2932	2952	SearchIndexer.exe	104
PID 2952 wrote to memory of 4868	2952	SearchIndexer.exe	106
PID 2952 wrote to memory of 5028	2952	SearchIndexer.exe	107
PID 2952 wrote to memory of 432	2952	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_95afc9b75bd78c3635085e593809daf0_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3ea111afc5fba6aa7ca9255c11b18b5f40efb2e530b99173f136ca14d8b77acc
MD5 d0d1a456ec9b67c587f0ffad45acbb4c
SHA1 797a8eea5160cf0fc611e3961ecbe01b682bf79e
SHA512 8e7a54aa7de6183dea0acdbd2bc9ba82ef37a94e8820d2b12c518be674a77679b30f230a538868996aef40da13b258d9eb4e2a10ded973c0241ac91945c4491b
SSDEEP 49152:bb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnzLNiXicJFFRGNzj3:p3q6mjB87wRGpj3
TLSH
T1DAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 84ecb258ca885d9d0b80f709ec457c287137379afab707df1b4143fedaf09d93
MD5 8d93710c19daaada9048a7a32b9fe949
SHA1 6f18c30c559b237f98c9598bbacf4a7b245b2b47
SHA512 b0de48c8b210740ebb72885960e799194fb2d92b12d612a8be5a7daa4ff4d3c4d5298c62de7afb0bc036ffde5787a5092bd5275f16fe8a3c59672912a17a3fef
SSDEEP 24576:/XYfDtczAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ktc1LNiXicJFFRGNzj3
TLSH
T1EF75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cfc24553d291fb44e95ee05173409c013baf921bc80889b25ccc60f59d986746
MD5 ee0f87fd041a4062493b9bd80ff03f9f
SHA1 65270f9570b248994d177b501a53591c344b7d4f
SHA512 1d60ae6ec533686f012de9e839c8f3dd484a5726147d69ef235254f5132a534b55bcefbb46098b9b5bf0954939ad82910f6c527b63807caf7403a494abd34851
SSDEEP 24576:60Le5ji0hmxhrMb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0AzGLNiXicJFFRGNzj3
TLSH
T1FB859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 183d0a30f44eca13c752443a5ba8ccde028608f0e97b4166d7ca60e468770e3e
MD5 d664c10d6287294668a2fadb7a222688
SHA1 a8e3496d7d5e4a34ee8087b321c56cbd2aa62af8
SHA512 b92893b8993dee377abf515acfc3eba0c808f2bb8722ce14c0f87da40701e1f3216c4d3f9e7c92a87582e25f62127a00488cd2b844f1ec9d4c29c01db66355f7
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyul/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m/ezSC6vUzPv+HjyCLNiXicJFFRGNzj3
TLSH
T146756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 df5f3537a74e1afeaa5ed60828a789af25fbf76e923a6e3aaa8ac4263b60d18c
MD5 69c963c316d477233b476adb7c023c2a
SHA1 78e0b01d375d2e87e51bf4cf2dc62ef34715ddd5
SHA512 76a075e94758bfd54537059ffca909756dcac351e2d34b37dea7cd973fadfc8a5016bce3eef4876f0e19e76d73490cab1d3e2fc86ceda06fc4af4a9cc9975d96
SSDEEP 24576:uVbqPb88hv/l+Bs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uVO88hXl+mLNiXicJFFRGNzj3
TLSH
T116559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 454b017794da30517aafe906d289d75fcff92d62bdadad4189d6de3021226065
MD5 e43530731d438ea3050c6e4e8b2ac12c
SHA1 75f1a8ac9d24644b76f5513ce6016b2307cbfeee
SHA512 a0051740a396856a5e4c138b4d4aa2b1b11cb9b5d01498e82d5ffb28821822f06f8bc7062be4ea36749d0e5275a0ab212afded9f888a31b105be1fa67495155f
SSDEEP 24576:8Gv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
TLSH
T17A5523D3468864B1FBFD003A867A5828B5845E2CCA595DE2D2543E5E913CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 551522972476e1484f880c8dd5bc768743451b6e69ba16ca67c0da3fa77a52a4
MD5 2d9de03b8cdb14a3fbff5640f3d8e261
SHA1 79a2bd20674eceb42165be07044220f28e35f3ce
SHA512 ca529c06f04f6aedf8d6df283ac522a2f6794899002276c4bdcf28d22c6f6fb34b0e257b5d14ec37207f7c554cb85d75a3533e779d8a7b273d76990ec731d88c
SSDEEP 24576:hJIU0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hJIU0LNiXicJFFRGNzj3
TLSH
T16F75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6ddbf6a0bfe2fd649076545129e0481b0067fe064327753759d1cc16597cc938
MD5 478b84985a38eb4084726b3a5fd15efb
SHA1 de7f861aecfd92dff9cefe0e5d314de4ea3ad93b
SHA512 d2097d3bf1a854714f40f991faa01afff5a030cc15821a892fbf6d1f0a5ee66929b44c84a6dbde061f445a21b072f3c23a0a9530a829911b6bd67d643c39e474
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:3QvGAdlCEL8c/WRNw5CV7wRGpj3
TLSH
T1D5266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2605ac8c118777fb675c6164c846cf7b30592b7569e3d7946fe5fc30d1f103b5
MD5 84a8f4e062d9cadcd881b42ba69ccb5c
SHA1 0ffe6bc2bb370afd2748be0a3f646dbb6a0a0652
SHA512 7df845e39135a541f8821e83715ccdb5f9bd7553591b22d7c9090329568b16fa68be2f658775ecf76f1934d093fb11dfe2e25bca6160860c48866d55ee642e54
SSDEEP 24576:lfewsAj2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5lj2LNiXicJFFRGNzj3
TLSH
T1D675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 992d41a2a2d601799b64ebda358932eae5ac2be597761823924ec4a7b6881979
MD5 59f0bc78a2f3042c6cbd5dbdee39603c
SHA1 cc3a5ef54098b7ac95be1efbf8220cb7a29bca53
SHA512 3e337814c1d96282b374a43875515a1a07cf375e692f8e94a19f573d6b205585cf83612eb887d8eeac990b761ab05dec999e1138857fc4057eed14d193ab5496
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHCF9:dUEtQevvqc2W1cpV20I32W9
TLSH
T1E7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 430c00640bc98809305c20e24b144607e2252fd8a29917c5b037b06c61914d9a
MD5 25ea4226bea788e7ac7bda37b4cfacb4
SHA1 f13de67fca28195307f5359a637d2190da782f06
SHA512 85b4668fb7bcfca27a9f64201e446a31b6bf1ee81eb8df627a0b9333cd5593af11183f44db729a8d1fcac0a52b88cf51c272ba2a4a97466c40e44490f6992e13
SSDEEP 49152:GCbRquA/m2yL5zLfFiV+XenmE3/zWLNiXicJFFRGNzj3:roq2Vjnmh7wRGpj3
TLSH
T1B9D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bc612a467833e34843ac1f42a84821bbda20e7b6732abb169eaf2fe3aefe7f9a
MD5 9a629dfb7a6a283f28afa0c946ef78dd
SHA1 4b266e6190d38b0ff9e0ec731ec9e90f0c8ee588
SHA512 6fd38d67d43d41b55e0aced170ee70e951ea0c1bc6076e1a1d86a65c0e66e075f5e73e2b086cec1402ec35c6748f81cb2da89273b9d75f14c64e04368c2a6af3
SSDEEP 24576:qAhGL6IFoiwtA5l7S53B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qAM5Foiq5RLNiXicJFFRGNzj3
TLSH
T142359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e8a03cb2abd5ba8b2e50145a23d169ade46e4fd043304f78c9459ac7b1ae7717
MD5 d775d1b39c777f73bd5c94cfc27d8c2e
SHA1 b6d678c30a925536c6148d85f1da10e375ea37c8
SHA512 119d85fd844a5502b2c1b4b1a3781d0815a6a560c490f62b7e8bcce8d1b53cf3196d2398c3754373d38fcca44d3ec785ccd916a5f9efc08dc4521d6d439dbc91
SSDEEP 24576:HwuROWi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HwSONLNiXicJFFRGNzj3
TLSH
T1AE65F18632940CF9EABA41398657C035F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f1f7006f0993bd9651fc201225d437d1584ddc335b1fdfbca8ac9c4d263bb2d0
MD5 b8b02c2ab05b5025504d9a3c90459312
SHA1 4460caa18bb0e0add6f818e43c5c2089a9f7f6f1
SHA512 df4ae16b15dea76221ff63e3c1ca56e19b2f821454cafbedeb8a9ab78aa3dba2a1f87801039062f5920ed5b8fc03ed9db35494d23cfb71f8efea4f2cadd303ab
SSDEEP 24576:pZuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sLNiXicJFFRGNzj3
TLSH
T1DD55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f7b20df74272660f65e1e0796fe7d1a321524411f908152f7c1d56d50e8b5726
MD5 502a5626a239dd00447c3ec67e075cc5
SHA1 c4e6b0651b14fa45f39aae4397f90b5b3d929bcf
SHA512 6347e20cbee3976bdf5dba4e5d7f028632e63b8536985e992adcf35a8e2c835c5c5da9f01e11011178a332230d528fcf1717760f53f63be7518b5914b493c8c1
SSDEEP 98304:tQRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:EQyiKanX+PN8F9
TLSH
T106667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7a2183aba471fb33e72f18d815864beb9f16e57bbe139bfb8087d870ab1b07f3
MD5 9b67bf535ed9401abc8a1267647810cd
SHA1 7df4266103a530231978e9ce84d4d1eaa66848b3
SHA512 3e80454faa2b3c5d74724b799bbe8be25ee02c33becc9b1242a72bdd68bfe38deb098484a8d5e355596bc52e17777b036467ad0300722dd5faa4bb2029dde2b2
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:kQyiKanX+PN8F9
TLSH
T189667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ae50b1347372fcceb5bd2d96d3f8b46ec23dc2a372c1178b3e55639f83d8e098
MD5 7e183a6cb91600bfe5015b1b42554a6e
SHA1 9087f6921f96b9d2ace1a5ac91e23cbe70f11b1e
SHA512 53f14d904d4c666f727481875d6f07dd0b1c1ee75f7859b93a1dd82426750e7161b0df186dadb1345cc2957003ca37be6028d846a8bd57f9eda0f1b46cd9ecdf
SSDEEP 49152:q68Qg55nhkeWu7PNU3/GLNiXicJFFRGNzj3:YthTRc/G7wRGpj3
TLSH
T11DB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 44dc92b8f9984db8fc8d92120ff2898290a6dc4c032bf70cdedbdc5412828e3c
MD5 ac4e5fa90d292121d90985fade1a35fa
SHA1 aefed7ee6061c52df4bf121a9167e2d2e2740370
SHA512 1342c2800455259b8de57da8527a5765631441839cf240794491630b99d19f3030c73175254861a6a29bb66536b2fd10b433ad1629fdf20c325fe844b5c680a8
SSDEEP 98304:zy5112gYy5azzVvU69nLKnhZv7wRGpj3:OLIHRWhNF9
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ae71e961fcf76107fbce8f259d6f993aaa6e8bbd2fed15791cab7c9efe9a03a8
MD5 d1aa8dcb826c3e483a1fc59528332802
SHA1 e0a0ba80576941a7874d544b68663149aeb6f044
SHA512 0860e2b65271bd26239975e1131b0ee5122c4b1af1984c30270d214bb11bf72dc55d890bd4586e9b506a8d3085d6fbd9baf19050b4d422745b32bf73f001679d
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYLNiXicJFFRGNzj3:au6JmIxd2dY7wRGpj3
TLSH
T1FDD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 326cc7afaad13c6a762379cca0ed02ba397010a1236defe79e686778f1ba561c
MD5 4787fc56c50377bd6f4e18b5b6c2db8c
SHA1 2a2be40d8af07d8d2d288ee48972b8241d2f84be
SHA512 c2ed39763c84f6a04bf026b399797b3a7f275f511b2c0f85812089aa86ded3a1a033955fe9235fa4183f9ecf4e2dd470e44450f897334b57429507018992c8b8
SSDEEP 49152:F1hpsNoJpF1A67U44CwH7R4xULNiXicJFFRGNzj3:FmifPqRh7wRGpj3
TLSH
T12FB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6ad3a167fbe1d3c48f0221f4aa2056a16faf96955c2cd26adb31a858f71db548
MD5 951c58b6bf7df320f0e723d9077a9143
SHA1 c8c94528714da898480a644c53af1cecc7567330
SHA512 9be1d52bf67afd0bff43b0128fcb3327e7cca37cf19d79c5c7cf749f51eb2f84cd5f490e574e3bff687a62c393a358f68dc2ce068b6d0326476b086873240ac6
SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqjLNiXicJFFRGNzj3:G5dKqi61j7wRGpj3
TLSH
T18DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5c688f934ebc59efa9b2c2c961bdcda1e6864cb48ecc475583907f39491c39da
MD5 19d01191df252ce1d86147cf24d26867
SHA1 8021b6d3dab8cb707c709d4e2877df4488d69531
SHA512 9999ba74af8514395e83ec2104e28a6b22a3cc78765bda1419a887387dfbfbcda2860544be5ebf0d889e4a6fc3c4506195d4554e96761d0f3b18acd1fd61fa80
SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wILNiXicJFFRGNzj3:oX2iWpht7wRGpj3
TLSH
T12995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cbe4785138d49a0482b8fbbba2b04dda6e9d97e0242fbac1e46b4a257780aeee
MD5 ae46cdc9345f3009ac88a9e4b63b465d
SHA1 a6f1354a50839ee2a5f58c7dde63f05c8f011c94
SHA512 74ffe964969535984245f2960b5158cfded29303e875761ed0c5c9e6b4bb36930aea5b3bc65faa2dedad3f420a7f676adf4a4b33bc242669b91a0ef177b8e7ba
SSDEEP 12288:OjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D355C955B1FBBC003AC6754428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c9ad42dc1f8462c1bf8d0d874b84b32421868a4856cd85fee4d7a36bd26a3ce9
MD5 eba05d0b7ac1cfe19461f75ce0e06ecc
SHA1 d98878b1bb6442e9a311dd6a175bf139af8f398c
SHA512 caf9cdae52dc48fd7473c8aa376c9fa0605db48b7b180ed260d63b82c890c3049aa83de7be1b677a7fb998dd103dbde1151f9560b72df83d7e5875b355f33215
SSDEEP 12288:yoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D3548955B1EBBC003986754428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 43d40b37559a4869eea3d68e897bc5136a8a076c7df57f92fb2541026f5d9f11
MD5 05e61ab129138ad595da871f30e12f3c
SHA1 b7cb3baa7bd2c23e8abee2355f97523044d6dc1f
SHA512 faee660ec4a729d32f50e6d3d59c70cd44becaf507eb4077010d4478b098c315532729016fd377d5e3b1fc5d956dddce15898761bafb53952032ca4f853999d0
SSDEEP 12288:xaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D2558955B1E7FC003AC6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a5f94e280811ae26ffcebc9c63605c33d99b06334cfee8f0d8f67fd30103d732
MD5 b4b01fddbbf733aca53534d64dcb501f
SHA1 ea3d86ba0d034d75d2f5219e0c530ed75bba985d
SHA512 0d5d29779c9b8eeeb10639fb72ab1aafb92917cf0d8e654dd9f19dc56e548da5bb1c2c916677c27def6b05d1b8cd7d40f33cfdabefd211b27b60b0443455ef38
SSDEEP 12288:4V9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C552392168900E1EABD803DC6764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d745acd3d9f6c81d27d2dd72e86be6d0f6309cc4ecb2ce0d4092aa7ce83c6210
MD5 04542a7e87a42d7614fc5e45c6f75502
SHA1 aa5ea0ccb1511182457d72faeb4dc9e162cd3b77
SHA512 fd7a8b593457db3fc51ca6887c7e68a6295e9f8c65b15d4f6f066e97b6721a08f117d8640f9eec10ccfdc18bec947d40191c3b8a43d2b4604a317a75cbb19db3
SSDEEP 12288:31iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D2558955B1E7BC003AC6764428F5881E2DEB5618E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8e78f486c926c497ccb07080689129e7a3c77b90ed7e870800c4f44fa53d884b
MD5 d6f4081310e907fb934daffaa2ac0dde
SHA1 4cb5ea08a9f290564e6db3ec3ee0004f77627581
SHA512 250a58970e748fa2c048f48c04c3827b0dad7a8ec633b2004e191bc86b4df397f99124dd2ef2f4607f2977c307c2d7f8dd9d0897faa2648653e4b7d1e470f076
SSDEEP 12288:X0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D3548955B2E7BC003A86754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 91ba03532d1dc8d4310da0e2842e121c3b6cdb2edff3b5083c8c247cfd3f8f4a
MD5 5ed14c78f584f1996c8f5c1c13954072
SHA1 f8c3b3a1ff29320403d3fbea552ca7e82ddf7bef
SHA512 d23894cf487f42d025a10c3a1671c9606e1c43520f4dcb4a9360cfb9ed1a6e210e242131bae66e2136c8c3b8249de3b7c98d6481ae14ef79d51ddf2e97065efc
SSDEEP 12288:bgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:by/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D2558955B1EBBC003986354428F5881E2DEB5A59E3E2083D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a1d8cbdc92976d0990c01fbd9818e4f1ce0b87cb0183af940c74709b3ed777b2
MD5 6798b872e0e0570009b9aba454576371
SHA1 9b5ab78a9e8b149f600d3b6f807fedc9fb6935c9
SHA512 7aca538e7cebe406d9d7f0b8aa71222e59359f5dfc5b31fcbae0435d3536325be26e8071c43bd366a0fb7881a2ed852e49baf498b2c97a704cdfa9bdbf94b3e6
SSDEEP 24576:uZM3zFVSO6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uZM3zfOLNiXicJFFRGNzj3
TLSH
T11B750295B39018F4EDB7813EC9258815E6B27C194B70CA5F03A4362B5F337A14D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6c16c15f7f7fa44cdcf4340f8108b2d328a5101c6a641de244a2d756a00d60a0
MD5 7b42b9f7f2ecc81a89f235de39c4cd68
SHA1 aa03a2f5874c4d8f27fdc32ba5d26d5858c5fee0
SHA512 0dc710660a0c57810744451e12f96e03a68c3c47a8100b57a9775d2330b9c288badc42b8a69f214d79ca971e57eb5ef38d7c601d36a9ef5124eed00010fe5691
SSDEEP 12288:gniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1695523D3548955B1EBBC003986764428F5881E2DEB5618E3E2483D1EE27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 afd0b74e0beb6d4282d4e982de9a49be2630e5f727e0f947e4782067d55d5211
MD5 8cf12e081508277aba1c46ad50b83525
SHA1 888ade2f436ce1e71253db2998b690bf68b8843b
SHA512 232e29e0c0442c4b49055d2cef2ab4195127e6112835c3e1700a5f31f35fb7a6ea0c778d5c159deba801e165082a8ec588280861b41aaba64bce0b91ac04368f
SSDEEP 12288:tLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3548955B1EBBC003986754428F5881E2DEB5659E3E2083E1EE27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f797715ea23e4243f5ef9f16d00fcf9e45e40e047a1a223923cfabfd800ed8d5
MD5 010684e1023e1d2225199bfbd762f3b2
SHA1 6de54306b255758590c19410751ae89cfb4a8b16
SHA512 2d2df6b33b11dbb75bbb8d4aef0b1eac1d22b2a04e898a1b97f4f27beb2b3e28837e3b4c99a839bce3e5909369db3e0cee6e3e71c287c5c0255973c00dab93ee
SSDEEP 24576:nzym/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ntLNiXicJFFRGNzj3
TLSH
T1A8650147629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a253dada77e5c899c8edcf1cec80e806c9627cbbff2b967433171403061c53c2
MD5 03d834b90a5d594efd27e3f6ef95b517
SHA1 c5987f3162cefb777e8e8d32233cc75f7c5a773d
SHA512 2734e87f99a238181798998afec1b1b144e326d5de3b149b258824dc4e4e46deabd7e854a104d550b9350c5b909da0bddabbfd25de644997976bafee4523d8aa
SSDEEP 12288:vniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1365523D3548955B1FBBC003986364428F5881E2DEB5658E3E2483D1EE27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 948be34870c703ada9393e6210ad74edf4b667e76e1222c71f660e9f2eb6f2b5
MD5 0b478a2d9c03195ab3e79aa28e4240a9
SHA1 fa66ae15a296f28ef532c38dda7dd1d5c8684237
SHA512 c157f3e14d59c7159acabec9d69e9722438586c9381a4049f2a04660b858122a0e7110bbd2ef6c3775ae592c6040495ae853ecec5fc5b5b1790ff0759a657e6c
SSDEEP 12288:FniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3548955B1EBBC003986354428F5881E2DEB5659E3E2483D1EE27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4519d81a07aec1e66124c630cd2cae416ef2160743c5d606bf84c35050fa9776
MD5 5bdbb03ef5812b54355d0550f826a4be
SHA1 1ce0279b2e82fcc3331086aaf2722ca1f4f71e0e
SHA512 bf2076869aacd321bfac3e125c66835c0bb6031e599085dc5ad9ac0cf5ee170c850569b1e044df6b61111708553b714affb47fc9dde71c4f678007172ac99e40
SSDEEP 24576:bzym/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:btLNiXicJFFRGNzj3
TLSH
T10F650147629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 91defe273f1bdab40ab952e2118b39bafa8f1e989681328cb606884a49395d15
MD5 086857c409dc025c63224011fa408bbe
SHA1 0b586bc6fd40e653570cbc92f79f16fe7ba90f96
SHA512 7d6c62cd2ef592b271a45416f6d1dd1c92b0daa816c901f79583111cbadac2fd09f78edbe4384d8d04ba16081dabefad386de5ee629e3d92e69b0ba210597177
SSDEEP 24576:zT8aLl3z0zDM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zT7LljlLNiXicJFFRGNzj3
TLSH
T1287502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 bfc34ddfd2dcaa72a5fe97a313641a5ac421715cc5bb7f68110d41e58a12ab60
MD5 6236f847622e521152f474dc04ebdffe
SHA1 d34127d096e02ba9aa81c3f04c8e706575293cfc
SHA512 7391143f548b01d1f993bc58bce00ac8603791c8133bdc10e68693b39436af9eb20f89a4eb0648c84c22277356c7caf6308b7d2741a37fe1f21f45d1b77ebb91
SSDEEP 24576:83rd9CHKy7GZw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mrd9CHKyaOLNiXicJFFRGNzj3
TLSH
T1EE85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 38ea343455bebeb4c7772801fd9f1ad962e9f94e2cb9d311de9a2a707b2812f9
MD5 64cd2e0356290f6cbd3b5a41d37ca1be
SHA1 b4975bfcac0e54bb2da56e1e4d949f5d09e30802
SHA512 6c051e4b4c80e0a03539810915481ce20f5e82fc0c0608daac03af5e3d12a3681e8d8919181a80b302f24eb1562c4de0c8bb1c8c4c0b8998d95061e329b07e82
SSDEEP 12288:i6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ic/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D2548955B1EBBC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ecd478d3e570925c8b61be83188accb0ebe59636c0c3871aa67cf7e477e29e5c
MD5 10285de430c0533b34820dc37fc91fbe
SHA1 e3bd158b25ce77787165fa23f08e6e838d0fc27a
SHA512 058fe9b03aa43b84fd3822082fb2a6b22575a53e6112856cb37f2d9b47110dac2affce3f9d3847b2391bbe5d417b044c4b1fd04a7a19d043b3b54b422176596b
SSDEEP 12288:Z8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D2558955F1F6BC0039867A4428F5881E2DDB5619E3E2483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d29a5fd3fa84a0bf3bbacca5f268074c89d603a3e4c8856139af9662af98cbef
MD5 989052f9d5603d42dba85f96800a4ce5
SHA1 40beb42d7ff2e0101d6ed37dc3a6d7da0522d578
SHA512 8f13d2a8dbfb56226ae411d99da6ee7191b6a174ed6cbb50b0d05439a62180549d133a2d71b0d7bc3dc417d756a7818d488ad6446f97792264e262beb8e6eb2a
SSDEEP 12288:vRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3548955B1EBFC003986364428F5881E2DEB5659E3E2483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 66a183c2432b4ee984d029588ae1bc57f9ae8fab8a66121b6f5519a805d9110e
MD5 c95d6ab28c97e269b06a7a0b2a7102ea
SHA1 88435d0dac64be7ff16bfe70643af00162c8127c
SHA512 1f0d83d5787cab42b787decebef73216f153971af4069156d43ccf0c929eefc775edc7179782f9f681a994c3c8c3f3044010f5564c56c31d669c62b9655e8a25
SSDEEP 12288:pniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3548955B1EBBC003A86354428F5881E2DEB5659E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a8b43d6b8fa74d0f781c695d0fc787f59a8e0107a1c62be023323266e577aadf
MD5 54a0734e0cc922e4a68cae122ca007f8
SHA1 0a712cf1ffc41b63cacd72185ccfb019cd402ec8
SHA512 f5fbd36ded1533610c07e97d0604c0674ba5410bc964ded736941b64b5bf3689197ca17284ddce9665353670542f9eb44617fde53f44c2269b6b3811203c0181
SSDEEP 12288:d6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3548955B1E7BC003AC6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 27b4a5ffd65b1b355f216dd6f7b2a48c09923f7227a06b5e55520bab09fa907e
MD5 8767e44574c66788976315adf760d7a6
SHA1 dd073a5a8f8959eb2e1d7bd5da959c055cf69a28
SHA512 f0e5f3a55a0f2cc5f8a40ca31cf8bb22f4ca5c319668a8ba53ffcce382cc61e4b92c1d8fe13c60905f355aa64307801438610009756520f185a63d00252c5365
SSDEEP 12288:nfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D2548955B1E7BC003AC6754428F5881E2DEB5659E3E2483E1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f46f4f68218044c6c9610769a9228159d6a6c028e3c2fe4e020963af38d7c660
MD5 8b84ba8dfb4a45d3b7bf27d1ddc695b8
SHA1 86229f13977e355b2c09713e93b2cf0279cb8d07
SHA512 c504847efc7f215f0f34e004f4ddcede2dddf707a4a95cfa23b5d2cc06e851f92fa737fc418c6e022d47ef8387f7f13775051d15d6a2b9de0573721f0744428d
SSDEEP 12288:71iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D2548955B1EBBC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0aa370c6b78f5904c06b5f34f807beb28839a3e1b6e16675b84544518d7a6146
MD5 6ddad5930e31a242ed0d16d09645a416
SHA1 f652cdde4ff462c56d74da1857847ed9adc1662f
SHA512 923ffeff224fc17c0c56888a3f9d3b508dfce883e9610fbc0ef304c2d9d791d1b3332f97843ad3890b6503cb47482caf245ccd4eeff20168d34cd534e9650a58
SSDEEP 24576:mfwvzk9RX6wkyAIP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1MnYIPLNiXicJFFRGNzj3
TLSH
T1B885DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 562ce06d592b7b4499da5da8ac6462651a60645abe296097ac140c57ceda2aac
MD5 2c3b5915e15abc09a18be2fd1b1e3a6f
SHA1 7fd5078faefb74c334f25de1d060c1730631b0ac
SHA512 60f35def96c1f0ea16784281adad4e55b47cb699a2d884dc43e5481c84775c570572dbc25047f41bc129bcd3a8b8520688c6035ad26ad9865e0df68fab5a712a
SSDEEP 49152:OYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oLNiXicJFFRGN:xySzPw7wRGpj3
TLSH
T1FF066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b5c008cee04cf0f4b2ae6a21de58367915615d6eb06fd9862af3190f8d4c14ae
MD5 e85e9e1f8b38e2e397c2bf26559bfd62
SHA1 906030be97d80fd98141a01ce6601c6db282c46a
SHA512 bb8aca0cc7287c9db29edbe5b01235ed7b04f7e788ee69b1278fd9dbd278cf098342475c5716f1a0035c990096b58d65ffa57a2ced8586287a7a6aea594c45ee
SSDEEP 24576:j47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j47JUQjqirIhCnDHUPfF/YLNiXicJFFS
TLSH
T1D565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a362362c8cb37fab683dab4a1635219ccc5f4ac5c0a06966a294bce2c2d9ec18
MD5 a51d5de7dbc7e4f12d3a6b2a2f160d20
SHA1 3865a518aced8f35bd7d3e52bdc96b03c9e71cb6
SHA512 f15e69c09caf911288c32cea1bc73de07957d80630298716e6f30dc6109d1f7112ec6f0f64669b02f57ecb4901e01877a5ca493e562a23c6403a0033189d8a12
SSDEEP 12288:PpsfXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BE65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 358311b67bbc18df673509373ddefbe7efbcf37bdbd9f9e99f9d27c3f2110e3d
MD5 1d23190834fdfd80bb14837d63bdfea7
SHA1 53615f2b4930c1288ff8db25fad4c3719a1de456
SHA512 b558a511e123bc8b266e0423ea0518e519a76db374c7999a26af9f9251df3aefceaf7bed86fa78d619c2f3678bdc7da84992686ac78a7c94aa7ae6e127acbef6
SSDEEP 12288:gTqhU3fje7DX5CZFeqDNo12hby1RQNfy9ZhkzsuNeIeW:gTiUPjuOQF0liQNfc/kzxYzW
TLSH
T1A7352800766AD75FC6AD40325E36D2CCAB707D41EE056B0772C9873FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 88534a1dfac3b8d6fd562e28eb2609d218fbb0961d5eba633305d173ab6ea16a
MD5 eebe8884c21e738e382a0600c5c356ed
SHA1 b52e8df22c5f7541036248e27a6caa068fde1cc8
SHA512 376ccbc8bf93be62d39658b29cf45af2a5c25b2af963c0797cadfef6f2525b19e994a9ea2b9595e894b7825761b00a54ddeaf529e3e49d2cb6b0169f4059042a
SSDEEP 6144:RJ7aq4sTFloj0OSgBK3tC2tYVUmbelc59cbVtMx2Jl/gRk7nE9cbVtMxvR6ff/SY:RJ7aq4GtYVXic5jHHWRowkoqu
TLSH
T19665D7815537A3CFD1FB6072072A6B4CAB64EC0777095F2673C8443AD86AB65A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a204703ff8568c5839a77d788f0d4b5de4d24b45e6062bb6a624b72a71fd8462
MD5 313648fa60aca0d5e0c73543077c7ef7
SHA1 1b760ce945fd6f745526f476d4ce78b33192665a
SHA512 9ccf3c3ce927dbaf049483fa929a5cffb5e19a4956c215e6fe367413d044930a9fea6d804d41cba8ca1446f406435b783ee65ff9355b608cb6bafd0d28a1ebb2
SSDEEP 12288:ZF7PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A5523A3568C59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 214b3a0e9e108d0977eb0976bbfb059675ab4af88365c2af786f82f3ce80fa33
MD5 39937902c31ed7aed6d0c9b144f2c3bd
SHA1 13d35c091d25db532827c0b913c40b95b9748ca3
SHA512 7021144086db5701e721665affd3317b280f387e3f3f872a0649386c30c0d632a0453e37259535cb9782b0ee49b88a34c9f9655bb4bb931bcd9f60af35ded153
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:agb4mBIBhGFqLNiXicJFFRGNzj3
TLSH
T1F665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5ae859eb13a03016b7fdd8f2a186dc44fed0f612e29cc8f27ec5b7e0ee5ad089
MD5 f3f7f502aba01d2f3215ee8b166fb0d7
SHA1 e733e03b45521c5fa2b1065c64a3b32569b7fb1b
SHA512 12000eb6065607c0bab771a95c9fe3135ce3a6cbf66e6c1acfb0f253f8f83edc9e87b07236cb2e32addd27bd25fb10e9d6b5f2e003cd7f265982493f6ea80c15
SSDEEP 24576:iG88u8FpJqH1vzria7/m6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:57ZFPqVya7/9LNiXicJFFRGNzj3
TLSH
T1D985F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 51c708feb0e15190f9ca929753a5408bd25f552b92ac1801deea35756a3d3e80
MD5 e2b5d5f826fa2fe9b25cb25043bf2f19
SHA1 bfa65d9e9836b0b6b395bc0a1921536e4cf081a8
SHA512 13253ffcede2657b73c900bc5b962470b2db3c4906c74ead856c0700d6d30898733496ca2a674e8bdd2481d158735e56449072e89120b8a3c3741bdfced825ae
SSDEEP 24576:UPUr+NQO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UJQOLNiXicJFFRGNzj3
TLSH
T19A65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f0f1d79afdcc7077ba980eecad980f7c20f8e1e4293128f6e75305fc13611c4
MD5 52d5d1980af6f6eb36b9dd85658adc12
SHA1 a83659e07d0c461a3e9623a2e093d931fd03a378
SHA512 6549fab3e8733a88c518ef3c382bb662c88b2642bc606869e64f9bb39b405fa27f1e39b52575a57fd338f2098c9e996621cdf72979d724c982797532aa8fdc6f
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeLNiXicJFFRGNzj3:GG05lO43bH7wRGpj3
TLSH
T137D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6dbadbf60666dc379ce1ca3ae3b3f6504a3b9bf320396e039034c79d6c47c914
MD5 446a2326576dd75b4f5c12cb1dd17a57
SHA1 53d77b41e0d8793c29c2a5a6bfebfda1b28ea7a7
SHA512 7cd3ea5ecd2e05d11f43ee91ea0a435d7d3537cfe77c18f0fe3fea83ae860c0f29e67f2d8755042e5a444efc440452d04845089fb7ac528da3f727cdd08e017f
SSDEEP 24576:Wfa5POZ3dpyWVM50JicR2hG0lasx2+47eidno/TwSfVcYG3K/cJHlnFR+IGNe8jg:Oa5POZ3lJt2pasx2+mGLNiXicJFFRGNf
TLSH
T1A665BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 047e31b8c6f603eb396995bb843c3c7b81162e8cd7ffc3ab779526bab9eb5451
MD5 01438c73c51d0dec2e3c324e462c22ae
SHA1 0d8d3068a68fc9a044c15cedd8bed3b3ebdf9623
SHA512 5387efcdcc0860e2193956f1d80c6ee247f6f02a98e6fbaf8bd29446842a5bd3cfb75791dca7726e240d6db9e158e55eca0aa30784e9bc0c3497c739f04b52f3
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9Nc/zEOVHFdLNiXicJFFRGNzj3
TLSH
T19C858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bb0fc18b413d5c17ccfe33175360f3b34bd20de69556d74520c9b64df40a3cf9
MD5 965908c3002081d3ddb6c7e2ff7a99e8
SHA1 f20d634318a41b8d527e7407fe6c5eb25f5f82e6
SHA512 4f6e195a8f22db5a456c20814399f6852d573c20acfe2d19fdc6a4467cc90f0f400cbbead1ae5bb182017c1467eb228cb5e5aa51529510300a215957d416cee2
SSDEEP 24576:SzkNvNnaFeYhJNtmZBmk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SzMwBtOmkLNiXicJFFRGNzj3
TLSH
T1D355AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5282f54d8698bde25850414b396d05b5013def979ed64b4e7a9c9bd6db3d82cf
MD5 1ed1d308ef3985bbe5500f61a77e96d4
SHA1 6971dc2d9e4e6a35938ec1bc0c7acc8ab8361634
SHA512 b327b0db51299d9b46b6c7d3c311f6f71f932446ce205fb55c55239916411a005517aa6794c1aa2d4d8451f0cbb94ce4315265d5938e5d685176397f4aca10a6
SSDEEP 24576:RD3FHshBIYQgA3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RDVHeBIAA3LNiXicJFFRGNzj3
TLSH
T13B75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-77-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1008-9-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1008-7-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1008-0-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1008-1-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1700-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1700-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1700-314-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1700-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1700-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1700-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2712-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2712-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2712-116-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2712-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2808-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2808-67-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2808-73-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2808-288-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2952-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2992-50-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2992-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2992-39-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2992-46-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2992-45-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3580-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3580-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3580-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3580-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4884-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4884-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4884-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4884-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4884-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4948-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4948-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4948-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4948-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4948-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4948-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5236-79-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5236-305-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5236-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5236-84-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5548-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5548-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5548-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5548-168-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6132-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6132-139-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6132-133-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6132-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download