a171d3072d13ae8dd6b2ee98443d058d1cc8fea5d9b0c695af66ab147fb332dd

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample260812-rx4wvaak7x
SHA256 a171d3072d13ae8dd6b2ee98443d058d1cc8fea5d9b0c695af66ab147fb332dd
MD5 6a99532cfcb562f9f493e706096f02d4
SHA1 6b61b00b1279a1f413b82cc3d1e7f6498fea670e
SHA512 a1aa3bcfa7945a4d0b212ba87afc05916b1ef666f90a4dc9a0a3b59cf8d4693ce63ad9fc41d9de68dc6a92dd4911feee95d24825654971961521fa67bde82415
SSDEEP 24576:atsdlChptx7FYA31N3RUDHNmdPCAaq8Nozgi/rE0TOj:WsdlChLxWk8HNUPCAaq8Wdo0
TLSH
T12175DF94F3E411E9F0B7CA3589768512DAB67C991B31DA8F03A4261A1F336D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4900	elevation_service.exe
860	elevation_service.exe
2360	maintenanceservice.exe
480	OSE.EXE
752	PerceptionSimulationService.exe
5332	perfhost.exe
5572	ReFsDedupSvc.exe
6364	SensorDataService.exe
1420	ssh-agent.exe
1248	AgentService.exe
5728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\611c22d9957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038aab4d7672add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d3967d9672add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000094cd8d6672add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008044b1d6672add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f1e3518682add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005710e2d7672add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000907e36d8672add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006669fdd7672add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4408	javaws.exe
4408	javaws.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
860	elevation_service.exe
860	elevation_service.exe
860	elevation_service.exe
860	elevation_service.exe
860	elevation_service.exe
860	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1248	AgentService.exe
Token: 33	5728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5728	SearchIndexer.exe
Token: SeDebugPrivilege	264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4900	elevation_service.exe
Token: SeDebugPrivilege	860	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 4408	264	2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe	90
PID 5728 wrote to memory of 4432	5728	SearchIndexer.exe	102
PID 5728 wrote to memory of 6252	5728	SearchIndexer.exe	103
PID 5728 wrote to memory of 1800	5728	SearchIndexer.exe	104
PID 5728 wrote to memory of 6800	5728	SearchIndexer.exe	105
PID 5728 wrote to memory of 5056	5728	SearchIndexer.exe	109
PID 5728 wrote to memory of 5296	5728	SearchIndexer.exe	110
PID 5728 wrote to memory of 2552	5728	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-12_6a99532cfcb562f9f493e706096f02d4_cobalt-strike_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2360

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5332

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d3eb593353af26794d6a581edcdb1cff9101ef0b3fded8b2ebdb827ebf9df58e
MD5 26de23c63c1bcdcc0448c5163442144b
SHA1 2ef3dee94e3fe6c4e944708e1c8ce154c64e32b2
SHA512 a7aeaa98e48d19110aa8659607f64f574f1c318500e3810de4121fa8eb1ce15a980774657548f48416d4482306bc1abea15612deaa2097af7b1821c27f86d3da
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnB8HNUPCAaq8Wdo0:+3q6HjBC8t4C7
TLSH
T11FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f2d6d8d985255b24dd56389cd6147cb77fea1cd82cad21c53d198e0d3280673b
MD5 7ae36406703d97dbf1d5f5b25dd333a5
SHA1 2cdce4da6bba6b3296430d7dedcb302e44f95a35
SHA512 ea94fa21bad29d328d90d54310b5b546f45aff7e12621e005d8439364099f978864674cc9f76f3727785a5a9d862851305a8b592f621f0f120736ffb140fc367
SSDEEP 24576:OXYfDtczAO1N3RUDHNmdPCAaq8Nozgi/rE0TOj:Ntc78HNUPCAaq8Wdo0
TLSH
T1F565012C77E409FADD67813CC8A2C511EA33B88547A0F79B03E499295F232D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3f9a98b21d4fd74198cfa39af9e5ed62bbaaafcc591818a555530c024fdf4da0
MD5 bf1c83795c170aac79f685bc0b352e4c
SHA1 54f6b63c876159a3c2febb57caa05b91f61fbdf9
SHA512 184a0c6199fc936ed2be636410c4b6959ad967408ec41f13e02e406fbcfdefb400fc7f9a7d36c533d955b4c86c954207119e992242b85e79dcbb04e4fc9469e5
SSDEEP 24576:60Le5ji0hmxirM91N3RUDHNmdPCAaq8Nozgi/rE0TOj:6Pji0AcM8HNUPCAaq8Wdo0
TLSH
T15E85AE26F5B48331D073C0B9C5D2A69AED7130865B308ACB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9964765425f013223909d2a376d0db0aedcda8a6f70617fa52acd8aa89594159
MD5 c676520f1e1ee2e3e2f0e6d23211863c
SHA1 2c6b515361290f57f64d6cc370ed82453806e1d3
SHA512 69779dc59e34edef8c8e5e0a3c7fbabbe31cf07c4d3bdf0c19848596ff439d66aa81ac52c682f744b387ad06f2189721ddcca42ea950cc87e239264d4df80bbb
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyu/1N3RUDHNmdPCAaq8Nozgi/rE0TOj:4/ezSC6vUzPvxHjyg8HNUPCAaq8Wdo0
TLSH
T1B0756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c2c1a131fe74ca71a301acc3a0f1c5ed88178cd0a70078a44ee4674dc403e7be
MD5 280faac18886bbde89992ef72f9a8123
SHA1 0f44b95e2599383be68beeaf391e8395e01ceb87
SHA512 b9620b6dbf21c05da6f08269d593183ed58d45897b01ba407b444c6b6a665e1482c6cc43b96b15809c0b7280d43dcd94995a4c4fb1453b431e59e69cd38c675d
SSDEEP 24576:EVbqPb88hv/l+661N3RUDHNmdPCAaq8Nozgi/rE0TOj:EVO88hXl+98HNUPCAaq8Wdo0
TLSH
T178559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 364d747c2a07c7de5520eeea47ca9feabf748522d57cc7c6b0773032e5a3aa6b
MD5 d7d52ab9b6f16cd56e1cab18e4b4feea
SHA1 bc90e0396bf8f03ca809eec3e7b31f31f87b2d5a
SHA512 d763ae0e07b77096c8dacc2d467960d49742f4f7835b72ab6e73c6ec132432ea7f0b6f43c1397adb31147ab32e1d856178a31cee7e6c3b173d28949ca19ae7e1
SSDEEP 12288:TR53FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:TR51N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1EF45235E58E443F7CBB7403021FBCEB13961AFC49985B3274BA17A1DAEF6018946582F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3c0d5115b7e33b2bf9fe965e2c3fa4663370bdc1ea48584bb1d2245f56b0618f
MD5 900e9a79a9f2f39413c2785e7507e65e
SHA1 aeb0be9dd15be6887446c10b59274daaadfb6787
SHA512 ea353ca82e095af8179da60dc6156d0accbc6925b95077df4e61b73d4ace5439de6321f39b8e717452b3feeec6684b1a40e9e6e8819ee3c0f44725f8787eecdf
SSDEEP 24576:vJIUi1N3RUDHNmdPCAaq8Nozgi/rE0TOj:vJIUq8HNUPCAaq8Wdo0
TLSH
T19465CF3BAE68FCE2C27A8D785691C740A77278704F62A3CBD175820EDE235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ddb45d30ef3fa1059972fadee0fd6aac485e31a964a20c06308ae6e91f31464e
MD5 9b867f0e3234952388f91392d95c31c0
SHA1 fb15dd9d2532a58b3728491811aead26760f11a2
SHA512 1525539b24a84121bc9123f3774d08f064c610a0e8f3308ef6e115fe185697bcb985e888da161e457756109eee3315639f83b63f93e3f7ff54920103e110c5ab
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:FQvGAdlCEL8c/yRNw5Cb8t4C7
TLSH
T1A7266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c1837c36ffcac485fdeff4df3adbf15235bd7b88b77071858b3e00d4475d520b
MD5 725ea6a692ebbc68789568a7e2da544e
SHA1 d41386edd15d3c0fdb87dc2065f669fc2265ee51
SHA512 d413d1dc6a82b51ce9725c51077c7adcf3f3aca16cf8945dd8363cefff8aa1ce1ceda6694db04ac6588714c1bd7df15ada2584dffc80381fa142e315cff4378b
SSDEEP 24576:pdewsAj01N3RUDHNmdPCAaq8Nozgi/rE0TOj:3lj88HNUPCAaq8Wdo0
TLSH
T13F75E031FEB4D036C6BB0DB61B36C716187C7A604B512AC3E3E85A9D59701D22376E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 83496232d06a14d25b0b3859e4dd50ce486a75d48e17e358226c9e494ceac4af
MD5 43a574f2721d4b98a62137a86bce51a8
SHA1 463ddec518667124578ae924e889c3d3f8ff3194
SHA512 b8908910dae8fa723363c200a6f1b3ef4b35418fd4b9e7be52187c5587d68b830eba6e3c9e4149f9daf2d86b705bfa67529f03632d162ee73b6cc6033732ce36
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHE8d:AUEtQevvqc2W1cpV2EI32Eq
TLSH
T1D2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cbaf015d95afe1739b093a69b82a4b20467c55e0840f087f454acc2d0a89352f
MD5 8fb4ecbd2fb0972cab9ea02e0a85cc59
SHA1 c7d15ce477bc32ee4535f5ead81fe19c56ca50d0
SHA512 c15a67133267908baed9eccfc6576f403de4d0891f5e53d09e989347d1bfdb03d39dc6a8968fd2791fb150254bcc43ab16a0520c523d9586313c7bfe5e56b59b
SSDEEP 49152:QCbRquA/m2yL5zifFiV+XenmE3/zc8HNUPCAaq8Wdo0:5oqHVjnmP8t4C7
TLSH
T1CAD58E0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6703a35fd5e69d3a68cc907b3aabbe4e5ea24c9341aee641434aa9c1bf8c8722
MD5 a8ec3c98b0e66e9e843e8f64591fe9aa
SHA1 c2fdcaeb5ae26a049bea11c962347419196a0a09
SHA512 ef05089593aa8961808384a5869cbe0257215d9fde4042aae9222026ac50b1f71d9d7d583c02d84c5e7c076580ad42e46c1be219bd66120a5ef6c5cd1b80f058
SSDEEP 24576:8AhGLJIFoiwtA5l7S53D1N3RUDHNmdPCAaq8Nozgi/rE0TOj:8AMyFoiq5/8HNUPCAaq8Wdo0
TLSH
T1A035AE81EBF945D4F5F3AA7899B68570EA76BCA55E31D20F2260D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1ea513fc2752b9dff1d36692fcf5d291b76924a40431b0d62b71483cad6b91df
MD5 3fc096617693351131458bd078306c10
SHA1 8e57d5ad5e9894eab8190686e73d1f1a1c9d679d
SHA512 5da9f0bd4e70ef3a838340f160d0c98da74209121fc986485173af344ee12b1712f5f40b250e68add6147ce5c8273fbac448d7b058c2742ce34f89f7ea4a5774
SSDEEP 24576:uwuoOW41N3RUDHNmdPCAaq8Nozgi/rE0TOj:uwDOD8HNUPCAaq8Wdo0
TLSH
T18B65F14A36E40CFAE9B781388597C536F7F2B8412A21D71F17A0C65B6F732216D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 860bd0ce2272117a8e847d77de70df9f0654c459a4abcb87ab74e5d0dc37e535
MD5 5ac0ee64c520163246fead4bb34c5ad5
SHA1 d60d904fed48a55d5ba40bef23722d48d330a086
SHA512 a06b2eaf3e57335a2d0f293c70334c49f49e20704cecc12cc0756b723a3598ec970a0c182f2a9eff0ac6dde9ee7dbc8eeff7ebbf39d954fedd85709f861a7fbb
SSDEEP 24576:yZul1N3RUDHNmdPCAaq8Nozgi/rE0TOj:R8HNUPCAaq8Wdo0
TLSH
T13655129E32E422FBD6B3813894F68A51E7717892677293CF07A052296F735D51C38B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1015a8f832239a24542aa65ab5ed413212602971acf7b603b4c483662bea0dd7
MD5 f61390178a0b7be8ec23351a1dc3c18d
SHA1 4cf93680a899774881cfc13c07f753d012e20e70
SHA512 5afc10a306c85cae88e4b1c7a20059fc351fec9160de8ca3cf8170e5e784ec9689a411b91f707edc47fc2954bfdccc9af7d813cfd9071758bcdc3231765d1284
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:yQRQyi36YOcPQLvw2gAf+PN3e8t4C7
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0d85c3b0076211ce58f26ef6ea87cd917127067b7ae99d2b8a34196959b2c707
MD5 511c8ebd0174e2fe1621f4cf9e6b5d87
SHA1 da9de62c9fe1ecbf03819bdd0ef18d603c03e0c3
SHA512 69fa7855d6ab2f5bc7853038b266e6059114c8a212d9be88313f95cce0dfaf46dbed04d71dda49e29cd9b53acf03415bf483a5deab4860a880d6699851954bce
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:YQRQyi36YOcPQLvw2gAf+PN3e8t4C7
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 60202d18d733a9e20004737304cb7bd84a10c6fcd61c6fb4348a4e33ed1e085c
MD5 afa87824c7cd20a942081795bb37f65f
SHA1 d0609af691b7f02c6fc2228b7eac96a15d8bf25a
SHA512 98d415cd11d82cb2f42510619a22b9668738ef9ddc7230ea1fa03c9c1e0649c6564c156e8539b0559bd9b4c1fb8ab889e14336f369442d9eb74c345b37196a99
SSDEEP 49152:b68Qg55nhheWu7PNU3/M8HNUPCAaq8Wdo0:lthWRc/M8t4C7
TLSH
T175B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7fb221c89972b87a889cc00f8d30088e6f1e8ee4242267b28ef32de7c1cce030
MD5 e56d09adf68ed85bb14567a425e843f3
SHA1 3e5f608c4bac8e7804b15c1726885bb54f15761b
SHA512 6abc5dfca01bf29c9908c7746c9f28c1c2f4f0b663f51569b664c4b68a68df71d1b44077f3e61ade55999cfef155b3c80c4e6f9681fd86701c275f46a5641033
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:ly5112gYy5azzVvL69nLKnhZF8t4C7
TLSH
T17C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 005cdbb1cc7401260a97d2e65a97a2b2a9295bb93805a0320f37197345453193
MD5 aa29c5cefbf8f5a3003804bbf22cd550
SHA1 388b56b626231fae3c4b7e47dc06b067c2e44508
SHA512 e2fc8d0d09cd6b1dc00f8afca677acf4e80c653839f2f0d6fc4091c6701e40c341620f2976854205a47d895d2b22a082714bc39ef6603a0734943e4177444896
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glW8HNUPCAaq8Wdo0:wu6JmVxd2dW8t4C7
TLSH
T13FD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 928f725d61948abff84e2a4cf660b2ed51a3f53c453a38ee85547f7cc0271dd4
MD5 9d7a61a1c37d8f1ab4ff62d579f8017a
SHA1 a77b687189b391c1aa4ea5dfb959d9db2e24e716
SHA512 cc0593fe5737c93f0afc51c2204ebc4b426631834c8032fa634062e8068c1691a27bf65c027692880279cb0d2d4d591506993684129f14acb72309c9f2c548cc
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xK8HNUPCAaq8Wdo0:tmifPbRP8t4C7
TLSH
T17CB5BE13F2D801E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dacf576189fe9d5292039c3ef519a49c3f6e697cdda3dd497a29330c34bddff2
MD5 5480864ee9573b14696813687c74cd05
SHA1 ca5c1bab192f81c197d6d15211645d845c253a4c
SHA512 8361c3e77887c7b09d13d621c13ce885cefaea2a5a57fc8e4c821c15c1bceb85899cbf0169b0d53a24f1e6d014478aa80b68fee7e616084cb00f255cb4f04138
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqx8HNUPCAaq8Wdo0:V5dKTi61x8t4C7
TLSH
T174C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 36201e4c2bcddb9d28594b1a8c0764f0563a74e4b9d4b0058c495e38a89ce81f
MD5 b4aec8c9067b92a6325132bc966a0ec0
SHA1 fbb6316f2a82b38848f9ee2a5a43d1de55d3eb4d
SHA512 034946e99fd636da5e13aba631c6d61e92a2675dd945082ee27d121340b3a04816ca23a964d4b88ade85cb6147b4b5b1d4f707913a111def26f94a4fad3ce97c
SSDEEP 49152:fhtSn8EApI0figngiDn0AP5wG8HNUPCAaq8Wdo0:OX2iyphj8t4C7
TLSH
T12A95BE13F2D901E8D06ED178C7468632EA62BC050B35B6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 84c16f3c95ff68d323eba836c4e7fb72848f898bc26ec27efe110555a89ffc0c
MD5 86f9836f26b297bcf1c2135244522d49
SHA1 1bd6637e0b7d54ce0a5bc1c64f6798bba60dedaa
SHA512 2b630fdbc87b60617b669135c6705227e469872d715eccd38f603d5288469b10c4d72731208085748292fea86bd62d02cfa083991e6f85b380680b056127bc5c
SSDEEP 12288:vh3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:vh1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1CC45235E28F543F7CAB2803021A7CBA179607BC5EA8273275BE57519AFF30282465C6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 92dcfdf3b6b7f846ea81e69da086a6d2ea2863dcdaaa717c311a0a1c8854dd18
MD5 9f14ede3dfcf095595878b4b8e54bf71
SHA1 d2e264cbf19784f2508ce07f190e7c49509302b9
SHA512 b4a49325754081fa777b788922d9e0ae5c301ed2f31aba2d1f7ce01eba7111dbbeca517903fddd99733d5940424587f6bf72f8ba75fdbd3030a4616cf1411306
SSDEEP 12288:EQ3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:EQ1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1A445235E28F543F7CA72803021A7CEB179607BC5EA8273275BE57519AFE20282465C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2e66e980809e031b47baf9b69a28bb764eae8ddaaff966bcdcf8749d4375ec90
MD5 cc500dc46dfc244a21baf6a150dba0ca
SHA1 4b367a7b332e3b6b45d42a5a807dc7d6ae407b26
SHA512 362de18a7026676642e5ba3630d3a4f1d7cdde6169b18ce6908c99666c905ee56fad11c156e9f8ac896be0b315a9bf41bbfabb039ea3c7b4a133644c2100201b
SSDEEP 12288:7q3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:7q1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T11745235E28F543F7CAB2803021A7CBB179606BC5EA8273275BE6751DAFE30281465C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8b86723fc556c423b7c6efc40d3319aaa8846432eaef0a05e52131465882f1d5
MD5 1c97fdc79dbaa8d7cdf77be9420e8e3f
SHA1 ac4a24cdaf4ca6438648c30d09f2fd4d6d4b2b83
SHA512 6e5d9148b0a394ac4f899e21ef3387007711f7c10c6d68118a39b0fce02fee262f64f52b55be8ff4d76ee9f3180b7c9c0b0404c86be7f8761df233a6569e8985
SSDEEP 12288:MVj3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:e1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T10945235E29F943E3C9B2C13490B7CA61B6B0BEC4EB22B32F5B91250D5FB21542874D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dcafdab614f0cb06fa06f9ae5dc94f40b300ddd5c5a24044b7a13a18cdd3bcff
MD5 1cf1ff648eec3d54bc44f9a5526041ea
SHA1 9d902b967c9eafd72dad29f4a6b1026c4d5ccd30
SHA512 6ecae675d6c4e51341884fccf88cf3ec43744eb9dd6ed5e06cfbc911f985b0f2e88dc59471a6cdc15fddae2ae5b6d71202e2acea5a4f498962533baf5081b439
SSDEEP 12288:Nb3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Nb1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1E945235E28F543F7CAB2803021A7CBB179607BC5EA8273275BE57519AFE30282465C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0be168e59552e0b46e531b8c18f6afe89eac880a30ce867de84a3bee346433ea
MD5 06828b8b0130cf3859d7b8e4f1b0f95d
SHA1 25b3e48a561a16db82714225f8cbc3f4d398720d
SHA512 31f9993f5631d2ee80c615e6a9b02519503b61417c9c11aeacb2ce72b4d97c5fa934b6d3d847e0c48b93b98e3f9f0b507289d262217e49239c79f587b1e94d00
SSDEEP 12288:f83FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:f81N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T15145235E28F543F7CA76803021A7CBB179607BC5EA8273275BE57519AFF20282464C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2c2f4e9abf86dac228f8468503ab057f108a6d41d75b4662eb3ca4442751ebf4
MD5 747e61cfb488f278be7c44b3d9f1e4a1
SHA1 291bedac850ee54570b08007f240b480341fb21a
SHA512 70cb12933299b97173a3e9a017d05a0e1b0f61be1eeafc103208710d00c02d853d807d4ae314ce98d9fcc59d0d05214ec6c119e485743530eb37d132d81d8df7
SSDEEP 12288:Po3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Po1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T12E45236E28F543F7CA72803021A7CEB179607BC5EA8673275BA57519AFF30282454C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 40978dcccf7f12d0a1eca4b2662e7c660bf2867e1315498aca95e52df8019ac0
MD5 b4020d9eecde7cf4c13ed021a00115c3
SHA1 8c86eae9c9d1531fe15633fd5638d2543d137e35
SHA512 69acca4a8a27cb12e21c4cb986f7e059c1588813c4a3fbd1e25942ad8e95fe42cf2e06606c0286f91754f76911c9bc6cb759d54ed747c22081bd4245186a0a02
SSDEEP 24576:9ZMSzFVSOw1N3RUDHNmdPCAaq8Nozgi/rE0TOj:9ZMSzfk8HNUPCAaq8Wdo0
TLSH
T1B165019973A019F5DC73813DC9668916E6B27C590B60C61F03E4362A5F733A11C3DFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1907cf3ad3fdb4e739cd2a8671ea863a9fdda1a89917dd275812ebbdfa5d4b72
MD5 9bba310f8f75a244d94bd510648007a6
SHA1 82a1ce1d25e89f6d778575d7fb87b5ebca7245cd
SHA512 d9095785ff1b714ba17c21746cd36ff92ad6c2a169d96429cb7fb52c0b3e1cc9feeeaed08a178df2fd2635d45fab877040909e796c2d4c5a4ebe9f9261874ccf
SSDEEP 12288:J13FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:J11N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1DF45235E28F543F7CAB2403421A7CFB179606BC9AA8273275BE6751DAFE30281464C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b27d02d65db7aabf987d7a022ddeeecf9ff00ae2226f2b8a32d12dc94e464c6d
MD5 fabcb3f496427a61585ab1dc429bbd9b
SHA1 985ba756db88809cd49324f53d20b821388e767c
SHA512 fde1514c2fc04860b7174e5c471cbcaad0d836c3b4748cb98dbf50dc484eb15b3cbded0ad3713931daf7b9ddd45a7de99b330cab10bbd24c2652a2fa62a927c9
SSDEEP 12288:iJ3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:iJ1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1BF45235E28F543F7CA72803421A7CFB179607BC5EA8273275BA57519AFF20281454C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 598b688b7e8ec0f6f57bb0e0af5e2bbf3b73ecfc737a1f784fd3a24267724110
MD5 d4e46c70251341b1871faf587748c53b
SHA1 c47342b35a24bce35de4cd2eca6091448d558ff4
SHA512 3dd0f98e9534f6e4730033a084a31594841d152d90632c09c248d24ae94cb9c5d3cd44e5877f51d5f70bc3bfde6bdd7377a6e5216cd9a63551a7cb4463a178b5
SSDEEP 24576:NzyE1N3RUDHNmdPCAaq8Nozgi/rE0TOj:Nj8HNUPCAaq8Wdo0
TLSH
T1C155125B36E132FAD577813884A24E52F771B8754B209B6F17A0177A2F632A05D3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c8c0eb5ff0a7e9b867652bad7958c85d070107583d75ebd62a0f6bd32175d436
MD5 791a0e5640ff87bd6c4733fd350a4c4a
SHA1 fc238992e7829ca782d9604edbe8d28d179cf7be
SHA512 6c877d556fea6a0fc71af345935b67465f9269c758d5738cbafca9bdb3e9369086a1668c6e75fb4e388d307b29b856abf3ebc75188faa5c69055c5b710fce86a
SSDEEP 12288:m13FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:m11N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T17845235E28F543F7CAB2803421A7CFB179606BC5AA8273275BE5751CAFE30281465C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ba20adf3dc886fae2aa890df33a55c6d200be9d76229e40b96ecf461080eddc1
MD5 d17bf89e9dbadbd81654342e480e3f1c
SHA1 1d0384f91dbed5643f4566eccc70bfba64d814b6
SHA512 aabb2520cba15eaba32be68b2c18854525278e9bb479782db87d55f2216343404cea095a2f32ea3a98eb34f2b1bd8f0efc700d4162be92fd74c756f71f4d5ba5
SSDEEP 12288:913FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:911N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1EA45235E28F543F7CAB2403421A7CFB179606BC9AA8273275BE6751DAFE30281464C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 987efd8ccf54197b4ac6df5b3ea32b8e992402794f07f04bd1b24bbcdc650915
MD5 72dd25bc97d05e33220ee3e056e9f72e
SHA1 408e556be0995385565dcbd67755ddc3cc566055
SHA512 bb51b623464005c4caef825e837168dc639eeb4479ddfb24d5350bcc91a2ab68c6c1e6bc3d0de28b714e45927b4ce2419e77e417fdb701cc106f70dbc09c02a1
SSDEEP 24576:5zyE1N3RUDHNmdPCAaq8Nozgi/rE0TOj:5j8HNUPCAaq8Wdo0
TLSH
T12655125B36E132FAD577813884A24E52F771B8755B209B6F17A0173A2F632A05D3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 84a335b4f190cfaee9acb0ba6c642b5e4ae67f6825a5ffaaf31f6b2b1d2b7451
MD5 250156b2ee804b6a567902a010645809
SHA1 309fd7a6e07a934eb13c74df48b954dfb45bc447
SHA512 54edb3f9a392e99d8c2500ab4fca9f31b0e1aa0da53804fd1f243ba8b63f24c981a0b500763e27cba8b18de5d8cb98b9a4393e708545b9dbd061655ac69bf8b5
SSDEEP 24576:oTHaLl3z0zDa1N3RUDHNmdPCAaq8Nozgi/rE0TOj:oT6Lljr8HNUPCAaq8Wdo0
TLSH
T1386501A973A019F9DC77813EC8668916D6B27C5A0B60C71F07E4362A5F732601C3DF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 86a85eb8accaf2320d1999b6df40bd1edbb911ebe208eaf6a9b6f97d9530d159
MD5 d31cbe03ed70681f0d8b2f673b70e19d
SHA1 a56cad3959696d920b5fb32e561436b2ce4ae18a
SHA512 08e2e5856eaa339b0d1a4b99a081101f616fbb7e7dd59ac6236115fd57296a749cbd24b11f84f3fdfcd8ca654b85cf27645739814a6ef42b8a4c0a1b1b8f9fc3
SSDEEP 24576:l37d9CHKy7GZ21N3RUDHNmdPCAaq8Nozgi/rE0TOj:F7d9CHKyak8HNUPCAaq8Wdo0
TLSH
T13575DF90F3E411E9F1B7CA3589768511DAB67C9A5B31DA8F03A4261A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4dd1e3b88420e05e5f482c34e11674cf9bb607e722a45ba6c86e3b66345e94bc
MD5 6144f627bc6eaf206e5136474cefa177
SHA1 dc896cefc0bdd00b5858af5ed88ee91fd9e0605c
SHA512 6432bbc6d39a0bdf94305669aa5822a0d8bf9973a65dc4f27b4f8d3a169d2c03d91e8cf9ce570d1ebd6c5e9ad46a52cda4d8c0868016bf7474e6a4a28260c41e
SSDEEP 12288:7K3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:7K1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T13545235E28F543F7CAB2803021A7CBB179606BC5AA8273275BE57519AFE30282465C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ae30488ec8dfdb86ebe830f78744d20f15ac60a9911b9166046a135492da744c
MD5 ea2b4bc6d79155f414498974f642cc71
SHA1 0a7e430ea19ca5164d15a8c76e2c314bea4a99e8
SHA512 5a81510500d20fc2cae5493b54f41122e38a4d4a88268ad2bc28fecd51f0366ca6c3b173ed0b30f600d1f0863d90ba974477786d953aa7c7c1498222966ed730
SSDEEP 12288:xk3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:xk1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1DB45236E28F543F7CA76803021A7CFB179607BC4EA9273275BE57519AFE20281464C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 496eda0399c99b9be8c6b78938d73bd47b060caeb52609b918fb36497ad56c21
MD5 b3835fa5236ee4d28aac80c431210526
SHA1 c7e014a4601b1e65225c018c8f50e4e6fbe1b616
SHA512 1ffc96de31a5f95e241fb4c47b5bf75b6fd9b66a545fe22c15e66dba2374890e65bb603c7fa789a15228a892ed0567244b6eedc4aaadda7d0d6bb7b4a0647735
SSDEEP 12288:FX3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:FX1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1DE45235E28F543F7CAB2803421A7CFB179607BC5AA8273275BE6751DAFE20281464C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5320b1aede563bb7006d3145ef0b3af67271bb83800f47eb239c1ef2de35e2ac
MD5 66b012cd5f9081024cbe61a4eb9a7ae5
SHA1 71cf7a0dbbceee7a22559f9c226286e7ef84b187
SHA512 3c3d338cf73e0845b255a2e03f59260ae92f8391cabcb9730986a68cb9f200d39f5b966959235dac1c2ab341113d6a1b6b3d5fa14ebf6abeec02fb9531572a38
SSDEEP 12288:Q13FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Q11N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1D445235E28F543F7CAB2803421A7CFB179607BC9AA8273275BE5751DAFE20281464C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 12c9ef5ea3084c0440810ad8872d2dd1aea6f7e120e8f4d82ad47d49db478879
MD5 ddb4a2126c5a2e236112520aad24689c
SHA1 29a14bb1ba982f69722694a1be941d2386af1a82
SHA512 e4b2b93d8e7d6839230dfe6f666317c1b07749fb1bf7deeaff07ed822e06e7e5a9b93986b21255cdca44bd904ffed17ba3e7cb5aa9a769221211107540ff9286
SSDEEP 12288:wK3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:wK1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T12345235E28F543F7CAB2803021A7CBB179607BC5AA8273275BE5751DAFE30282465C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 58ba2b0e3c7706d42b2d03761d9f5ce78dc61e60e7fb90c8f00544a49e7bccb3
MD5 552b3beb8c9fb03903c84932b9cc117a
SHA1 1368ebad066454deb75936ba56a361109e12d802
SHA512 fa4ebbc51af57455d8efd64b27ccd4a98aeb368bdd01c425a5cdc8cf3c7691f4e8f8eeaa9817cc0aff58b818fd5a6cf7865c99ca081add7e834229e5b6f275ca
SSDEEP 12288:lt3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:lt1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1A545235E28F543F7CAB2803021A7CFB179647BC5EA8273275BA2751DAFE20281464C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1b5b2672b2c1f1dbe75e6c6dda9b78da24dab3bb3409e0f914a34ccf8277a12c
MD5 9c2037727d49be43c867d39e22bc9f95
SHA1 2dff9333d1b9652228746943ff1fa1b5991afd1c
SHA512 40c680ba6870dcb65752177544a15389012f0b5b60929f34bd1dd472b219860ed26b0180cce7d45e69b3bc5fe4858ac7c5df33bee228011272d8fcbf3666b751
SSDEEP 12288:pb3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:pb1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T19F45235E28F543F7CAB2803021A7CBB179606BC5AA8273275BE57519AFE30282465C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 503df867581f4000df1f5b544d4063f4a4e5956cef4138ae33c0a8d65a3d1d51
MD5 cbd10bfc1cddfb6d9b3a5c50923db8e7
SHA1 8ac3e992f0a48bcd6b61bca06f407d2328ea3e85
SHA512 0fe3353ae85ce354306f13fe0dc2d9b56210776741e8d18d19095f0f086ecc5eba5664a460c8e06dfc485d0df1c462a018cc6e30fdc928b46b08d8009600c5e1
SSDEEP 12288:Ny3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Ny1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T12445235E28F543F7CAB2803021A7CFB179647BC5EA8273275BA2751DAFE20281465C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 cba94d70ca13601e87459217d738572420045ee80598c4caae58c4f0ae3c9cd3
MD5 9adf5022f72498dba4894a4161bda7fd
SHA1 6d3bbd8ba35c434190079fe183bbdce7a7adf9fb
SHA512 6f64468a24e0a505227f87aeead2aea05554e0c323f9dfbc8b69c3858f38a247132cf6b0beb8b7afd796b75e46d2252b212b406175cf020d8f615958480a802e
SSDEEP 24576:Ifwvok9RX6wkyAIZ1N3RUDHNmdPCAaq8Nozgi/rE0TOj:wMnYIl8HNUPCAaq8Wdo0
TLSH
T14885DF2DEBD845E6E1B7913C99B7860AF6B178581B31C2CF029A536D0E33ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 174ca01908920fb45c2234519970d45de2a9855d4dfaf0820a52d5b0981ed1ff
MD5 20b4ab06082b0f6a67a7a349553d0445
SHA1 6a88a9ecb6d8b533c8baae621f7a62c67498680a
SHA512 bba9c6fb0af286e3614da9db3df20d329150b9e26324e54eb191a2f273c34bb572446d22960a24b41d3a670487a894c9e2f73961b6f79c3ce9880c2846aa0885
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0m8HNUPCAaq8Wb:uySzP+8t4C7
TLSH
T1A0067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 98015ecd215f5a4ce5bd9733dfe5245fb51fa0b9679a8678275bc5e088b4a9e8
MD5 95dc4648a5c0bde64025b4f68837345b
SHA1 a1570e7b12cd2f780602338f6e29995194c01218
SHA512 7775eb3a19df2b2b19b0ce279e101dfebd64be5a5fa1f5c52d16eec6998f86436895921f56041c0fa8a78c5d01781bb6c010fa839a65510cbd5840affcec6da9
SSDEEP 24576:d47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYA1N3RUDHNmdPCAaq8Nozgi/rE0TOj:d47JUQj1irIhCnDHUPfF/W8HNUPCAaqR
TLSH
T17C65AE1EA3EC02E5E1BA823885158A5AEA71742D1F31DACF1270437D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6f004fc61a1d58d9a34346ce8701215087a6e93a8ff25648a3f68a59ece3cd01
MD5 a126f19006c673e4b71036efd9306755
SHA1 3f5e74c1369185b879a5a1187e4813f1ce105956
SHA512 8ac33e8a26fa0642d477084f7d2618789588e251bab50d0117a5eac4da39591209d96e606e73d025cde782e21338596cef270be304d5c423e8a15146ff1f51e1
SSDEEP 12288:6Nsfl3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:zl1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T1B755011ED2A802EAC0AE9134C3968A41B7337DA597E1E3CB17D0F53E1F761905DE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3bcbc4128bace1fc3b7bf4f8a22947a3660ef6f503d9357f3b43ba61d5514eb3
MD5 667b38c8188fa48092396a03afce47bb
SHA1 40051db31c3634ab82240c9920490294e50d097f
SHA512 568ac91be6809733a082ac143e9dbbb93ab351274dcd059f7e2c21397a5066893017cdf4274e0f2266c257e08b5337064b8bf2bd7a9da0cbf1d044c0f139fd66
SSDEEP 12288:8PBlmU3fqoiEvKgGC+SOALt+KfUPRs61ys8iW:8PPmUPigIg+6UPufpi
TLSH
T116353950766BD75FC5A940361E37C1CCAB707C41EE44AB0372C89B3FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 1bce350cbb0f8e8e82cb705e516565e66c1c3cf3eff190eb4b6e49e8a3e67672
MD5 03b4ea912d04dd960b9de6795cb8e471
SHA1 db600366e7e2d7d53c9bf3edfeb71b418b143056
SHA512 d179c23140a92048374b22bbd717dca72beb6f87c3bf36b5b2c537fc7c491fb6a235f0d6a0f0a7b5cd3b11d7022b74ecc77c8c83a36e321443fa27a02c8c018a
SSDEEP 6144:Xq6MUZCmV2JfJ6JDL8AKf/cAIDAIhkXlJk0gfFzKBAfUPptMxLPptMxEbRdfClJi:CRgRbd/y20gF6Z+QJU6KXA4
TLSH
T18C7509815537A3CFC1FB2072073A9B4CAB64EC0677456F2673C8553AD86A726B0B93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0864e195c9b821fb77da66e750dadd44ed6317697b57d9725025e317e3d7a1d9
MD5 8d650af9865406d8b7212728233a8617
SHA1 8cf7d47293cc4fb131f91bf52d3181d3b27b3c4d
SHA512 b9a732c166231e54c52a1a447296ba31e91639316dabe246b98dee292f250d939681449a02910b48f87e3cb906b97e74b1965ff73c8be4813931cbd370f92c55
SSDEEP 12288:wz7d3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:ud1N3RUDHNmdPCAaq8Nozgi/rE0TOj
TLSH
T17845236E59F847E7D9B6403020AFCA703925BBD49F41B367AB91350DAEB20985C74C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cab91831cba202d226cb0bcdd874c904097252cefa1f9893382f5743dc2c34ce
MD5 5acf7a71a083e08f831a52c60d4c182e
SHA1 97da38263d9edfd98549cc5427b63240a638078f
SHA512 08f272552389ab95f93951a6950a085c8639199c4dd8d181668231c86a6c781fb76d8323f562cdd843b291f03587caa6a16e303fc335e0920a5b3c23593827c6
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bY/1N3RUDHNmdPCAaq8Nozgi/rE0TOj:Ugb4mBIBhGF48HNUPCAaq8Wdo0
TLSH
T12365AE1E22EC02F5E0F6D2B89DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9063b598d00c952511986b899f97a5a0fbf5ff720ecb0036fbd0aa386c4faf50
MD5 20349e5888aceb9178ea67349cc510b5
SHA1 a9c431fbc2a9ebcc9d590b6c406810d540100846
SHA512 4d0ba87c3f8a66f94f6c3ebb859b761c0ff988cb94dbf073db84a68b8315f92b4094f85da64e4b8fb96d88a71d2ec516adb0313bc7edba0b4a15144b7a69d272
SSDEEP 24576:5G88u8FpJqH1bzria7/mw1N3RUDHNmdPCAaq8Nozgi/rE0TOj:s7ZFPqVea7/z8HNUPCAaq8Wdo0
TLSH
T1DD85016976E102F1D477D13889864A63F6B2B8250364FBDF07A88B551F236E40B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 53030f2bf7e4e313dcce593556027fae53aa646ac32cb2d18dcb5cb3eae96609
MD5 2324d11ab472907f0f0478f3bd6df62c
SHA1 529a5fb2d83e7a0ac81c41150e74454694507ab4
SHA512 a237035646045975253ddfbaa6c7b36631c0f8ad0f1d8863412b91ee95d557aa057c9923593f5d4961fa945c9ef2a2766ca4a4985721ffb22265fe9504fb8802
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj08HNUPCAaq8Wdo0:4G05lO43bt8t4C7
TLSH
T1E7D5CF6E62EC11F9D1BBC17CDAC68A0BEBB23415032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a02c42d645463f402f2502fcbc9765387bd92577edbd8177df40f29076066026
MD5 70101a8cd2398e4ea98b7a7d9f5521b3
SHA1 27aa6e68218c5291a15d2bdb3fdc6837527db519
SHA512 79c4f6d1297ab524b3912962ae222f6e57901942ca580705a7b7fc1a63626e3eacf1ae9491c3b77c35cee37d9b685a52e32bca7ffcf7b4a888b00e5ef1b08414
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnu1N3RUDHNmdPCAaq8Nozgi/rE0TY:Ca5POZ3+Jt2pasx2+mM8HNUPCAaq8Wdd
TLSH
T13F65BF5EA6FC01D5D5B9D17CC5838A1AF5B1342553329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6f3b1745b100d0e272646ca6883946e5ade87de291f47a09e66fc925795938bf
MD5 aa6afa1ddf21446d85e7385a6daab99b
SHA1 5654325c65008aa532a3b413b9f544767eb8fed5
SHA512 fb787c8f8e7ba96ee2ce23897fef48c0b2ca931048e4ad5de11e447158e5d742d8d8416ef2aece50488fb417e0c0e19f2db2ddcb66762b1a1389c15dc9dd66d0
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkY1N3RUDHNmdPCAaq8Nozgi/rE0TOj:WNc/zEOVHFT8HNUPCAaq8Wdo0
TLSH
T1EC858C2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c449d88a2b742bd12cf9506544586318de860d1d725fb913afebb29e022623d1
MD5 9bb6646177963d5994b4385d07377186
SHA1 9d5aa4bb67042ee4fdd1ad645ce6db05ebb08719
SHA512 d8dee77b24a4d26d2d101be8b386cb5989b684d990454afd90096aa691f0b0a0c464837b5866958e5b34d661abaa883a439406a1a946ea7638386236c9abac95
SSDEEP 24576:x8kNvNnaFeYhJNtmZBmy1N3RUDHNmdPCAaq8Nozgi/rE0TOj:x8MwBtOma8HNUPCAaq8Wdo0
TLSH
T1CC55AF6EBAF846E4D1FAC6748D238512FA727461073293CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b2acd85bb831d23936118daf07cb7f403bad96678116b452873c609bec79c15f
MD5 2626e7f391ee98bec180da919d764294
SHA1 fe61c83424264e21e6ab3ae592efa472bb2ba0b7
SHA512 7b1660508b24a70ee5ce41e79d974f68c4a63e1459cabaf0f6d10f90ddf151a047b344963064a999ac8a8f5230ad59e1f70da7b4f090a0ae3d3e967116b18543
SSDEEP 24576:tPUr+NQM1N3RUDHNmdPCAaq8Nozgi/rE0TOj:tJQk8HNUPCAaq8Wdo0
TLSH
T18565E12F26EC18E5E676E13C85868719F771B4621712E2CF02E1817E5F639E87C39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 50fc007d2d06e2c6aec4a77afa341b34bb1047c4a510128bfd2e9935729f8651
MD5 0d202dd296cf00cbf22b150dac4b00ec
SHA1 2c84b6ebfa0985e9cd4c11ce93e165c2da2496e4
SHA512 d6d2f71b85a652c1433d8086988f6aca4d72a660a8ee26f4e6c2949e389f8b52ef87a04718b981f573aa36c2d22af1336add5c4889ceac5b454aead34fd2b546
SSDEEP 24576:xD3FHshBIYQgAB1N3RUDHNmdPCAaq8Nozgi/rE0TOj:xDVHeBIAAd8HNUPCAaq8Wdo0
TLSH
T10F75F17EE6AC00E5D57BC17CD6638A06E77138A9032266DB06D081B95F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/264-77-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/264-6-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/264-326-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/264-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/264-330-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/264-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/480-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/480-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/480-292-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/480-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/752-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/752-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/752-307-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/752-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/860-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/860-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/860-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/860-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1248-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1248-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1248-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1248-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1248-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1420-119-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1420-123-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1420-113-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2360-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2360-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2360-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2360-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2360-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4900-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4900-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4900-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4900-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5332-84-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/5332-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5332-79-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/5332-308-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5572-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5572-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5572-383-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5572-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5572-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5572-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5728-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5728-314-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5728-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5728-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5728-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6364-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6364-311-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6364-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6364-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6364-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6364-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6800-382-0x000001CBD1710000-0x000001CBD1D90000-memory.dmp

Download

memory/6800-410-0x000001CBD1710000-0x000001CBD1D90000-memory.dmp

Download