f7bb10c17e2ec599cab43b0c0ead4c4cb8ebf99aff1409452a30011c5450b142

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.8MB
Sample260814-rexd2svgpd
SHA256 f7bb10c17e2ec599cab43b0c0ead4c4cb8ebf99aff1409452a30011c5450b142
MD5 2a81309c6cc0cd38da552688015b91d9
SHA1 7a6258ae44a5cda1f68cdda260cab670d1704037
SHA512 afee0822c66b88a9cbe8f5546838c5708fcf76e4711a05f77141370a317660a02f62917a619d597f4d004c8daf00ebafae6021d6599bb67df28368cb0da31276
SSDEEP 49152:AtbIwL5D4Jc+b01tnAyB63TANQnMEx6Te8wTLDgFIDRRAubt5M:SkPbiHW6Zq0Uf
TLSH
T1FBD56C07B3F941ECF0AAE2B8D73156329EB2BC52CB34A5DF125416151E71AE05B38B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3772	elevation_service.exe
1712	elevation_service.exe
1956	maintenanceservice.exe
5736	OSE.EXE
3036	PerceptionSimulationService.exe
6104	perfhost.exe
2768	ReFsDedupSvc.exe
4824	SensorDataService.exe
1744	ssh-agent.exe
4920	AgentService.exe
2892	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c57e806a23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fe63c39f62bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005c48d939f62bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d2cd339f62bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006baa7a3bf62bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007ac3439f62bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063bc363af62bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1588	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4920	AgentService.exe
Token: 33	2892	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2892	SearchIndexer.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5060	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3772	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 5060	1588	2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	89
PID 2892 wrote to memory of 2352	2892	SearchIndexer.exe	101
PID 2892 wrote to memory of 2820	2892	SearchIndexer.exe	102
PID 2892 wrote to memory of 2640	2892	SearchIndexer.exe	103
PID 2892 wrote to memory of 2648	2892	SearchIndexer.exe	104
PID 2892 wrote to memory of 4864	2892	SearchIndexer.exe	108
PID 2892 wrote to memory of 5000	2892	SearchIndexer.exe	109
PID 2892 wrote to memory of 4492	2892	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-14_2a81309c6cc0cd38da552688015b91d9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d4,0x1401ba6a0,0x1401ba6b0,0x1401ba6c0
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1712

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cbd0ccbc09ea7b0e23a4a5bf0ddeb063ccdd53aca0302882754ef0fa16b12169
MD5 4f5ff6cdfb479c563618881486544889
SHA1 2e943db6cf08e70ec1c332e5543bc9536b5d94b8
SHA512 1e38a3b106f3d0393074ae5d1a0df6c761e3c506e05e26cfb80b4599bbe448c20e1ad3b4c541cae245444086727835175cf07a76d896298ba1d3bdf96a7159bc
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRgFIDRRAubt5M:x3q6sjBpUf
TLSH
T1CED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 9ac5d97bcaabed75769cb6165e0a1e56d4add234bffec5db34ef460b3d320356
MD5 51945dcfe2eaad0163dd2db4a16037fd
SHA1 1368460692b105b8fb09bddadeda95f78fe11ee7
SHA512 e225539f24571bfafdd2633cf92c0d21edd0e26b67d41ef3d24f563e32319dc2ed550baecfdac2b8dc27033df3a147e3e9b96c33fb4ab1d7e0157f5a97b46e8d
SSDEEP 24576:pXYfDtczAYVg9N9JMlDlfjRiVuVsWt5MJMs:MtcngFIDRRAubt5M
TLSH
T1FF85F12873D509F9EC678279CDA28502DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 08bf37fc5c409e361b1961d113c4cea3c3d7f6e080a3c3874d502c32b85b3e24
MD5 45ecdd2cd71a2fc572673519c750fe74
SHA1 d1419308da07e85d60e7730eb0e80f494b73f0e5
SHA512 db95d72ab517e15e957515d008362e1282d49b04d1028d2ecf35a3c6985c262359b237fbcd04d4f85517696dd836ebeb9b73f2a5b1f0112172bd2ab417c04c74
SSDEEP 24576:G0Le5ji0hmx7rMrVg9N9JMlDlfjRiVuVsWt5MJMs:GPji0A5ygFIDRRAubt5M
TLSH
T132959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2edd99c963cb4832b6331a7d08d5a3733c8d40ea671faa8bbb5baaf5d9cddfd0
MD5 7e0db7c13e91325b24205b51a91f5af9
SHA1 865c93cf966a62085d4e55b9e8c4caa0c09cc2ff
SHA512 05fe7427696867b2b13d32cd79c8009a570ba65af05a0b41568cf7816989d8d106f6fccbaee3a1959255cd376fe2d6f65abfc4034b86a5ce3dc5ffe48d02af48
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyudVg9N9JMlDlfjRiVuVsWt5MJMs:p/ezSC6vUzPveHjyGgFIDRRAubt5M
TLSH
T11C755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f240ff0e6e9fbb2fee2908bf2afb9d2aed0d8aad9fa79e9f0686ccaf6857dba
MD5 55af21df7a5a81a1627f17b800752500
SHA1 0a1fdb014b804e528e0d5b9fd01979f5b0e29b72
SHA512 deb4ecc84af91b20289321278c7d337a2eb4f7385fa6e0e72901e427efb86ee8007538da6652f60c2c878e311b00ba0fe790bfe68e53b9cb653732de9c89f676
SSDEEP 24576:WVbqPb88hv/l+YkVg9N9JMlDlfjRiVuVsWt5MJMs:WVO88hXl+PgFIDRRAubt5M
TLSH
T150559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 61c3419709a592f5bef270e9158a3a156fe34703ed5e6bd3329a468d1dc46218
MD5 f9e660a29d7802adbef416c0aaf51187
SHA1 fa355556fe0d2a0047007a633ff3e5c315993b49
SHA512 fbdf81cc82846e327c79590475a77046f6c960618a3c4c4e4dac437a52cfa3124a8584e35c1960dcd9a7f084b68a624503679cb8defdbfbf81017f7cf133ad81
SSDEEP 12288:I91V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:I93Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1306523AA7645A5F6C65B82B1CA73538ACF226F5835C58547C2B019D1C9FC1A2E80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c327dd41c3f1cb6cf8ae8ea42e1b32f5145436b9ae17f9f9d3eb2b7e28b7be91
MD5 5799f714370f415a1c9c7f1d56d79081
SHA1 f2ceb9070269a29788fd1f7ac0146a8bf639336b
SHA512 c784b4c08749c7211586c7ce8828701f76a7f3768e230b4c43d95ffdd9bb9aab5b3069c133d9f8ca0fc93a174177644342af9465d3ea33f8166c41adc735c3c8
SSDEEP 12288:eeBNUbTVO86UgV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:eJIUMVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B685CF3BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c1f537b8cbc3b671814f51dfd62b0bd21b3e070c7ccebf8cefc8aced4fe41d33
MD5 77320a60e91967d2516f357830510b0e
SHA1 a61d7edb438a1edadb61ca90947066fdd877a5fe
SHA512 4cea4f46cd212fe79f7714ecb2bcbea8e6b1baffa853c21007820ea6a1278ea31bd2a5d7e4f03e405da4530f85c132830e0c7df53b5f86bddbe4e3110d7785ab
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:nQvGAdlCEL8c/DRNw5CAUf
TLSH
T1E4267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 65309db5e21620f872453aeea99c0c0a19d2971ffd015fd33e52a6a59eee6520
MD5 4a8b77a53430654422d02e16b6d13a9a
SHA1 5d94092d4f98793c4dc8df18b600f2ffa37f1db0
SHA512 04d5c2372a07da882e4156c47ba4aebdb6795539dea2ea579a8621a7e363c3da194aa7721c4ed81e1ec42aeb800f3a023d140f02688f19bfd6f6f9104c4b9c32
SSDEEP 24576:ESewsAjGVg9N9JMlDlfjRiVuVsWt5MJMs:DljCgFIDRRAubt5M
TLSH
T1D985E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1b0285aececcbf729aade08b167f29876ce7e7b697403287bcc2577ac82b8dfb
MD5 6a32385592c4c8fcbc42ffe2a740fc37
SHA1 f5d33efea9e6086f3096b39a4cc73b52d307c5ad
SHA512 54ee924ec4ed69b8c16dad2d9ca9b239f737bc746ade93fd3db005848604549f8cdc14fb0b8e4b1afd6cceda0e199e63b6d5d3db279884e06c51cecdec5af50e
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDUf:JUEtQevvqc2W1cpV2tI32DUf
TLSH
T17B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2c3767eba1820517e3aad458279d101fbdd8b868e015e99626dc924fd9fd3d0c
MD5 4c47731780478503a11622c1a7d1f1b8
SHA1 79c3e9bf8948eae757ae877007bf28d79d11db01
SHA512 a5192cc91775a0598a48ae2e323ab0b62bf5197b20a8c8ff9a9066ebf6528b56700d95106938a96c689dfe46c579bba85089728643a51874fb39c8025daad9b9
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zigFIDRRAubt5M:7oqtVjnm8Uf
TLSH
T1A9D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f051eb4bc19d62180243ea1947ce7813a931bcdbfa83d4a1de0efcae2a1046df
MD5 229c2edd27d37e4aac42431248117760
SHA1 fa7e4379ef9f4a4f4b88bbce37f5a325b2ca7186
SHA512 50ecd8171efbd04da528164f65510c7e6a44cc97fd4b0488d71c5225555bdb68d21840cc434ffa9b56e543d805a94a52bab3ab1f1b49533538f569ba2ca3b7c1
SSDEEP 24576:OAhGL3IFoiwtA5l7S53hVg9N9JMlDlfjRiVuVsWt5MJMs:OAMUFoiq5bgFIDRRAubt5M
TLSH
T17635AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fd039a2219b96fbe6cb218f3765742292772d7dbe6e3e086c559e7be02e185a3
MD5 dc1df91fcd3a08e9a3246bade049a5a2
SHA1 05c0c518c22cf1792d906383bc67f38d26027e5a
SHA512 939861943c6babeca8a6d75762dd64562da655da052fae7433e09455844c8a1041ade89c8383b91469d5dfdff1db27c70ef13d17c4ac4b34c0c35673fedd9310
SSDEEP 24576:xwuWOWaVg9N9JMlDlfjRiVuVsWt5MJMs:xwZO/gFIDRRAubt5M
TLSH
T1F585F14A32A40CF9E9678239C553C136EBB3B8053A61C71F43B0C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 eaf46d6933fcc6f8064cca5de6f0099ac0c268e75cc29af2fe654c618a0890c4
MD5 1a942eba2175fd26c6090cd7f77460c9
SHA1 aee780de3443d123e6382bdfc16cfdb9ab2e20eb
SHA512 a86b310a2da712c10234f34c34805085489f89f24f15cf103017e78f5ce4e1aea40061a140c5183981361721cae7e65dba194e18e197a0e445b0792447119257
SSDEEP 12288:j0Z1IyGV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:4ZuzVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1977512AA33D460F6D1A78278C9F24345CB72785633B283CF427006A65FB66D25D3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 daf542dc36a82d0b18a4ccd87c43f7819d4e9eede8e480008dde9b7817a3a9a3
MD5 4296fc77f6d1b4ace9541412764656b8
SHA1 0becf96ab91e372693a84f170e9c48f14d8cbd2f
SHA512 ef12f1b6ca9563769eb051cea0bde1534250c31677e8e9aad57f57aaaeb0b999b97ff7c11cb1c4c8347f8ee13cfe7e5b39e649f6afd26ee2ce4a876d0a612208
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uf:0QRQyi36YOcPbLvw2gAf+PN39Uf
TLSH
T165667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2613c9834b40ef9e0a4b17c1e5289be0a2617d3310fd5a9e9cbdfe5872c9eecd
MD5 6dd803c2a129e8f9487adb638f154ca1
SHA1 829ecbf495f47435e6c5763c40871563bc28558f
SHA512 e9a97caec451488963edfbaf47c61209ab16e2d66950baf90724bdd1205bf30133ad14387a0c201f4ce36ee2f6a4f3e46d752d1f783634aa418a9fc536f11517
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uf:MQRQyi36YOcPbLvw2gAf+PN39Uf
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 38795ffa8a52e2ca4d89752cb1c464a4babe8dc10e9bb62c84b73b609779cc95
MD5 acf77c1ca50c06e8f0bb2d4d602f9417
SHA1 37d6db46d86a196f2a02cfb21ca01fed615eec1e
SHA512 00970228a4c09760561722895d97e696ea894a316c7c1af8c19836df2d5f62d47125ae2a2ccd02af94366c31c330fedf8d19ccb38613da4626210d2ae52f5a63
SSDEEP 49152:n68Qg55nhceWu7PNU3/ygFIDRRAubt5M:RthLRc/bUf
TLSH
T188B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 73a1140b68d04a3d67c398f07cc688e46ba92b003c4c19ae8acfed804f5f1606
MD5 217b128425c67a7c1a4131352c9d6c5c
SHA1 14d3f852e748d860c2803899dbd70ee3c5573dd9
SHA512 e29853d068d73dafa9c7e6a0caf41523988c46f91f0ee77ba03fe7b10e76f207078c5636f31c83ee96b7e582d4183478e3efa68347bbbff35839a09968b329b8
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99h:jy5112gYy5azzVvt69nLKnhZiUf
TLSH
T190167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 182dde02c39916d7a348262f7a583a4579345329706d84838aafb6ef8a62da19
MD5 326c82f9a47617316f130b1b86e25cff
SHA1 197137f84a4cf6b68b4b02d7c0dd32eb61161ab0
SHA512 6088c6d1de7be9a0d5d3326fdf84a0094098b3ce3f197c62433d2486441ae2bf9f685901a788627e5ff94a3ea8837bbff1ebb139517d40e2765992872c1ba712
SSDEEP 49152:TB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvgFIDRRAubt5M:lu6Jmdxd2doUf
TLSH
T1D0D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1eba847e13caafc6c2f56caeca7bd8c4b778ca87ab1395a7bf67b225f4c8092a
MD5 c0c8d95a50bb6a272ba7fb9a8a4dd98f
SHA1 d36f1eba7587774f04ae828e6e9007153b773307
SHA512 5264e03789ffe62cb7027902ab89d011108f548f116da62b5b740d01e4fd6980ca3eb2550034b0f6fde19620b0b86543f4fb2126ccb48b2bbfe2e765bb08ac92
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xMgFIDRRAubt5M:ImifPWR8Uf
TLSH
T1DFB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aa0abb4061a2f26f6e8e4ac1b20a60c38f95f0a291ca7c471357ec2d9126f61e
MD5 adf75a3860def99e1e4180e734969b42
SHA1 beab93f7a659ac429694e8277346e792ebabf311
SHA512 3d70ebeba5e7eb0ae7b8403ae9b26f74fa6df78a80b02d152a95dd181b5161005500527abf663efd0a05b944f25871c18a2c215e08e6d23ee428c1c3c1db20d1
SSDEEP 49152:PSuZQIY0Be2KcRVtOnks6NMHqhgFIDRRAubt5M:15dKii61mUf
TLSH
T13BC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 99435a9fac8c8b30a7794bfd6d61cd4ccdaa06f503de77a0e681b9a1bfcd2261
MD5 a566a9bead503ed59bff64fa075b15a8
SHA1 eb3f2c8108a2f8d813e0f08210f887a2c21b78c5
SHA512 3970910fda3f00e50d01aa0c7d01bb5d9bb4fa02d7ab9dce14a5f1c3e68f2c651fe761516da63c634eaf7cda03be68eab1473c3d8d976820fb087d9d815c8f85
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wogFIDRRAubt5M:XX2imph4Uf
TLSH
T19995BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 89eaa7f8f30a946a9c370f2ca52f5a06b8d35dadd63461e9282f95ef5ca87928
MD5 a05fc5044786a4633da67d2f041a7565
SHA1 e57fe27f754ce130d1698074d71df5f7cf94cc8a
SHA512 2643421370cc0e1872f47c61be5482dcdacf3b282b8c826b2e23f1a0790211b49f37382845ee1d0040aecd2fdcfe140e597492de00652a5da0edf7ef22565513
SSDEEP 12288:5tV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:5fVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1086523AE758695F7C507C2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 096211ea120f7a20b4dc837d6bcf19cae533f4c3039b2d4dbbf875464c0fba0c
MD5 2db752a7834afe8bb8af42012c2dadba
SHA1 eee6aa7141cd1ffc208defa474b6a2e84d14fbfb
SHA512 9d5099fdf3fc1a2e4f669f07015d9eb3b5d4250bc9354c4ecd936d0183ba38188e6feccfca138b0c1dc108d3ee64f77b8f4435828b620079ff6b3b7da1f4b101
SSDEEP 12288:/qV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:/SVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1176523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 12b33a33f5bbc2d624823d8919593a83b0fcde561411c388fdfa9137481426a2
MD5 9f512f5a19ffd7ef9914776b5fddefe5
SHA1 26daab9e4e7a04d8215cd73e3bd6e7ac5dfee6bf
SHA512 f936d60572991f7c655be1098b2f8dd65d3ef05de9512505aa08c80b83e6fdb7d68762ef005140f140c920adc956eca459144b2b5fec6ea2c96dad9b1eec5ad0
SSDEEP 12288:2YV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2UVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1636523AA755695F7C50BC2B1CA735389CF222B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6d2660d58ff0d51c09dc8cbb3e23da2189d351300014d4f29899e1ee2796481c
MD5 0bb257fa8a4eb7e1b8dd2aededb7f8a0
SHA1 23fd86f759ae1cc8110a823a96f22ddfc4588416
SHA512 ee151c8cbd6a69f9fdd354986feb8241dabd32ef1d676467d4ff6322ebc9aa760e508eea5f87fb813f4a4987cb9f511ba7388e3c1d0c1ef46541be93459bc61d
SSDEEP 12288:gVLV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:8Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19665236A369651F7C457C2B1C9734345CB727E5973A2828FD27009968EF43A1AC2AFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8d0d0424ea099692995c1646e8e64ef8b7dc0bd4b8e09474dc4a70b961bbb88a
MD5 86a9727fde44e76bd52953979597d06f
SHA1 a724a7816ed7be4478cb1a83a42e5584dd9f3cd0
SHA512 2912e1a32025a2338bd0266e2e85dc2f1972bcff11c97473bf79b23be76c6370c0037a132fb4df636071072b7e5d6ff225d767f603254b2f8959dd8fa060409d
SSDEEP 12288:bzV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:b5Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1016523AA754695F7C10BC2B1CA735389CF222B5E76C68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 eb8690741048289593bfe3da9fd9dc309e16f910c8f06ea3d07f462511eec6ad
MD5 4cfffc44e509222a22a40b9831157b2a
SHA1 7dad9b7fc8186eaa25750c96d5e6f58a4f5bb2fd
SHA512 088c132cbb208680260a7c4ff064bd2696db0468773a05bfdd15f5f6be3738ce76871b52beff735b21da6d288893bf7cc01ba153cac4649f666de13acb4a2bb0
SSDEEP 12288:suV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:sOVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1826523AA758655F7C51BC2B1CA735389CF222B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 b5551aee787c1d6603668984cb485a82da5fae7c8eba47278046df580aa5dfb6
MD5 0c84bb03884ae411d1a69fa446a5ab28
SHA1 efed2efe1977540c99e0e43162d866e7bc786ce7
SHA512 c3858249d71bbc8e8aaf68c3d6b4138897a8ee750d2baa7b52a746b2d8f2fbf2fe71b3009b3a416dc19e3499875472c98caed0cd4aa26cd84dc8e6afd0648736
SSDEEP 12288:eSV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:eKVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1136523AE754655F7C11BC2B1CA725389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 6827762686090c4dd4100b29ba5bc71f14f5c19586e819845b5846b69bf2bdb3
MD5 93443bd2937386bebb2c1c68a64b3891
SHA1 c58a10da22f9f00704eea8bb5cb5cfd9438c600e
SHA512 db154e6604d69be26b07bee2293a6d332d286922ffc238eb5ca13f4aeec4366e8138410320fd0ac2870daff610bc8d8d2dfc39da2797392981faacd3943040b2
SSDEEP 24576:BZMrzFVSOyVg9N9JMlDlfjRiVuVsWt5MJMs:BZMrzfagFIDRRAubt5M
TLSH
T1CB8501A9739018F9DC67823EC9228906C6B27C5A17A0C61F03F436675F773A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 fed5441bd5a6a3c6f680b2f704c35147af76a130f50e5d815689812dd29d4b7e
MD5 b89abb36e302a5bf34679a2c2d1a0323
SHA1 be0bc78e8fb0766c8fb2776b5f6e19a9815a8fb4
SHA512 6780f1c6caa7cc1296a47ccc638007ec01b5aa3eb77cf92d2fcf85550e91c276980cd86cc27015fc98fdb7ddf76380026dc81564b7cd0c500e8e1fbd584e163e
SSDEEP 12288:Q5V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:QDVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1286523AE754655F7C51BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 dd5a14aa2ad84a8cc8c0401f77037751b8c2434ddf063a6b1061d86e1cb7690a
MD5 ac98293272601f76fa380114f71883da
SHA1 fa2a3fd96e1b234d07120bcf978ce4dc6543ef07
SHA512 908fe4c6ea69d04eda7eafb2e59d59cc49e09cd8639f645010c60e6c5462caf6f6a3a266345533ec702d0fb22277d7d9348034f99dc7d94dbd6612c47ad5c8a4
SSDEEP 12288:hlV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:hHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1196523AE758655F7C51BC2B1CA735389CF262B5E76C68147D2B004919AF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 e7e172f69dc787bc2966055035a66ae00b04682bb3927e02c5521775d51bbeca
MD5 e7c4cb93fe2d2e457e717342e7eb2f90
SHA1 eab402199d2d00d870459903e7856025d124537f
SHA512 d3b5c74efbb0ae0cca81888b75e2e5b05543071ec31095dffe25c0ac82be0640c6eae026bab5603557a439938583cc867b978f64e59cd3e1ae588c8463f8b83b
SSDEEP 12288:GyPz5L8GV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:7zyWVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14D75125B73A130F9D1378274C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3fdac4a40f4afe63512537e22bd817850a2eccb04acc201233e7291bf928475b
MD5 44ee10ba7b6d1ad08e608b9925edb194
SHA1 6b7b4e3cd87426593f35de8eece27a9705379ddc
SHA512 224f8a791ad012e4652c79648293fac7f9dee654dbf278330ac38915c5d7ab14667aa22ee3c13e659d13c6dc1f123bbc9930b9d329bd1d02f8851c662727dd88
SSDEEP 12288:45V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:4DVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11B6523AE754655F7C51BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 888e24a8ec75ed19323fc04028b2c1a53f244401d4dffd0dea4a74442728e44a
MD5 9651205fcc1b38e069a3460cf32c866a
SHA1 8c1ea81499eb2b583cf3ae551fbf1cfc001f1c5c
SHA512 1c4cbffe8c49629ab31c4c33cea3940fc1b364018ed899d8db57b9df630a554d7230f758faaad3efecd5266bc2da81a1eb5e231a86a1b57d1686873d902db0db
SSDEEP 12288:u5V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:uDVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10D6523AE754655F7C51BC2B1CA735389CF262B5E76C68147D2B00891DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 4c1a03ab5b61d795d3d935ea17895f77c73c8e09b5e48dc8867bb22257a5dd6e
MD5 f19d5a9b2385ab8b9ff2809d94eb429e
SHA1 68abc3815aa666d1dc0b6aa4fab1dab42d5e1270
SHA512 61fa0842f756b0f75a0906cc9911183a23b48ee9e52a6f0feeeb1d51628e373187c36eae2c6b01a15df737bd437b4b474f14063df64b06f1fffbfbc8ead0e40c
SSDEEP 12288:IyPz5L8GV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:JzyWVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C475125B73A130F9D1378274C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 6dbb715fa6d34d19751d56583f26f536fce402b5516c579690c36ccfaa1e7758
MD5 cc3304c83d79ede8f497f08ef48663ad
SHA1 09474c59f4a8088bcfbf7a28f883778e42db3f9e
SHA512 e0f83ce17b8e1fbdaba035a945076d7faafc4a66912a170b9d65143c2b280507d370fa3ecef44621033951cf003120765f60fc6ac63ab52974faee19770047e5
SSDEEP 24576:UTxaLl3z0zDEVg9N9JMlDlfjRiVuVsWt5MJMs:UTsLlj3gFIDRRAubt5M
TLSH
T11B8501A9B39018F9DC67823ACD624906C7B27C5A17A0C61F03F436665F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 7cd8f9a62a82dc2f35503b49c1fc196a8d8f319e5b8d9150cd2fdda7e6aba55a
MD5 c937325c243d5166675740183438f867
SHA1 f48231ae27c53583e3d485338e370f54ff724a0d
SHA512 1da773a9cb84b0ce274c3dd5b68c10acf21febfd96e36366b55fc8fb7cedc299eb73759704020a412b588e0f456f60f6c2fab9c0db0afa725f1d9cd85c51d8af
SSDEEP 24576:t3Zd9CHKy7GZAVg9N9JMlDlfjRiVuVsWt5MJMs:NZd9CHKyaagFIDRRAubt5M
TLSH
T1B595CF90F3E414E9F0B7DA35C9725602CA767C9A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 b152020045540a4c71744621f1cb09272b5f90f0bf6d74e185afb97685cff1da
MD5 978bb2929ba438fbd3a1da37f6755861
SHA1 dc46384a58f2ebbcc4cf1283d54cf655db4a8f6e
SHA512 4af8421388745c90455c7205f0e6868920c761eafa7ceeb3abdbf84668be3bc7f0aa17835ffa28ab6d04d12755e74ad3e920ffb93fe15b7283357d792d9c22e3
SSDEEP 12288:/4V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:/0Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B56523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 2547d2e14ad20ad57e386663aba14449d0c93fb5859962b6a563467ab1dc9143
MD5 b7a58ce6dcc33468e613dacb56065291
SHA1 034a37e65512af0f0bc289de1ebf4b50d642a618
SHA512 13862b931c9d1da6bc80a5dfc404c3c976b446488b999a178cab6d68dd049c68bbf212699fb26d5d0ab37a02f6fed6e2cfb6670ee97024ef8b271926aeb503fc
SSDEEP 12288:omV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:o2Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A96523AE759655F7C11BC2B1CA734385CF262B5E76D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2f9a5e11d8b3af2c9f3ef81ed31e29c2f9aa5a6bfe36b7320f2f6be5154630d9
MD5 5b8867048880a5baeb1ed65b241b35d6
SHA1 d306462fc6dede08a6103e65b105f591070fe499
SHA512 20512c3f745cc59610f099bf9323d1ca7641f80c5d33884eaa6e328a578bd03ab51a7fc3c4112b43a090f698b387a210fb3b7dfb92b5a38108c407635ed21e00
SSDEEP 12288:KXV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:KVVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E06523AA755655F7C50BC2B1CA735389CF262B5E76C68147D2B00891DEF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 44a62687bc05ae7be24448681c0385d3feb9617959fc12e1f85c8a69ce6bceb7
MD5 a4efacae249faecb4e57b0d022dcb9f8
SHA1 c8e2ffcbfb2419f05cd6dbcad8b3ca71a3faa83f
SHA512 0afe1179f45fbde8ef688cf898eaf556cc702df629e11b62e849a9d9a4c207c3d869122d35ef0ffcdbdbb47cecf53d7514e1d97638e7218805f7db61eb30c1cf
SSDEEP 12288:V5V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VDVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1446523AE754655F7C51BC2B1CA735389CF262B5E76C68147D2B00891DAF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 599595b334c2c33ce7485bd1682c514de55c0b3a1168c2fcf32d2a1ad9356a5b
MD5 416ab6e17bedb7864fc4aecbe5b1f5d5
SHA1 0db39eeb9243c8df0de8beaad1e5094d0691b8fd
SHA512 7adb4555ce15d64f451e0413fcaea14ef34f0d5f7e04fdaf4b17e4f0f0d9dc35ca53c0a986f179637e25825fa3b2da6c9276aa80afd0f8b33cdcc6806f610e98
SSDEEP 12288:V4V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:V0Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16E6523AA754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 4429be811ad3c1fadfd0605a82bb11497db9ba2b82e39536b1579b693d230ea2
MD5 39d7d039e1c28636c721209fd29488ae
SHA1 83b972360f97d01d66611eeba97e44fa75b3d675
SHA512 96c312395727f72069459b6e612e423c002dc1fef552cc8c1dcdf30a02347594315ae93eaae129d799773efa021d82e0bceea1b74a23657d921c86bd60a64e62
SSDEEP 12288:UhV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:UbVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C76523AE758655F7C51BC2B1CA734385CF262B5E72D68147D2B00991DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 cd06fe91750c1a694a9192cc44eb6b646bb8f5700cb0c2f47fa1543aacfce258
MD5 6fa0343fb426e469c155b6713ef27bee
SHA1 a817a9735868a008f55c507453efee69495b56ca
SHA512 7fbf0c2f4eb6cdd590bcdbea51676476a42ce13c4aaa4a238d1aed1c6da37c48346e194f18fee49bc5c67e7544e97823d7491be07f662a3b3c41809531251bba
SSDEEP 24576:pfwv2k9RX6wkyAIXVg9N9JMlDlfjRiVuVsWt5MJMs:BMnYIFgFIDRRAubt5M
TLSH
T1C295D029EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8fd2e6537028f1d8c70273a05be80fd1182e24783bc26249ae97f39c9c4138a3
MD5 e9a6cd6370a509b12cae86752695bdd1
SHA1 d95429f7fbd197443d94021fcf903d458730c257
SHA512 cff6248567eb607e2da39a068bf6a46ef3efe9064e6816bfe21793e7a4a8f44ed3ea3a4b4d73b7dcf96c16d8521501e0021e3be90c2b664692639f37e9965cd5
SSDEEP 49152:gYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IgFIDRRAubt5M:nySzPdUf
TLSH
T13D066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 296cb2ac197e65d4542acd8dcb79dc6b821c83998982a5f836e3c94f1a48cd92
MD5 ed86fd36ec21322068273c0f08826aca
SHA1 20d3c44c51e4ec078f307cdb4be86fae512fd578
SHA512 9f001bae04009e5fc83fda38528bda099f127781c5ad78c1cede0778703cfaedfd57052bf6ce9f5fd34334ed03bdf1ab4be09eb40a750a7574f24708e22e9fed
SSDEEP 24576:P47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYCVg9N9JMlDlfjRiVuVsWt5MJMs:P47JUQjTirIhCnDHUPfF/YgFIDRRAubE
TLSH
T13465AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 70418ee510034c90d419604fd2b960375d6571d6955a4e2e036ddd1926a697f9
MD5 3d014892e53ff9367993bd1b49fa5ef3
SHA1 9180ffbeba5bfdef19f5f48c0a6f1a7a5c916ebf
SHA512 9c956297fbe1193d38e6c52ef219ec5db9195321190971d81c62a8594e028c6aba68689091da71dd1a27a2715c26a96b6e77af44f0654129592d91786e11665b
SSDEEP 12288:vVsfJV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:kzVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15E75F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 952KB
SHA256 0fe7f70e47a195549f617ab45fa213489f5ffa5a41356775cd200a70d0ed7718
MD5 251c28759ba244cd07d75fffeb7cd380
SHA1 214a5218fc31796ed6f15255813152c7261c0570
SHA512 98fa371176453de02f429e73ed5c0085a822be2bdb0d0a1f7351df6668097a2c8c5c335f7e178d7f982b66d16e0ac587711c83a0bd6378014b9d6b0f4cbd45aa
SSDEEP 12288:m9ykKU3fBd4hZ/QPJOmHY9aRMXOFZDSO:mozUPiI0KY9aRMXgZDx
TLSH
T160251811766AD75FC6AD40321E33D1CCAB707D41EE449B0372C99B2FC5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 27b4605a5c07419342adf049df29a033a870be515fd23d1a8c7e078880f192ea
MD5 14ff82b74ced0b6682589f6b85e5c11f
SHA1 812864600c5b02d8c22957025ff758dcafe1a4a7
SHA512 f9eca61838155ef01d3fee6e3a597fb8b8c5353efb8847400611c261fc8800b65f0255e44ca8992d62cb2851f434f7e5b527f61f072588161a4378ea6f1e49a3
SSDEEP 6144:5GH8cCzHpiio/QMD3A4c3D9tMxqD9tMxuGkS8zQlI8ToaRvBA9ME5q3N:5G4pzOA4sYhv7xN
TLSH
T19055D7409536E38FD1B72032072A9B4D67A4EC06B7496F26B3C8493ED85BB15A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c57e806a23e529ce.bin

Path C:\Users\Admin\AppData\Roaming\c57e806a23e529ce.bin
Size 12KB
SHA256 98abb338654436df521a0df540d4f7a2298a337095155dbadfd126750473e21e
MD5 a2ebb195b0832c933d6c4b2693f6d16b
SHA1 890e839f2e3c25781bb09bf7a628c4ad0a590503
SHA512 986deb64c9665d4c74bc99b34bc6b60f114b48a68f4b48354cb8815fc9ac3619ca2322b2e9d34e2ef78e2c87beda3e5e16f0d098a0496effd92d8b584d461a31
SSDEEP 384:076InQ5EWXKoT3V2YGw1cN9vECl6Ag60JI8Obrygz:0xgEW6O3V2YGRJl0Jw3y4
TLSH
T12F42CFE355AA05C5CA1A5543F497F91C2C9034B23E89E370708819B8CD327F7A9A337B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a281c94d0308fcfb76bcba4a6b109e5e10fedc47c53a4d751ea60e2ba24f1b9c
MD5 fcfcffd18e524e4474cc9b274bddf41e
SHA1 34fcad763af876ebfdc25be6c56b456eb779591a
SHA512 70127efefdb9b177852c8b117bea7c3d152940314db81b3c30650aaed418a2365b7bceceff4128c98fafd46c3351e2862290411e3e3f1260dd9d7e7ba6c973df
SSDEEP 12288:a+7xV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:xLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19D65237A768999F7D46B92B0C97383058B2B7B693B8181C7E17005D199F81D1AC3BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b35aa2c2c1384882d45507fa55240949679ddc2ed00bf132bc9d1669d53bfed6
MD5 4e0a67fee0b8fec78cb97c3da61cca22
SHA1 ccebb075a3cc755d2f084fe9be2a137f396c9f30
SHA512 211f774af8c4b3ed9cd0410348176a761fe991f3fbd443903800cfffcb2844eef105a39cc7f3444426a666a3430732f5da6b40025b9ea1cb6745311305691bd4
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYdVg9N9JMlDlfjRiVuVsWt5MJMs:fgb4mBIBhGFugFIDRRAubt5M
TLSH
T14665AE1E22EC02F5E0FAD2B8CDA64417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 437236dc0b2f1ade8517c26e88df8e4369c1f9a20ab2e68617a771e492c705df
MD5 6dfb22d48ab9667a350cea9d43228d4b
SHA1 d5ae64e3946d35f584f6db97892ced8954448caa
SHA512 3ba3beb9f5d9cf946255125ce0b9d7a3aeb70d517bec26f64c5f9150b3e536b6736a8473115a94a8e18db1a98750c0879ac6c8f977f2ce892b2448096e8e34ab
SSDEEP 24576:jG88u8FpJqH19zria7/myVg9N9JMlDlfjRiVuVsWt5MJMs:S7ZFPqVka7/PgFIDRRAubt5M
TLSH
T17695F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5aab587ea2d382e82c675d6bbe7694f78b2608f1122f73ed8c71c31d7fd9de85
MD5 c76187209108a73ffa3c0ace2f442d55
SHA1 969a8497fb114ea45056a98a168ddf48eab621f8
SHA512 acec0198342c75c308cfe05ede83782f248fe49ec8a6bda26fe5c065473007bf8415b5f10d3231ba4de1d9f1d1fc60cfe399782118fc4a24d78b859816ebc834
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKgFIDRRAubt5M:PG05lO43b6Uf
TLSH
T154D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b9dbf4bac4f3eb9c624e9091f2c529ece8d83c1656438c1953228bfb30b105fb
MD5 761e0fe20d4343f07b410afbb77ba36c
SHA1 7befc2efbf674669f13f462f480041d7b0645d05
SHA512 0faaf4ddf85444e71ca311058b7d18d2b3506ca73f4864a9801c78fa949dd5a00dd398459590bb2e7efb42ad7f80a0f288bc9472bf9908b948cd7a6a62d83da5
SSDEEP 24576:rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn4Vg9N9JMlDlfjRiVuVsWt5MJMs:za5POZ3BJt2pasx2+mygFIDRRAubt5M
TLSH
T13C65BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0e25fc6c94772af6bafa9cabbd042146b8a5b6047b14afb20f71f28ff35caeee
MD5 faaa75095f8025ac69c38c5796db7a2f
SHA1 92a428c0fa9b1995c4bb81ac3a7a1dd5431267b7
SHA512 dcf9ae91f7376ffca5830b370df211edd2a5c9e84c34cea01d3cf1706051b62f265ccd75cdba90d75b6118207e145c227e8af99849408132138ed7d94c4197c1
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fk6Vg9N9JMlDlfjRiVuVsWt5MJMs:3Nc/zEOVHFvgFIDRRAubt5M
TLSH
T16A858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ee950ce1c3266ee4df260d74ae2cab21deb65b2eb798514324d141f4ca20f540
MD5 eb74aaddbec3660e4088744d9670f656
SHA1 08cfb2b6430d4010f38463eeb3ae813048a779b2
SHA512 6ff44c8bec43c38581a744b4cd194f2f4554f74668dcc5e2933be0a077df544c30b5ad08532d37d71c063b96a32c524157b210bb1195bd78f70fdf2fabb37785
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBmpVg9N9JMlDlfjRiVuVsWt5MJMs:ZTMwBtOmzgFIDRRAubt5M
TLSH
T16E55AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 0de6d6e74576babde71b312a3903752e003f47099039387df2c0cf88a6a031e1
MD5 7f9904e8cec69b452c646dcb2efd1f3f
SHA1 528e1dd3843f0fbb6e9b8771238cd696eea1a301
SHA512 dbff598bcfb735ca62fceae55a4656b3826cc9c845e14a9fbf71717522c6bc6b1256e5d90d4464ec8962e02b2a4b97e2d5cbc1d6ca25345397ff749af21683eb
SSDEEP 24576:gPUr+NQeVg9N9JMlDlfjRiVuVsWt5MJMs:gJQagFIDRRAubt5M
TLSH
T10E85F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e1afc80e84c7baf83cd758ac0d9dd6282c3f4189813137000f448d3db6c1c91c
MD5 e7542f99b0ceed0649a721f6a8a82592
SHA1 6a2d5ec54f1fda71a0569ac2c952d51591316599
SHA512 4312dfef94ccaeadeec52eff0f7a08fb4c30734b069e75b6ef4da651ec99c7de7e5e26bb93d3255db80ee13d0b130e5b5436237799cbcd2597170847685b65e1
SSDEEP 24576:YD3FHshBIYQgA/Vg9N9JMlDlfjRiVuVsWt5MJMs:YDVHeBIAAtgFIDRRAubt5M
TLSH
T13895E17EE69804E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE47D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1588-7-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/1588-0-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/1588-23-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/1588-27-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/1588-8-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/1588-1-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/1712-47-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1712-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1712-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1712-156-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1744-134-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1744-128-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1744-330-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1744-126-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1956-65-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1956-52-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1956-53-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/1956-59-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/1956-63-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/2648-342-0x0000018CA2ED0000-0x0000018CA30AB000-memory.dmp

Download

memory/2648-409-0x0000018CA2ED0000-0x0000018CA30AB000-memory.dmp

Download

memory/2768-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2768-107-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2768-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2768-345-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2768-343-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2768-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2892-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2892-331-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2892-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2892-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3036-86-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3036-308-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3036-80-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3036-78-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3772-32-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3772-155-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3772-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3772-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4824-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4824-113-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4824-324-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4824-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4824-119-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4824-326-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/4920-148-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4920-146-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4920-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-140-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5060-12-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/5060-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5060-19-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5060-125-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/5736-67-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5736-290-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5736-74-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5736-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6104-323-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/6104-91-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/6104-96-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/6104-90-0x0000000000400000-0x0000000000577000-memory.dmp

Download