b8b2b18c27fb9d75d2a2b972fc36ca693c6106e261b2dcaf4e9a758bd0cf7ea5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.8MB
Sample260824-rrbccazajd
SHA256 b8b2b18c27fb9d75d2a2b972fc36ca693c6106e261b2dcaf4e9a758bd0cf7ea5
MD5 33525a0336020d69c6ef58ea85fc62f7
SHA1 64fc3d15480faea2b9a0d323d72d263d71446cce
SHA512 f69299070277f2275de836e50769c28f790aa244fc4a7ac0ee417f0e3a56bf82ad519d6e1fd3e2216087246db0c6f0bdd4061d6567c6ccd850d60a4c18c7055e
SSDEEP 12288:tYMri1GOJdlrqJ0tclYYZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+x:tYMrE8Hd3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T16695E015F7A804E8F5B792388A729902EB767C550730C5DF13A486667F33AE09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4976	elevation_service.exe
3180	elevation_service.exe
2980	maintenanceservice.exe
5836	OSE.EXE
1252	PerceptionSimulationService.exe
4492	perfhost.exe
5220	ReFsDedupSvc.exe
4972	SensorDataService.exe
5724	ssh-agent.exe
1064	AgentService.exe
5732	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c87bb645e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002006d96bd433dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d69d3a9d433dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5276f68d433dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e019c868d433dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f0b98969d433dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ecd0e69d433dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5220	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1064	AgentService.exe
Token: 33	5732	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeDebugPrivilege	4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4140	2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4976	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 4136	5732	SearchIndexer.exe	101
PID 5732 wrote to memory of 2628	5732	SearchIndexer.exe	102
PID 5732 wrote to memory of 3056	5732	SearchIndexer.exe	103
PID 5732 wrote to memory of 2968	5732	SearchIndexer.exe	104
PID 5732 wrote to memory of 248	5732	SearchIndexer.exe	106
PID 5732 wrote to memory of 4920	5732	SearchIndexer.exe	107
PID 5732 wrote to memory of 3780	5732	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5836

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5724

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5c3aa01fa25c29be2b0359e7ab04f9f1f94e451d6d554315b07aac67b24ba984
MD5 3f5e2d8cd6f63a825c93c70cf58a4378
SHA1 487ba2137e940037c036711e0e7c0bdada620205
SHA512 7b7e5203928afb822da3ce923ad325a70254043df2a8b5a6603f6ae01c297fddaf9e4fa369c589a55b090bad3146cc3dd76d0cec3b7cdd2df41b4f029583d71f
SSDEEP 49152:3b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnFKnAX1tIc5foj3:l3q6sjBe0Okc5g
TLSH
T193D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ea092b3c56e5dae9fa2bdf3ab1c974c520d7d5ffb00d3de077df54550ecd2098
MD5 7068c00f454cd7784a0530e0b58a482a
SHA1 e933171fef7359f85ecd4e2ecb0b0dfb51cf9b80
SHA512 76c0c24a618d2c62cea685117728f5939f0ef2522fbf26b05d651330d0cacdd245fc7f5fba90a9f6a9650cb46b0750340a1269d45684f5b4022b8f92f2904a6f
SSDEEP 24576:rXYfDtczA03KnAoIBlEq1tIgAWz5foj3Z:utcPKnAX1tIc5foj3
TLSH
T14F85F12477E408FDED678238C9B28506EA33B8514370E69B03B499266F377D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 dd4f7cc8cc65179743744fe9fb3e7b126d6078b44ba37e49f1162894f99d2728
MD5 f2bff7f6550d8abc04f0bc76aa7c1493
SHA1 b0e1d2c63a1a8d3d3b44c867d0617df4b7922bf0
SHA512 1b28e81283efc96810fd154568a9a7215f6386d1fd769763fc04f0b146444b6e59abaa222ecf3a268ceec5b1c1ed78377ac649e6a20569ca2f63b0b8a15ca1a1
SSDEEP 24576:Z0Le5ji0hmxxrM93KnAoIBlEq1tIgAWz5foj3Z:ZPji0Aj4KnAX1tIc5foj3
TLSH
T111959E26F6788335D073C0B9C5D2A68EED7130825B3089CB4296D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f5b7ca8b116804f8dd3026e15f264472113ce25fbe7b94b0e344440ed9e48d7e
MD5 a4007855680c5a77d25330c1f6c3c850
SHA1 37d949701e8307d95a9d8177d234520f8ef8b73f
SHA512 a931cce803ebb40816b388c81f74dc52518a53210fe4d07a7ec54a7775733633f244394398f77a84aaf2756486b0cab42958186adf2ffffb6be8979a9f9fb33d
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyuP3KnAoIBlEq1tIgAWz5foj3Z:3/ezSC6vUzPveHjy0KnAX1tIc5foj3
TLSH
T15F756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8b7216a0ed3172f10e9672037ce2eba584c8287e3e515b72dce2342e1f488f12
MD5 cdbfa2898a7574e44447402a38727611
SHA1 e79bf69e2f9f0c31573eb49ba7930740ffb57a5e
SHA512 5c2c2772e9cfc041c7580a9abcff196dcb35a2c465e319b601ea21c3b95dfb01c0430218b9aea6f9765a8f97e2da12c3835974310e702299c80e586dc4f850eb
SSDEEP 24576:BVbqPb88hv/l+YY3KnAoIBlEq1tIgAWz5foj3Z:BVO88hXl+3KnAX1tIc5foj3
TLSH
T127559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 eafc588648bad43326ac3b48bf3f44c0150730fdde8f3eb28c133c625f97d542
MD5 3f2eaf5755cdde2e5947c56f27ae2ecc
SHA1 dd341a7ba2acbbf9469b1a85e2c1d79212a9f082
SHA512 e596e8815136057c3e3a6fa20288503158dabbdb551e4fbbe7f274e198ef9ba9fdb24a87520ebf3fe2ef934d6322fc4b4a387dde6be379da20dd3a6f46920d04
SSDEEP 12288:qLfZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:qLB3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D76523217B5C182EE7674631A2F6688AFD75DD70453A48232036FD07B63DDA0A83F276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 20ed756d2ecc8c3b547edd615e2a13d1cde10b9640f466958ba9360434318e13
MD5 28238dc0176a2bfcb01298367f94f375
SHA1 171e40e771fed5c824df4849718ef7134d63360d
SHA512 f79b9bf08db8da0afdc627d323c37a0cb8758e64315e954ec86c4c37501869a0bbc905cad8bb64d9e574dc5c2c6c46967fc94575feb81a8136d29072691f23f0
SSDEEP 12288:NeBNUbTVO86U2Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:NJIUA3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1AC85C03BAE28FCE2C27A8D7957918640E77278304B6293CBD175C20EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 64fa171d1fb9436a1355bc4d36ad1cce3067b719f4da3bc46711f7120b7305cf
MD5 db269ed0e9c56d92e18b921b534fc51e
SHA1 45023b5d5415d0d81510edc7afd379ed691919c5
SHA512 290b444ae3198f39fa80b66381f7db31b78485b2d975b36027d6cd3788eb7e64a6b808905f83f12833b892a308dbcc2c3fffc32c5296fbaf892e52de20dc094f
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THD:LQvGAdlCEL8c/DRNw5Cv0Okc5g
TLSH
T1C0266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6f123ec0ac4d96c67c1e77b2b294a823c0a47dc1903f3db7d0e883f859c10e4a
MD5 69adb910cdb0d0844af84a9738ee426c
SHA1 3cd694d79060831787a09316b0dd106591ab0cf9
SHA512 2ba7e996aac0125ec4bab1158fe9206cdfcfe89160fb655d018e6e0bb8ac22462338166f9e9dd3f2664afb1167d6a518f88d38836c6f1a67c0a0fdd21d7ea478
SSDEEP 12288:8AwSfxL/2Dc3RDLLmt0LDQewsAjIZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:h0ewsAj63KnAoIBlEq1tIgAWz5foj3Z
TLSH
T13785E031FE74E436C27B0DB21B76C716687CB9204B6119C3E3B88D9E59346D22736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2fcf7c4042874b11a5f7803c1456723b1989ce96b92b0658b55652b82ba9972a
MD5 e9ecf51302092837b3a1f2cbb14944d7
SHA1 d4ed8e87911a75fa491824c6fcc46ca44b8f0993
SHA512 097bba17d9c027b4985a0e10e25915f4700d00ba76f3bf6d19b99a85a5698cec42394bee8c27ef34b3ee536763654180d35f28c7620888dc1ea63d11059cb4ab
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHtOBg:DUEtQevvqc2W1cpV2tI32Y
TLSH
T190474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d584cf0e446c488a31c3e068fcc084f0f129b5b1545b3b8737c29cbd096dd4b6
MD5 d5de19f10a544ffb33f79bc16838b1bb
SHA1 f5b6c287491b0dfb398b9d6c5401dce873157350
SHA512 38b9ae8de3541165248d09ccf91c66a1f7584cdff04fbd251ecbf691f5f91b67b36fbec832ef16c21d952226c065f09b8ef2844e529486c56e5c07d31f998736
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zoKnAX1tIc5foj3:qoquVjnm70Okc5g
TLSH
T1CBD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 13201fb90b4ce16379a5c50f40987eb1f888520b4e478902edc79781d71b3016
MD5 d98827a5a4579c693eefbdeecc5d11a8
SHA1 19a56a27aa3205c0fa829fa153aff2ffcc18d542
SHA512 0e89e9a300baefbb88d8bb27fc3dd82ae27310ada8d4c82000d63678225b7c0d4e62c825d27325c7534d45e4be9d98031a2be43aa1d8b700a9890a1c3de46a84
SSDEEP 24576:nAhGL3IFoiwtA5l7S53b3KnAoIBlEq1tIgAWz5foj3Z:nAMUFoiq5LKnAX1tIc5foj3
TLSH
T1E235AD80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8a70cf013222472488495bc2fea628ca6d462ef0a151be813498f9363d70d9e8
MD5 69d5c49b6785782576459f6ce6585863
SHA1 956d9b9aa164ef95b084f61944aec5f9b99ebb38
SHA512 a324f3387e3e0e52e12387de2a874c772f218e731b138be7658e6e99e3112c013441e666e42f34a70d593b05b25f8944d060412d07b98cb90ec38888890055f1
SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+CVZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:4wu4OW23KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E085F14537A80CF9E9678239C6978536FBB2BC112A25CB1F1370C61B6F376616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f3b2c3126480402d5f0a4069b345f08d39d00b76b4d30b4d9dd26dc2f1d276a2
MD5 9da332df41b1fd3cd7c23fd5a337cd88
SHA1 d65e4fea7288ec481ac9fc1bcc30ff835ed74510
SHA512 a2028db00ff065afd97d82482b611737bcd865d33de4408ea69fdab321540907189cd5c16688a4d3cc87ae251bd50288b28bcf7ff7beb5a14519090250c6c333
SSDEEP 12288:NeZ1IyYZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:oZul3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T16575125137E824BAE2A34238C5F5594AEB72B861133643CF213586577F3AED12C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6065d6dd74c17ebe5cc76d4e2706d90040262bd311f50a89951d7c1570f33fc8
MD5 2f5a5c2e3d5f076423d549ff8f6f1e81
SHA1 7107d75b52bf6b9204e40366748cf7eb1c3e26eb
SHA512 c41d19e80a23b0d00f6a4b87e8bbe2e74db502b466c3d9106ad107c9628f8c65a73caeecbbe0a5c4bc38bc01616f4ffaf6861b23f4f69051d22354add580af10
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:OQRQyi36YOcPbLvw2gAf+PN3S0Okc5g
TLSH
T13C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 58999d75f0355553187ecf3eab17d7727ce55b10f67f18a213d4c80e953d0798
MD5 73e2cc4a3b566399873fdd016f6035b2
SHA1 b01b20a0740cf9d508512b1a61f2083e1a792423
SHA512 9a4cf49bcefc25ef08ec00b7786f5b82b118c2069bccf94c160d6d4f981f7a36f9372a81937408b86e547d728f95d2bc0ea16e58898a3f0c7ecef273b3f4b8fd
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:MQRQyi36YOcPbLvw2gAf+PN3S0Okc5g
TLSH
T154667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1a0c80eebd10cb6ac68fbfd294861520b2e0147bb2a1996deb612b4e12b2d9d1
MD5 39c8db1d11cb436798499f1335ceebb3
SHA1 5c0dfc21de4d51e1415a8904ebb5f345cf9fe005
SHA512 79ee7ff923e006803fd10c4401d77dae04b23455e046fb48a482f3c72f8b5b4a894df5eb99bfad81c6715c3646e1ef8c72b36d714fdb3910dca7983c721a9478
SSDEEP 49152:O68Qg55nhceWu7PNU3/4KnAX1tIc5foj3:cthLRc/40Okc5g
TLSH
T1A5B55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5b5c5796f214b92db8d00267dfea5923db6b1287969d904e5e9d2d7087f1ceef
MD5 3c8eb5e2c3a9e1880aee3cf75746faa3
SHA1 dc3d527a7fd58fc88c24c619421125b06790b210
SHA512 4c801a0671709769668289381671076f439fb824dde7c10107f756d1d66b2d01b63265b08e2e9d687a83c670328521d5d53a98019fa702844ad4ece96d36d4e4
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99t:7y5112gYy5azzVvt69nLKnhZB0Okc5g
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 849407eb3e4c50d66d6301d2cc4d534fe4a7d4d93f4b6ac35f0cfe5a8613407b
MD5 73fca31a7bf422a7479031b2d88a5f05
SHA1 386e9bd680f0847594f6d1d79b5cb06fc7748ee4
SHA512 b1522a6784b2ee39f41c1786262af775fc3e0b5a734894acef44bbeffe9e9f088fde1edd2242dea14462c07d21a0f391dc29a73f256f1a85cc3df603b8a89eac
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl6KnAX1tIc5foj3:+u6Jmdxd2d60Okc5g
TLSH
T1FCD59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 097a6b795ad06a1e9fb8014f8af64d3dd305151312708df3083ddddc0b9bf2a8
MD5 b90f652b76974cb21cd50a579ca96c63
SHA1 756eb4e89c9b76fa58709d664806911f23403788
SHA512 db466975436788e419bb6f1add29ffbdc8756a4c0e030d3f868043e9632f5bfd3637feca3652896d9145db5802ff13894165071ee2621e77e67692455ad7285c
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4xWKnAX1tIc5foj3:XmifPWR70Okc5g
TLSH
T161B5AE13F2D800E8D05ED17887569632EA62BC450B35B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f3cb61525127274a0d9c9e4dd6306880aa4816ccda82ec7315cdad0ba031698a
MD5 273cb1f7a66699589ad695023926f258
SHA1 58e29aa417c10485affdb38d9c567d9366a87b87
SHA512 08cb27f6c9d9c7f5d7e4e22486981c7c45dc32eba3472363af74bb526522850a90e52775d4b65fdc9123e37e18ba73e40d4b775360f3589a67a5cd6f71ed8c81
SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqVKnAX1tIc5foj3:w5dKii61V0Okc5g
TLSH
T128C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5beea2d8597964a76660b1fdf11086de3c0a61126cab1bbc1f1209740d979ed5
MD5 f965d301d36ddf25b50457cbcbf17a01
SHA1 500a04f615806800b585fb9456704f75da91e47f
SHA512 620a3c2d9e664e559e7346283244890de3e4c50bfbd88b23ea142899500b08ef67c637cae7c205952f017a08c2faa889e73c24bb6f316af2d79dfc189faf6d86
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5wKKnAX1tIc5foj3:hX2imphH0Okc5g
TLSH
T1DE95BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 72795c37493060063e761fc1a28b35984aff1907315b5a8151a36299edece626
MD5 3023561a56ef3d73e13eff5a9747af26
SHA1 7550757af2977d02bda812d9655a8e8006702871
SHA512 1128c4d8d5d780688c540efa14a54cdd3f742b74039af7dff4b518ef076e17fa3ea432f3b43b73caf9c21e8c65d2347d0b305cfd8bcacb7e16c86e55c8ccda8a
SSDEEP 12288:E3Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:EJ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1146523217BAC082FE6538671D2F6548AFD74DD74453A4427313AA913B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 24397fbd39d15427f64940421bb2cc6ce6a6c57a26ea3a39c051f31906f28f46
MD5 14488b1964e7dc3da57f2425e765ce67
SHA1 df1616d441c489f51b5358e871ba97eed2f94274
SHA512 8efc6c43b06e80386150bc982aace79f4a7f180157d835da19c4b8dddd125af60e91cbba11aaa140461997f74d59b6f7c4821d6950d0c50bd8988630af1fc889
SSDEEP 12288:WEZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:WO3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D06523217BAC082FE6538671D2F6548AFD74ED75453A4467313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5c9941dd9a018e406fb454a249641e44568bf04f637db9d4520b8a6c6f9aff87
MD5 b7a7f8acdf610afc8308e442a886cb58
SHA1 a809bea2079a1e15d74884e2cfe2d264e5040943
SHA512 29020ccdc8bc40db19bd9bdb4494ecf84cc9a4f941cb1c6048beaea36eefeffb71fd2abc8d86199a48cd7bedb5cccfa452390c62c23cc7d6ff9818353c1ee659
SSDEEP 12288:KuZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Ko3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1266523217BAC082FE6538671D2F6548AFD74DD75453A4427353AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 db732bd047a1f9c228c30d79ad95d41d7b50b1ed6f2bff25baa4c03f865ea1cc
MD5 03635ac84ce4d9c836141e5e6a8d28aa
SHA1 13c1d8d1ab292dd946b5dd59d1830e6f94038173
SHA512 9a80fdff7328e9a307039461463cf464ea2f21f06c466550f3e746efbfb4f187f528f3675b7e29c4863105c25d083fb53ba43336aec0893f61ed4c427528047f
SSDEEP 12288:OV5Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:a3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1156523213BAC04AEE563C274C2F2544AFEB5FC748636446B252599077F39FE0283A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 289d1bda5d397bf069911f47718a1a672a7f82c2c5ae265ed5c0d9beb4a87cb7
MD5 a51418bfefa7920ee375759e0b18b098
SHA1 ecc664f7261daffae272bc780544614224cc3ca7
SHA512 7a73ce3ac2a5004c54d21950ab882867487b75aa9869185950c1889cb16662274c4cdf13e919033e9f4efd88bd366525f370f4cd770f5a4b09ccd116fcd51203
SSDEEP 12288:iBZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:iT3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1056523217BAC082FE6538671D2F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b501755c041307c2ed9cc62723aee6e240c038579e64a738dc1fe4c585bcc440
MD5 49d3f3a1c8e3620904d6bd315755f4ac
SHA1 2fd925f0756dde12c677edc1002905f887f264c8
SHA512 20d2e0b3ce21da6cbc0b3421a3c1df58694ba5186cb3802a377e78ef0605c2625d1c61a9cd07c945bde4fe4b3bfa8637b558d425b612410a83f711e97eca7295
SSDEEP 12288:NAZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Ni3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B06523217BAC082FE6538671D2F6548AFD74ED75453A4467313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3e2156220d7c59eeb98f686745928b074061ecb696394c6d3d0a892dc317c078
MD5 d3ea25531e73b8683d95ed2124fa768b
SHA1 889b5ef12cd8565baa627f19eae13f6f6a270e86
SHA512 8c7c597b4160336de02f17f27ee9341708aaa09db2fda534b2e564f334089d4c1090bfaf139b9d357ca0a57c0cd42f1ea2ec536ccfca51adfca4028f496ae351
SSDEEP 12288:VMZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:VG3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1326523217BAC082EE6538671D3F6548AFD74ED74453A4427353AD803B73DEA0283E6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 bf1015295683f81424c72ab90c8d8c3664b0d333202ae3da837bb8bff85b62b0
MD5 b41567963c6c90a548b03c0ce4c6bb0a
SHA1 cc8d408086c6bdacdcb3c2276b677ecb3e5c34d0
SHA512 aaec47e27d3545ff490c8184378506f5a6f65b9eab4bd06bcd9e2aa7210f9a2eb53bda9b60e2d95823574910f507f47176fbe48b0aedaa9e3bfff942a6dea04c
SSDEEP 24576:nZMRzFVSOu3KnAoIBlEq1tIgAWz5foj3Z:nZMRzfgKnAX1tIc5foj3
TLSH
T19F85F161739418F9ED63823EC9658906EAB2BC650770C61F13B436276F377A01C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a7dfe07a572bb71b2d2669d419c29ad396a9c55260c784b704d42c5a948955e4
MD5 216b8d40fd729dfb9366c95c55da4177
SHA1 6c425799e0fa715cb65ef417e47286c4f1c28312
SHA512 1790fb1b7a3cd07f0e265b3f674f48efb0d2e8cd5161f45228a2cd1efe812937fd9c1417b2cbc4240cd596cce58ec5794389da35dca4d2d1242825991fb21ab5
SSDEEP 12288:7bZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:7V3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FA6523217BAC082EE6534671D2F6548AFD74ED75453A4467313AE803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 909c7db958e3ed46a6feeba481d82234a9c7d12fb584657ffbc92d60a1674691
MD5 debbab01cedea783efe203085fa2f6d7
SHA1 fd2aea53a3d7931cae91841f1a5a1490c4824027
SHA512 fdffe5d638a285156081e9eb500183b33c71c71f6eef78439da2c455601c13d283e3a2452b6c47eb4c6492c1afdfc7cfa3186b98a86483c06288f34e6dc1abf9
SSDEEP 12288:0vZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:0x3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T14C6523213BAC082EE6538671D3F6548AFD74ED75453A4467313AD903B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6e042a4582c462ae072d7af591759d7bb1b172750eab875a7f9d68d33669fd2b
MD5 20982025213754b58283804b29ce5836
SHA1 763a8c2d61d382913a96936f8c6799de1b6694ca
SHA512 2af90a494b3d1fa3ce946c8807ed14eed87d5cf4484ab307156930dde7c326b8aca5ae20ef1e56e5b604864cd633a238bb031b345dbf283d5efe99a981778e0f
SSDEEP 12288:VyPz5L8YZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:8zyq3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T10075021377A820FDD1678234C5A21946FB71B83147358AAF236446776F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3849183863ef69eca4e5774480358275d951f8f2375d5a695391b3716141de16
MD5 a52b26c7c75c0493ca2e9499312e9388
SHA1 ef1d6ca4c2530ff29317c3e4c68633f3ac9221d9
SHA512 89c9dc2f163cc33847dbf0e3996532202a6dce269d557b3a6f1dcd0841cd23558bf0f3a1fdeedb2d2d01d93e9ab026df0ae244908a0168ab2d093e1f4b8e9cd6
SSDEEP 12288:ibZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:iV3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A26523217BAC082EE6534671D2F6548AFD74ED75453A4467313AE803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a0533aa4e8b5cee44f15cd381659d422be85ced23d28be83ac517e3239962d82
MD5 90e32503a7e0dac0af78ebed600c85a2
SHA1 067a7a1d96fa36a2381a215e6d2ed6d81502beac
SHA512 c782ef015fb67e626e8c81d3e3359d3422b67f9012789e5ee718615e07ab671846295506854633b9f2a02858f6a80f1afb98648cf4dda0fd92db71c1e3f507a7
SSDEEP 12288:BbZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:BV3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B26523217BAC082EE6534671D2F6548AFD74ED75453A4467313AD803BB3DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 8c7ef43df54696eb3700d84bedebfe3e9da60e3009bdcf00d8d9de71be590bde
MD5 1fe34d0a6f7f12720696d91212fe8897
SHA1 5fcfc41b387b8123dcc56cdaa9cdd775645d4f57
SHA512 92697d64c225e4bcd760f06d8538d3226f8158e89339dcd7d35b82ffc11805eaa3b51215b881176f17f2dd7059efa78dd1fc059d9ddf1449cb3189661aabaa64
SSDEEP 12288:JyPz5L8YZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:ozyq3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T12C75021377A820FDD1678235C5A21946FB71B83147358AAF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 08fa6167fc17d52adc1c07fc857e3b4de4b345202ccbb58aa9dbd3445504c030
MD5 96612c68e05ac70c2aa226a2089080ae
SHA1 4ea5ff58c6ffe45e78fe903869332192bba93646
SHA512 ae6697956e7b7ed7d30ac84f0ccf34b43787d1078bb5dd6aaf33f95a9bd0a9d5b0aea926ab002e6e3547b19e593fd5a51bcb185078b56183f6883b8e3556e7f2
SSDEEP 24576:iTDaLl3z0zD43KnAoIBlEq1tIgAWz5foj3Z:iTuLljfKnAX1tIc5foj3
TLSH
T16A850160735418F9ED67813EC9658906D6B2BC690770C61F13B836276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 bf05e3173188e4b5c989209f73d314b2db62e355176492e774e737fba4fe959f
MD5 5606e1eea7b9334c9d1c94110a2fea84
SHA1 20a4c90e708d6d33706a895a6938a9688a5f1320
SHA512 91d195b6159f6e016366963aad0a58432b56873103a42310d9fd8f02d832b4ba3a8d0dcb7e9f4d65816aa7efa39445a0db658e0a0425b3c2c4e98e690a049ffa
SSDEEP 24576:z3vd9CHKy7GZ83KnAoIBlEq1tIgAWz5foj3Z:Tvd9CHKyagKnAX1tIc5foj3
TLSH
T1CB95CF90F3E814E8F1B78A35C9765512DAB67C691B31CA8F03A4651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 02dc99e03d146b345f56d27fa0146377084b016f542cbf67979904c1ff0083b9
MD5 0e9f7ffd48d12866cedbeefcbc5d6c2e
SHA1 9e8a4f1da6882992faeb2b07c1ef44bd052e87c5
SHA512 1eed7ffe39f8f758cceaf6f844b7082a741e4ae9a958cabe203a789f553d9c3669165decef8004144f6bd0c897197eb56694717c679838e203bc816312acc7db
SSDEEP 12288:MOZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:MI3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C96523217BAC082EE6538671D2F6548AFD74DD75453A4467313AE803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6477ac236193e822c30cc06bdd5379a134559754d06e6d762609fbc101b37847
MD5 7d223da56484ef8233b576c4588dcd7b
SHA1 2f6c74c85c7b864f207830a8912f9242e24ac11f
SHA512 b1ff96270c9df43803a0544cb1f4f3c5d13ed7178fca084d30b080ee45852c886109f5a554407f49970b800318c42bec5006e0b29bda3eb03d31e271c8434b93
SSDEEP 12288:L4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:LK3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1936523213BAC082FE6578671D2F6548AFD74ED74453A4467313AD813B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 f0e73c734ad1267f307250ff9d9fd6084c146cef633564e0f49992ea9250bcef
MD5 1d0654a2b71755913dc56c751d49d4f2
SHA1 c2aa7b28646559d2163c6cb7d3b2818e2d1df5f2
SHA512 ee4b77c249c202016dceb0e24e2373d2469fe1af02ca5695b5c3194e016ddf2b8404bebfc278fc4dd04d28c7a4cc6efd54ee84a63e589d488f101e544570443c
SSDEEP 12288:8dZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:8H3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T17F6523213BAC082EE6538671D3F6548AFD74ED75453A4467313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 4d7679a09a21b79d03e8d020ffcf34a530fc478da90d5043a97b73ebb07d1fc9
MD5 3f665c232bbe8557dede3c7b6567b8d8
SHA1 5558be128ce11c988150833bd74ec5eec5975018
SHA512 4a3e3a134880b39e1569b31496d0d05477636af42190a2fa9c72d2c577cfa1aaf495472696e61419304c83f628624160625562d51752a3172d666623ec997a42
SSDEEP 12288:lbZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:lV3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1DD6523217BAC082EE6538671D2F6548AFD74ED75453A4467313AD803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 51abba4a46b7907cb42ea498dd36d2d1b23c03b15c1e46356ce39bb8b9602ec4
MD5 6b965a9fed91b72db91a397b375b14f1
SHA1 be1c1e0ca74f12f9bde5ec1f18bbb1ede01e6373
SHA512 c2bd8356ca3770e16bcd376746279212458608d7249950692929f2d9b58e348acea3b05099e86031d545634d4dad3e42cf43a8bba2681c9a4e84aa658b667339
SSDEEP 12288:wOZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:wI3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F66523217BAC082FE6538671D2F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 df6c62eb2500c417e9aa428db348927cce6ff65a06d294665b6a34324f3269ee
MD5 c514a0034fb63bfba7f10b03a22eb989
SHA1 0273c316c4840358b5cbff1ce8802dcb540aa294
SHA512 3c3f269275ec5d3821b677d26e2a54c425eae38bf3e3e199cc8a274449cc90e9c5b07854a04e274c7ac0124a5a5eb7fbe250aabf7dac8ee1b18f2763e19dae3a
SSDEEP 12288:2jZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:2N3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1026523217BAC082EE6538671D3F6548AFD74ED74453A4427353AD903B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 b997819c6af60d5e246faf0f7eb4a836ceeb52d13a7bf0f5ec7ad4bee9698d2a
MD5 08f2107ac3696288901285259a6370f5
SHA1 4be6ff327895406ddd656d8821e22cfca38a7f75
SHA512 c9dcec38603fb8ac6f8e2b0aff35b66a6822adbbaa3593921366bee45762abbd48a59f5c7ba8b833f773183ed4fe308557c6695a1b69ce550295bcc12cc047a1
SSDEEP 12288:YBZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:YT3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1BE6523217B6C082EE6538671D2F6548AFD74ED75453A4467313AE803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 5ae80d701901ccdc19d4cdacf243b4c4ffe6019fc26d5eda4ce6886e7b478887
MD5 806f72fd7aa32eb2359508abb0763d7d
SHA1 2d951e548ffdae9bf8bbb1fb6674baaf2efce1d0
SHA512 dcd375c5c0f827a6775afa1d05cb484fe667f93f1b43e379df2e3bb1dc24f5e4112028a79b3128f446dc10d4f35dfb88e68e186c6cf7ea696184e2e3c78a1136
SSDEEP 24576:pfwvUk9RX6wkyAIh3KnAoIBlEq1tIgAWz5foj3Z:jMnYIhKnAX1tIc5foj3
TLSH
T12995D029EBDC04E5E177923C89B7460AF6B178680B31C6CF125A536E1E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ab86dedb3f89b43575488a0942e253fd31abae2a0a2d9b403ca56151f3fcb3dd
MD5 8a803c5be45da7ed1baa7dbc833a772b
SHA1 1518d8f0c20c471eb75f9d6b07dbc230e608cef7
SHA512 c11009893c49eba00a491bfd876ca5068265413d7d512c04a8e13f51544e7ae0b4a4a9cf3870c455f7bd01fbbf82ef19f731cb9a8ba58c861757a77cacb0120a
SSDEEP 49152:1YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qKnAX1tIc5fob:4ySzPy0Okc5g
TLSH
T192066C56A16801D9C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 157eab80fbbb1207f349d73db8c3f41fe4edf695f4806db7c67167b581abc6e9
MD5 cef446131bd406fac3a54acd576ac792
SHA1 0a616e90837b7f3897683bd124ec073f3f79334a
SHA512 cfc97112f6b9ae2468c94a5b2dc3d2aa2bf417f3a378c3e73ec9c149711743c901420950301b34175ac3f9c882c6f3dad0543b42fed3cd3918e1f2cbda8d2df6
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYe3KnAoIBlEq1tIgAWz5foj3Z:c47JUQjTirIhCnDHUPfF/6KnAX1tIc5g
TLSH
T16665AE1DA3EC01E5E1BA827885554A5AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e723bc08a4bd872c538c0e704c9a56baa72d849ce4bc99dc7389534684aa9e4c
MD5 37abad7cac55c4fd2c091b4a9960ae70
SHA1 d92d30f4082f38a69a5f1490d74b7c2031a79f01
SHA512 e7d326fbf918b533a2619fef799702b6cf070c10d7e1f1ddca3d903924c3be7e78b3c751614ec402c24562ad82390c6719d25385d171385d139d5e853e9b0358
SSDEEP 12288:AbsfLZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:nl3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T16275F115E29801E9D16E5275C7A64A45FB337C2583F1C2CB22E0F53E2F3AA905CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8a3fec99bdb397b8429be618d8ee4c86165fd734ba2e3eeb46da4c267069d67e
MD5 7ca98a13bb71eb698efdf08aeaf8223c
SHA1 cb62e19609bdbb13da30a9c6db72a7157cfde3cf
SHA512 726260c27019393dc7f5b50b7b2564c359f10f019f0595294fd4b6d117574f928ffc05f49f44dbb454cff28aedfccd374f6cdfa3889816b04e4a55b7cd97c77c
SSDEEP 12288:omqQa+pU3fxU2tFOmJdytQRdHZll9DvbY2GxFp:omqpGUPHOptQRdH3l9bc2wFp
TLSH
T12C352850766AC75FC6A940325E32C2CCA7707D41FE05AB0372C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 44ba857c6104b11d63ae53811e9bed4953b09e6442db1bc4d986c8251a2a596b
MD5 d8f37d3c50a1da8314d98a435ac28ce8
SHA1 7da2e547223dfba50050ae4de678d6d7c3be9c4d
SHA512 8ed24eee4735b84c8246e3748dd1f24b22a4f4b89186fd188fd9bbb5bbe450c6582b4b45f0ec248a82aa4fb6c164fd998acc892c58e63ecdc106e453e38ff8cd
SSDEEP 6144:F9DkhlGx/rE1Xvd26tMxUo26tMx4/1u80ozpSvl5PcI0:FWv9sbpSv770
TLSH
T1DF65E9815537A3DFD1F66032072A5B4DB764EC07B3096F27B3C8453AD82AB25A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 96214480507b9ce942eb8355fa1a5689e2ccc5bc5a9996e7cdc4bde7c55fbb3c
MD5 372bd8ac414fd1c646718d0bde218500
SHA1 ce01678006cd1be11e0ff6de3d5f7acafabaef31
SHA512 47013a127123cdbcff11c2b7cd001c772861dddb28a3a5fc58fff4cc1008488fb8a4fbb6fb30d9a5b78771a501753974e8cb28c79120bf8e5769ac0e262ab559
SSDEEP 12288:j07TZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Id3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B6652221779C082EF577467092FA9419FD39F9744B3584E33029A907B63DEE06C3A27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cca3c51e76ace90a9e373246c85b14b8ce5e866fb5990a7c526e1174d9f7fc99
MD5 7d722a8ca8a153bd33c8ae0868ea147d
SHA1 4b90ba75b6d9c5b9ea0a11787c05cdfcfac011f9
SHA512 a40ac4a658b26433fdba8d792a95b3395455386f8b8689a5e1aecc250631851369980678d495fdeb8d5e0d63d2d389e6ff2068206d0286c4fa889628ecbe60ac
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYP3KnAoIBlEq1tIgAWz5foj3Z:Kgb4mBIBhGF8KnAX1tIc5foj3
TLSH
T160659E1E22EC02F5E1F6D2B8DDAA4417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 ad7244c1ffac3771c3d7041e8015e9509a74cc43eb7ee986ea720846073a6e96
MD5 c91237b6d8a5647e04ade568dd27b59b
SHA1 4a7dd0622675d74ca1a2a02f00f3b1e8c84ba582
SHA512 0c540eb9d22df2df8521782222d7dfdff4a13e128a14e99bb6e43a9e8d2565c0fbacdc4c07166e32174b889e7350e631839116276b4539845954b9f684b5575e
SSDEEP 24576:uG88u8FpJqH1bzria7/mu3KnAoIBlEq1tIgAWz5foj3Z:l7ZFPqVea7/3KnAX1tIc5foj3
TLSH
T15F95F16177E401F5D477D1388A964667FAB1B4250374EFDF06A88A522F23AE40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 702f8c182e1b1030dd45b003b8f7c248ecfa770181955fdddec549251e33672e
MD5 77dc076e7b59e4f5b1713fcd9a855caa
SHA1 1a1967801645661e0801217d6418499bddb0e241
SHA512 30bb61f69541600b09f870b2d78b4e6e2dbbef1bb20b9d74576910cbe053746eff52d4635c46c8affd5c5b197ab7343816b729b9cd0a5cc99d82aeb636b54189
SSDEEP 12288:JHvUrBFrEjwaQQZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:JPUr+NQS3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F685E12B36AC1CE9E676E17D85924609F771B462031291DF02A1817F5F67EE87C3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 091f1f7d81d435eaa63b2479fa6144eef486576b406dacb8bb4ae9edea9588cc
MD5 e30e095667694b86fadf81bdc7bc57c4
SHA1 fc0aaf07e20a67647e7fffad7c62f28a5dde0a89
SHA512 2229bc1785be18e66e1bfd549f302a7b505997ea687b51cd9d7633f790c5b9e2967eb310369b52bd39b82554f9a29a221c134a0937cf65f14ff35fd584983386
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQKnAX1tIc5foj3:eG05lO43b50Okc5g
TLSH
T168D5C06A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0f9d90c9afbe46bd4666b7af72b2240ca5e6855cc4db89627ea451e036fca186
MD5 82f52aa38e9aa6eeba796c18715c15df
SHA1 a67f20a4dc308233b8170b8153b7f2f2f8ce8bfe
SHA512 f5f23e5a970ffdda9fcee13a0a053b530ebd94736c02beaf93e1503f8db6ca1a9d00cdcc024c7abbe527d4b0a9c2c05ed39b4f721bb105b9d3221384bab7390b
SSDEEP 24576:Xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnU3KnAoIBlEq1tIgAWz5foj3Z:va5POZ3BJt2pasx2+m4KnAX1tIc5foj3
TLSH
T11865BF5EA7FC00D5E5B9D17DC583861AF5B1342153329ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 745a460b564d219572f274766793add2f2087425b177ad6b03f38d4fbfad0df2
MD5 3c04bdd6b3298b0337e5786b2f9bba5b
SHA1 89dc434c03685a30c28317d2f603decd8a4cd11c
SHA512 5f906a551d98c9781d83de302fc1eeabbf326054fa9206d3f4c167f5e4240ea7863fbb0c99e43dd4926640943cf0fd78657e4f5e16ed10f8f8776fd90dfb94cb
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkW3KnAoIBlEq1tIgAWz5foj3Z:dNc/zEOVHFXKnAX1tIc5foj3
TLSH
T115858C2623E901E4F1BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cd1817c6c35030715376f6e0645bc0dfc013aadc5b9429575190467acf13af59
MD5 56b92de069934f78dda37f988ec5d9b1
SHA1 f19122d05dc5a25709a8b817d01aef54df4662ba
SHA512 7e197b48ffd6ecf1d1623d86f5cb39a85183195d226713e3756df670f49a7fd29bceb04138d6a3973118b203ae1bde86ed3aff03834937da80a6677c4d7e3394
SSDEEP 24576:rTkNvNnaFeYhJNtmZBmw3KnAoIBlEq1tIgAWz5foj3Z:rTMwBtOmGKnAX1tIc5foj3
TLSH
T1E055AF2EBBB805E4D1FAC6B5CD238512FA727461073292CB5290C13F5E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 2f89fba158387d33bdb3b499a050397f4fb399b7b5467a5952f3718d14be8729
MD5 c94ed6258757cd16800719c8ab36b5df
SHA1 4ce75db757d4934900b2240d8795dbb65d4fe4d3
SHA512 361ad30076c48e3d2b7cf5dbda4bc2e29df7dc69ba8d8767b70f6c0bb7e6e680a890823149b80320b35c5530952bcdc93e390ea0e60bafa146ca5ea51727d44b
SSDEEP 24576:2D3FHshBIYQgAp3KnAoIBlEq1tIgAWz5foj3Z:2DVHeBIAAJKnAX1tIc5foj3
TLSH
T12495E13DE79C04E4E57BC1BCD6A38906E67178A8033255DB1294C1B66F2BEE43D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1064-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1064-119-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1064-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1064-129-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1252-65-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/1252-73-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1252-301-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/1252-67-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2968-320-0x0000020D6A3E0000-0x0000020D6A510000-memory.dmp

Download

memory/2980-60-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/2980-40-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2980-39-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/2980-47-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2980-52-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3180-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3180-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4140-80-0x0000000140000000-0x00000001402B9000-memory.dmp

Download

memory/4140-1-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-8-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-7-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-0-0x0000000140000000-0x00000001402B9000-memory.dmp

Download

memory/4492-302-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/4492-77-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/4972-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4972-95-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4972-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4972-305-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4972-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4972-101-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4976-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4976-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4976-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4976-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4976-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5220-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5220-321-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5220-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5220-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5220-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5220-82-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5724-108-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5724-308-0x0000000140000000-0x00000001402FF000-memory.dmp

Download

memory/5724-106-0x0000000140000000-0x00000001402FF000-memory.dmp

Download

memory/5724-114-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5732-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5732-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5732-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5732-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5836-286-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/5836-61-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5836-53-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/5836-54-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download