b9699da9a402ba07d1c1247e872e5013edb50dfabce5d8e232e2aec19c52ed5c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260913-hsypladn71
SHA256 b9699da9a402ba07d1c1247e872e5013edb50dfabce5d8e232e2aec19c52ed5c
MD5 0818851b0b7d9c0f7ae3e49cc96e924e
SHA1 7f6d4226038759a5a45aa8b8a9b4cdf2c5283f2d
SHA512 f5776caea8d5c1adfe1c36dde6270cc8a7bdd7bad642ea352ed1d2c36205a872c422052a0f6b653dc1b5cd4fa83cccdd8f9b8f7eae11c079084b83074e29542d
SSDEEP 49152:1vmHGcnO2EvU/bMvo/SHEif5YL8NnjSzjNCWTPp8N7s8SJGZDmg27RnWGj:1TvUko/SzSj0I8NioD527BWG
TLSH
T1B71629ADA6DE00C6C070A4F4CD065795E2F2F864833149CB15E81A1FAE7FEED4E39664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2972	elevation_service.exe
3096	elevation_service.exe
3428	maintenanceservice.exe
5652	OSE.EXE
2848	PerceptionSimulationService.exe
4760	perfhost.exe
404	ReFsDedupSvc.exe
4548	SensorDataService.exe
2208	ssh-agent.exe
5484	AgentService.exe
2200	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\57d3abcbe4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\CompareRestore.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\java.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5edc7a14d43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001348a2a04d43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000af2c7e34d43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004c833a14d43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e7f90a04d43dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5484	AgentService.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: 33	2200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeDebugPrivilege	5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5844	2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2972	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2752	2200	SearchIndexer.exe	100
PID 2200 wrote to memory of 3024	2200	SearchIndexer.exe	101
PID 2200 wrote to memory of 4876	2200	SearchIndexer.exe	102
PID 2200 wrote to memory of 2036	2200	SearchIndexer.exe	103
PID 2200 wrote to memory of 5768	2200	SearchIndexer.exe	105
PID 2200 wrote to memory of 3412	2200	SearchIndexer.exe	106
PID 2200 wrote to memory of 1408	2200	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_0818851b0b7d9c0f7ae3e49cc96e924e_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3428

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4548

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2208

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 80ddfa8c04a6c29a83487ae4ee7d3ade06faf3881a5145feff8b581cd90ebc2d
MD5 740adf183965353a349a78e3ffb38ae6
SHA1 d91642c6369bb206e058ddf7df66c6818f4cbb77
SHA512 9ac24227452ba189217f6701e54b9bd89b79e5c595491c9d71b164d263eefd0ff75d3a2ca567b28c52d01ceab941ceadf91ffd2ca1c6e41e5ce2461e12292c63
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTDmg27RnWGj:o3q6sjBYD527BWG
TLSH
T1F5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 acc580c63df55d7f071542c2e409562ffbcd9e7db7d8dba136a024bb80f5aa13
MD5 6adf088acb419fbcecd9a7cda3ffa21f
SHA1 dc845ea7cf640d3b0db219ea594983a78267df6f
SHA512 83e6af6ed5f64813c3fbd42a350c6fd614a5c3f0cafa00227125a5a2ec2811de80f2b4b83307f98c556598a289e1ad76d00ffc0522b45a7e5a9f804dab15ec41
SSDEEP 24576:QXYfDtczA4sqjnhMgeiCl7G0nehbGZpbD:ntc9Dmg27RnWGj
TLSH
T15765F129B3D408F9EC67817CC9A2C515EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a6ee9e9aa2c4ddfbd90cedf19afbeea94613a03f5c6f6d2496d066acacb77eea
MD5 b952c85c8373eac7e27dac070e970094
SHA1 a108061dc7eaa263871af2e1f39968753eb83726
SHA512 c49989c62c5f677ce4557dca8cb2b3a70ad267134e01625f508d4d1c31289039264b67eeac1f26a279a7c9b560e599cc70dc264f0f20f15ed2e81c6b50e7f94e
SSDEEP 24576:s0Le5ji0hmxxrMnsqjnhMgeiCl7G0nehbGZpbD:sPji0AjiDmg27RnWGj
TLSH
T1F0859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 68bcb6a8d90a919de480d99cf4185945bd8acb86a83dae607ee6687641769f6f
MD5 9e6bb43bd5cdc07e97cdf47729aa6e8f
SHA1 3656ac4372ce79f4fed6e0a5574c32ba89117525
SHA512 7c97624de3f45f296ea8451942082d22636e61511cd3f7cb2ebb74df9723c4ec51f6c4b0a31cdba45546ebdf7004617bd2553d8a58c0b71712eac8c1bb6369e4
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuJsqjnhMgeiCl7G0nehbGZpbD:M/ezSC6vUzPveHjyODmg27RnWGj
TLSH
T1E9755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4563b9c172483cb774d3ef76247385a662ceaacee35ef672838212fcdbb72888
MD5 0cb0d5af3fd01c68f15f21b0dfd61f8f
SHA1 d9f479b4b1c3abaafc54a12a84c48dfaac950fec
SHA512 facbfd81147d949b0410b798d24ae35306ccf404d1774ef3a6128459672e461616fa4d6c75c642aeccfd1dcb9e4d7fdc0b5c9ee2dd19202eccd605eeaedd8738
SSDEEP 24576:JVbqPb88hv/l+Y8sqjnhMgeiCl7G0nehbGZpbD:JVO88hXl+lDmg27RnWGj
TLSH
T132559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 13771171cf5e6a352d61d92fc61c5ab3a269309a8eff6c41d859c950b08388d6
MD5 a401a5cc88483190e875e9dcf44a97cf
SHA1 75f0ac28d68a54364b94112cdeb676bb7acfab96
SHA512 6af90a270b256a1f9f742ea30fb4d6ef4b9aa99f60e2fee34d3ac3af0a3edf0d159a7807f7dc0cd213a2d96312dac6ed8782d6da603ac76c92f2f906a259b47c
SSDEEP 12288:sL7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sL7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ee491c61a33e4ab6e24da683d68bb1b45fe09e03eddf85befe19dd7df8e1639a
MD5 9fe23a57bf7d7983fce36eb77d5411dc
SHA1 e158c13d453d78b4fb582d875129bc2676b6a946
SHA512 40f76821529a0a17f0391dc69f7b8c95614db4d774461f2093151bc14e7352c536b4dcd51de9fc250cae2a667e3ab97fb77322e58031e091a5b03c78996662d0
SSDEEP 12288:GeBNUbTVO86UUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:GJIUUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11565CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fc9ce469234693a099092399cc2fe6cd3e5678e48d8101ea3136313a90798fed
MD5 3adf6ba71e624d99deb92729561cd8d3
SHA1 74836696475057b7d8907f2f5bcb8071a1d2acbd
SHA512 d1e2664568428e0d313b69a4d68ad8bfe0174f36955d7c6b891845138302dff4dbc3a23e4d7b49299f293817212922d7078fd4b666bd1d291f3263bfd3bf790d
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THr:wQvGAdlCEL8c/DRNw5CdD527BWG
TLSH
T19C266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f904c32b6af451780abe987b1bb31de52c59fb732f864bba684c5f2d35058f90
MD5 0dff9e8d8419fe0b068ef6e1904717b4
SHA1 c84cbbea5c4b08b91e6c56cea6a86f4978ef68f7
SHA512 69a31cfd3d14507ef0ad65ec0c2f79257fd9d7fa2fb57c7be82355ee83ffc07ee41c41d3c4a1f422c1b2f13c900ecf8f1cd81af1ca0b4865c520e07b2ab16f23
SSDEEP 12288:DAwSfxL/2Dc3RDLLmt0LDQewsAjeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:80ewsAjesqjnhMgeiCl7G0nehbGZpbD
TLSH
T16175E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 727f3eb0063da8ce2782cb42f6bb7f72f44e717a8fccb760134e71b8cd287791
MD5 8a6d64f1bfbd4477828c1884a89f6985
SHA1 2d3a53afc3c34b62a51bb28bb9c3f1c218ce06ca
SHA512 575de26d9b639794cf41bbdd1933db5e55492c8e4024ae87127e89d370149ac8da60ca06a8fd7baf6a4762ea35e85031e6bb4df24e93946fa51bfdcc4093f5da
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHKVQBWG:DUEtQevvqc2W1cpV2tI32dB
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d3b739e7306601acc4ddda47dc2bc6d9ee0123ee7634beacbebf6d009623e57c
MD5 b33993a19f895e65343c3630a29690bb
SHA1 f3b879ef7844c1520b1d4cb1ff2b6b6dd0f8bf97
SHA512 09ee867ea6820e18c157b7594c9ce6f5d3a626a47a311554af1650141351ceb75374b7171bc074cf34737c6e1a9e01911eec1992d01c1b8668d636a8d197a3fc
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/zSDmg27RnWGj:soquVjnmJD527BWG
TLSH
T13BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7a0017762e6353b7a053de28a5419542336ba9bf1bcba5ed0ad79d5b0cbb1c2b
MD5 77a19d5eca48e463f0b7ddb8f0aa2547
SHA1 6bdf1e8d4a8f95898aecf9e3c37add425acee219
SHA512 82125c05ecbfaadfa89894594e64ed213e985786910507a771a2b7c9f6ac45608afd9bc3a845f24d26f88f62007beee7c20090e21f68148f6db6e8db7f73b07e
SSDEEP 24576:cAhGL3IFoiwtA5l7S531sqjnhMgeiCl7G0nehbGZpbD:cAMUFoiq5ZDmg27RnWGj
TLSH
T191359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6245c56327de3b8d7cb369037a296a40da7c6ba389bc2da31eedd759e8a2a482
MD5 2b255518342305820a7c0a578f079870
SHA1 9fd93052dddf1feba5ec8fb3f77af38ee2a6c6a1
SHA512 c1fa4983bf9fbff89d991d0dc6139b623984f45caa9b4768a88f5383ff4ba4aaf994984f896f496b739982ddd4828e06cff3c6e56e5436ea24273b12cb676d0b
SSDEEP 12288:xmw5HEjsChNVBFgl0WDm+CpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:swu4OWasqjnhMgeiCl7G0nehbGZpbD
TLSH
T15165F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0e16dfb87e21d728d2f7983cd380f77f4d01354e14766681ca7aa74ca40bc252
MD5 eda5da004970101b8d401793f3b9d3da
SHA1 660042219d0c63f7699563b7b03d4a0add0f5b5a
SHA512 3934797c2465fed578a58a2985f4a81a03767eaddb45757d86d998d30fcffe2ef49a72a430e10429fd69373e02f82ff6f96ce66f77c9b9f7d7331cb99648f56f
SSDEEP 12288:1eZ1IyuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AZu/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5739b106bb5bfa456f945db4a5e1e1910ba8e2d67ab73cfc8368a2499f8d8137
MD5 6ab19500f70e8b8876c4f5e46ab47510
SHA1 44da4eb7850ba87887d0f0871b87ba6e1a2f2d78
SHA512 238260635a80d7f8ece7e498eab0858df6f4cb053e1bb0e7533682c167cfa9564b77f01556ef79711ee37cc6297d344b589d6dd549dce81d76a1532685914789
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3sD527BWG:tQyiKa/X+PNcVQBWG
TLSH
T1BB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c8c888b71b829361ac7ae04938a57be493a3b30f64db5b0fd4685906bd277849
MD5 9e72778e7eb17c2d139bf20e8ca19f07
SHA1 721088dedc1b70058b0e022e486830d00aeef37a
SHA512 dff7f0680b90a6dbde6ad4ec602ae027fba70a54aaa7960121e0142608b9b27bcbcd44918ff329cc3fe3409d65fd4696579b0277773f1e870c7b89b8142c01ed
SSDEEP 98304:SQRQyi36YOcPbLvw2gAf+PN3sD527BWG:JQyiKa/X+PNcVQBWG
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 df91a37ae5c5590806d2093c5ec4e5aa4cc0c0a4cb8ef39c9ee91e472b9f941e
MD5 007d7c800ba932ce9dc7c8bebfa154da
SHA1 7f8f6154b54b96dc4f01e194b93ffb95b44eb9f3
SHA512 1a1ebef50957ad6f774d2f0d5189728b6aa779faa07b05877d2b51c94fbd61144d302ec8f5cce206d4948a85804d579bf5129a113964d4098e088fca1e8a252e
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0vsqjnhMgeiCl7Ge:N68Qg55nhceWu7PNU3/iDmg27RnWGj
TLSH
T176B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6d4dd29f78e18400b5844219634829a656f0c1f1ee2b0a89164f1fe1d937eb82
MD5 e0b77bb89e41a285bf1956b78b3003ce
SHA1 18d3cd026c3e55debd00d7f1ab2965e8c5aa7590
SHA512 9e96db9ba166c7e345398935d3f2bcf0640520a7610e4f87f728993dd95706c548337187bd12600cb84f350175e34874e8fcdebd8fbf42270b9b67c3b93b63c0
SSDEEP 98304:ey5112gYy5azzVvt69nLKnhZvD527BWG:PLIHEWhBVQBWG
TLSH
T121167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b5ec14eee3cb27ea40764cfa9e023ce7b82a2dd72186e1a4bb9ebaa0db99762b
MD5 b8246f21fe86192c6e0b2ac523b07cfd
SHA1 81a593949479b0c2223cf75fe0b4d77d4c65c66e
SHA512 c207a610b6e412fa2a217a4f323d99354fe951b2fa1041319f40d3e327261193b02692b59c4afc4210e5d74737742a0586fb0e4610ef3957a2b7f197386609a4
SSDEEP 49152:jB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glUDmg27RnWGj:Vu6Jmdxd2dUD527BWG
TLSH
T121D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 304e4ddce38ed9e8105d0abc2b2493b448e56528dcbbd1d97169c4fcb5739c7a
MD5 88a02426069850219ecf5f9432c85267
SHA1 c6ac78697a7b10ef61b39595778f88033f3cde01
SHA512 a3e319c364f4ebf513a4421aba8da132479ec8756d196b80394e485126f5ec3e6398ee32b2dcf997d864f6c50e043cfea22b3a0fb17e4e82cb8613415ab81a55
SSDEEP 49152:U1hpsNoJpF1A63U44CwH7R4xQDmg27RnWGj:UmifPWRJD527BWG
TLSH
T1BFB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 31450e7892d7ef4a05d5778d2c5d9191085d1adac2caf31050024ef74325304a
MD5 43b146106d8ad04d81e6ae126735a3bd
SHA1 d14935baf4891d62e113fcd98c11ef1e10b2a812
SHA512 d45a86a9eb8f3f97d1ea2f2b631b9e6c06254ff06df3d62d8a1606b79e0be6dac488b82b0fc6f44d320aab1ed7bfaeb499f36a222bd2aa1fa421c3bf910ca236
SSDEEP 49152:iSuZQIY0Be2KcRVtOnks6NMHqjDmg27RnWGj:85dKii61jD527BWG
TLSH
T102C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6e4172b7dafb301c36d6b79905675256e53018f4aa302e2f69e3ff03476de7a5
MD5 fa565213a45234381787de7acccb4e40
SHA1 70cb4903f5060c9058624039f7631c1a474dae7e
SHA512 f8520e09cfa8cb1164aca6206bf127ea8d170c7f8da8042fee8f96b9cfc247cededa4b89a1a54b79913a91f203c3dfec934e060e509aaa75b3ebd5d4837fed29
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5wkDmg27RnWGj:8X2imph1D527BWG
TLSH
T1FA95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e37b4d568bc848215c69916ee8a2f56d7c057a43f6f4beee5ba5be504e8c6544
MD5 e0c926f875addc261e24445b02c89aff
SHA1 2262f6c2e3c99432bbfcc5f904504e52c7f846fc
SHA512 4ffb109e1e443a1563d45138d076a9fda2afe50a90c3198e2c92d74f1c61c74938c31e927996f03450422c83a06a045c1b8c5075e1c0cfe48d0c585e6a3f2f0d
SSDEEP 12288:7TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBEEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 80b3fca49dbe276e61dc5f8662c64541a5207a1f26ba0262c8ee896636762c1c
MD5 1c85baefd1b92dbabc48d9b9d55558ad
SHA1 380d962ba250e1bb79308c9a39704d13f5a13042
SHA512 9d0d5246ee5466ad8d186f0619236337351567c069f33c09eeadaa4d424df64b8b5de5b0079d812b97a830fd1b8324820d25ad9e59fd935c8c64476f8cbe66b2
SSDEEP 12288:fiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 30ba85ded6ab437d6ddb3a043399f01fe7bcb7d98ec8ed42f93dd23175ad66fd
MD5 1a4b22f24234810f2ed7cf305f105469
SHA1 339850d96c2dc5c20815a60657fb554c06c431e1
SHA512 dd50f5ec6a2d110206f32f6ff649c5012edc5e0897eb87cd1e3a74ff57aa0b9a2ab4cedca1c2a7bace06fd25c6c3815cbd1843f5b189d1ca654b28f78b82488d
SSDEEP 12288:7sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 60c7f1d624b44933b6c8ba9677a4417ccc61edd80097e19fd79b17b01640749d
MD5 f0e882749a626dc042c6f857a241621e
SHA1 f6a56d9a21998a79fbe0cfae6d246ea02d6957ae
SHA512 9da7f5000bb76a956b42238911ab607466c8e69d01a2df990be22c490ab1294901ca5f5f64ec46f14c1bc71a602f011978b7e80b84241cfd24b9a0dd0fab1ac7
SSDEEP 12288:DVVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC45236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0d3b566bd379890999f4ae82b6f2b5b50033cbbcf4e190905004c2ff8ed9b3f7
MD5 f2929d1d55d3a7a56ff47c2f35b73667
SHA1 71f23f01a37c830b3e737b37f65620dd124c2264
SHA512 93631af40652e6fcebeae97c425f6bfb4979018b28a1f43c3c77ba7ad8fd36e54cd0ded6ea6a8dc601ae21f731b71029f67a2d3306bf91ac1cf55e441c119612
SSDEEP 12288:i9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1134523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 09166f3e63f61652dcf5df4658e7de17bf64465bac7ceb976ef60a64776a929f
MD5 d9920dddc33cd940d0511363aef9836a
SHA1 3f2d64f68152afd43c3dea1f697ce2b6805a562c
SHA512 7df9833b9dbdfc75bb9e192d890ce59d80f3f1fcd154f7e28f9db15a0b2088db8601ba9adad2e71864575aaac526c193bc734017fd71a5518b88077bd2f6577d
SSDEEP 12288:dWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BEA65C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 21e11e89d9e72baba0ef36ba91729b931478ffb47f1569927eedf00404732263
MD5 05e0db639e7237e8f9616eefd36656fb
SHA1 2085424dd9dc7fd6a5622a2f69ac45ab5839f836
SHA512 289f33771f4d50a06defbeca77be8ad4c577cfa190ab0e1089e365a2a2a01f9b6e29b14a9436f5b89b3c9c1a58955d9c0474de87af83a0f0665e8389ec82f764
SSDEEP 12288:nKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BE965C41CBE52648B5C3E5F11DAC073E5BE92004837A6B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 182551a658dd7d611be429a2104c7d58c32d6c705c1afdee37aef394e40483da
MD5 effd25eac32561e97023076091b6d7ae
SHA1 890442c03aca8e1db0fc9ac9c07f5f76a8dff027
SHA512 5a226d94ec9eee3d36b14738b97298597a050d95e1510d943acbd0ff5ce1aa227a881d849de962050e82899d189a87f8d16dbc9bbec5f109b6ae01e5024577c5
SSDEEP 24576:7ZMRzFVSOCsqjnhMgeiCl7G0nehbGZpbD:7ZMRzfqDmg27RnWGj
TLSH
T1096501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6af92965d8792a742f2195f458973ea423d7c3700d725d7e8396b9a4f1a7542c
MD5 49e7af692724005ddd184aa84b019440
SHA1 252bb6c7acec807c9dfea30bbf41b8747628b23f
SHA512 cbe38b4da07cdccfe82e15842011f98185c0628424ae5bd3bda3119d646b185fd08269b99766b5e6601830ed4e82730b4355566543e577174bc8dd55626375ca
SSDEEP 12288:NPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB4523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 326c0fb09afeda0c3b913bd2c1c885793bdffcbabe37c7037a7daadaa79a19be
MD5 3b39df0942e4d6a4b1b9c187367d17d5
SHA1 5096f3d6fbbd7d893701bd2560cc579042e7164b
SHA512 149ff72d44deb82ae9613b3dc00baa5401509480cf0ceb6c782585c264103dee9bc3f70ee7f58a719878ef0e50127acb481b6495214c9d3fe0e2201b06eaa338
SSDEEP 12288:qLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BFA65C41CAE52608B5C3E5F15DAC073E5BE92004837A6B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9d0a6e74ad1fabdeb16c26a3c2d5e470132a07e38d5f614b98c0588646ba791b
MD5 8adfbc6d7ef26da66ad66cf8dd679225
SHA1 b7eecc9663c79b32d9c35a8c06750a935118d332
SHA512 91def70907580fc18d5b35a6c16fdee03b216dc72c334011e636ef5f927ea31261408bdb36e8cf33dcaf7e49a9598d6f3d4b3d8fd61c494dec30a845d79cc6ce
SSDEEP 12288:hyPz5L8uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wzyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T12955125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e3243a9dea21bed340cf9459f05e6eca7c5301c1f00862d28df0298551f68b90
MD5 5bae336316ed0f9b6d70574c7a73fe10
SHA1 af7316a6c288ddca7ef813d216709b04a144a74a
SHA512 fc194383d2b027eb8fc8610ecfc9ed001bd79fa181e5934a777081b0c12da4b5b3954b55431e1fa6f5673b38e4925719eacbe51c3c5a2d9c71ecb81e4bea84ff
SSDEEP 12288:bPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 946ff15f4fe126938c8f7099397cb5a375e3a24daf972a70d6f1f877f7be9cd1
MD5 a8edc0e978eb80c7deccc21c680a7b8a
SHA1 44c21d7d476030734be144513aebfab5d5e95d47
SHA512 936d3098723b325ece1a345147b193aca15103b25e6bcc13de2ed94a5ea69ec46825abeadb99c730f5e736183fb8d2df77c36f9a00fd3477a12c8eb47178c92b
SSDEEP 12288:bPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BFA65C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c504dc2adcda5f6e92f1ff03e9ca7e5524698e04b7d3ed8f354c332e38e87e10
MD5 b3e78a875102d5242ec3b2d119e42b6c
SHA1 2e34d13a15c384db71ba08061bf341829693554e
SHA512 ae6ace2c97cc8e168fe5510b08568338f7b1023c409f74b94fb2b33918e89f515aa9f98de24e68327f2544f73e1f30d51e211a3c36a159572775bce55c74b0eb
SSDEEP 12288:jyPz5L8uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D455125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1409f7799f94a25d8c00728392e29b0b3a4ac3ac9280c4065dc92899f432c881
MD5 199b2a45b2a01c42b61dd91592c73328
SHA1 1a697406e1161de44aefd342c4684919622b6f59
SHA512 c71ec14e45350996b2da404da222c0c83b68fb337a65d19fefa1ae44b223088d2b929c2a8c047b70556fdd21c40b29f7fadc11dbd7b4880a192ba7084bd44ba0
SSDEEP 24576:tTDaLl3z0zDcsqjnhMgeiCl7G0nehbGZpbD:tTuLljNDmg27RnWGj
TLSH
T10F6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7b2d6f4d3a83136eaf4236af3a285a5d65a22a6c42e77c29c662110c61b0d0d1
MD5 478431643a4dfa0d72c8605e6e64a295
SHA1 17ffb86978a05ebb2e9de65389b9f870f789ae14
SHA512 a5b6ba8c012a9c822ab1006c921f655ce1e7acade1435862954c24c7edcbe7fc29f217a5576f75268e3f061d833b96944c195e4763e8336137eb9d80abd1c0b7
SSDEEP 24576:I3vd9CHKy7GZQsqjnhMgeiCl7G0nehbGZpbD:Svd9CHKyaqDmg27RnWGj
TLSH
T1D375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8b25e442b9ded124042e2e3f084ac447f82e3a979582a74093ee66fadbb08a77
MD5 007b05af1e9d9ddd22c708e03a842670
SHA1 e08156a2a1298109568bf1f7d8d5e97da5501608
SHA512 ccbbd24af9e4a181780a2b7c5c5be5103ac3c3c0815be16128c042c6bfd29c8d6cbb7bcad946c15c4bc010f6c1ad42217231ae94afdce83d859ad6010ac257fa
SSDEEP 12288:/MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1204523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 327174a0ba112ea9de09307980e77ed002229e08543e679e2bbfd8e13c753897
MD5 8e73ed847adab09603c01304435ea7e2
SHA1 d3984a0a396e7a274e48055c9d7ff74319d7e37e
SHA512 965aa4285321fe05b5802b8596afd252a83428ffce2fd82998e6b1a9839a7b20735da0983cc69cb2aff411a1c700cc778edd18a63fb52623b82bf81bd8ac2763
SSDEEP 12288:IOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837AA77CBAEBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 05abc144e3a33036197f71110f4619da50e0014f454851d3f149eca2bd3e3979
MD5 f89bfb3f74dd9b7728106206aef8ad8b
SHA1 f0dee3c62e669cfb0dafd6936d8f98abd172739d
SHA512 5f14e4d126a1c07de95f83ff177b22276eba3384d5eb5aae6b6ae2becc61e0969a577d638e255f391de8458b9f578ade74f9ca9a6bc342bfe791057fcadf0ebe
SSDEEP 12288:LxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED4523BEA65C41CAE52608B5C3E5F15DAC073E5BE92004837A977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 303215d6dc39fb41c3c5f33d34ed0ac99e6e39bfa42f4a4fd0c3e7170fe3db0d
MD5 24faa42ce8b2c84ea82df760c47a6b93
SHA1 d356cf01d96f9511c4fbdef315e9c03b5cc144a6
SHA512 e7aca0c03c68e2a211ffea369017c2d55697305702d1a62562d5a99e07f6de95419ab8cdb6e9fbe5577bad8537b957300000cad22d609a3d95b8fbeb47fe76fb
SSDEEP 12288:WPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 774389c31838a96450cc6960a34e368a6994c10638e9463de5233f0267e6b897
MD5 3242a6c6936f966d7c93ed5574fad8ee
SHA1 ae3545ac24bde814e302345baaac3f63ff30037d
SHA512 fabdaf0d8c5a98b4d967ec1d411856f1afaa5fa8ec5aaddf06edce2fd8429d1a723c63eb35bd0b8eb3b8d1b090ba6126c4b382387be4091d2ce118578861b53e
SSDEEP 12288:qMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BEA65C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7f24deb132a4fa8acd642c32efe0be0999e8e94a865e32d316e5d8fc862c90b9
MD5 63f90f6e43a2b02eb72c4be76f0ee840
SHA1 85c8c12a45466f98ed63d55c753fbfd8946c68d7
SHA512 d7205cd5a946f001c9e1c96c51679f266453ce4e6fb10e939c8a1aa224f1bc88a4721822989638ff21deb983aae150c3eeeb1e3344cbc903bf548ced7adc5e06
SSDEEP 12288:TXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BEA65C41CAE52648F5C3E5F11DAC073E5BE92004837A577CBDEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e018bc22bd92865230d0618250831e8ca336384405548350529bb6ad1dfcccac
MD5 e6acd1f4ecd4c9de1948a6e34abc880f
SHA1 9b6885f9a675408c6e5dbd2de519bf5e3f6d7ff2
SHA512 d734220e9d0f3cf0e0b1936c64d5e16c1b20f2114d675ecf4c7c174680d506a49933b913c4ee50f8a228f4f4a8b07358bd87cd69fdd134a2cc97730425f68fb3
SSDEEP 12288:i9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BEA65C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 705e7870820770d0be6cb30f828eff23fc5141c301fb8cb156db41dc40ae19f5
MD5 0f854132e828c33086353ef05df876bf
SHA1 cfe5cdc4e66bb6137d194b50ccb93e28acc37ba3
SHA512 de89f16f300f6d7beaa748f60f51e9c14cbee016a76a362ca9de958f3308c59e8122e1998ff4b750ad77a5724c14931eda79e293aee5c39f93bf42b82617502e
SSDEEP 24576:KfwvUk9RX6wkyAIbsqjnhMgeiCl7G0nehbGZpbD:aMnYIPDmg27RnWGj
TLSH
T1C785D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1196cea520858589358d8e02e5b7ac3a7aff95928babc9c66f5342b51836e6f4
MD5 d3e9b36c449bd15d7c893a9da4f0952d
SHA1 b27c67c0af7b6c21301d1fa2bbc6b306b095f38f
SHA512 d67bc4e90fbc364c6dc3e5f5b9a9141260db30acda26c1b7f6ad6d63d8022dfbf96ad6d1a34e8d2a3c3404e27482e4436ac31b899275165d03d1556b626eb64b
SSDEEP 49152:tYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EDmg27RnWGj:gySzPMD527BWG
TLSH
T10D066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 11935e4fd54a394826ab6e94fd08bcd2c50481924363b40d23191b48137a6980
MD5 3fddd4496901a7f70c8559932e20b22a
SHA1 4f40feace8a3a9c51f9d465886fbba8f305f3a20
SHA512 62408c4fe22dc6d3f3a56ce8c68300be3dc6b292068f11ade3fe519ee17262c5aaa36663e62e30a80cb2f4417f95cae9e527024196bc6947184124d9835e5cdf
SSDEEP 24576:047Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYSsqjnhMgeiCl7G0nehbGZpbD:047JUQjTirIhCnDHUPfF/UDmg27RnWGj
TLSH
T13265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ea653e262cab4f30c99a170db041c1989db067fc72479544168f607bdfe5eb0f
MD5 50e91284627a749b107bcac65131d0e7
SHA1 c310f197e39767faaceb63618f4d36b14ee2df8f
SHA512 c967f12a4457e2941d1fea3d6eaa3b39186cbd77d0232589002cee23d8bf0df1b32cbdd62445162e8da5d2b69c8317ba1115886d8f1f7d813417dbfb56656fa8
SSDEEP 12288:2bsf/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c5a6fa4c17b3df1050b4d75e8aadd413e00982f1fb1102496514082daa6e337d
MD5 fa8b4eca228c588d3f529fd50e93b4e3
SHA1 d391856d0208dd030cbb167b18d54f5fa91ca54c
SHA512 2d5e55755be309a603a9b35020258598c2271424a84a23fe61416cb95529e1bcb56d81b4a61de94580d375447dd61ec9884233d8c8ae7692c7d077ee83d41e84
SSDEEP 12288:kfzzGU3fOHaIPF4xx7erIL+M4XAOwaIUUy6qIK3wS:kfz6UPOH94xZ4XAdaIUB6qIK3p
TLSH
T1603506407226DB8FC66940321E36D6CCA7707D06FE486F0773C9873F9576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 95d0323b3edffc3c0e68c354abaf7b5e21b162329ef46f43e77618738b283a7b
MD5 2b285c0ace7764e81b2b9dc7b98549a3
SHA1 f3692fc1d81f8234e13cd2070f8533417b62f72f
SHA512 a02af514bb937638ec3d21c40b0e7d8c152b6bf16d507a1b03c8ee13a47c3ae6139591a56e811f2dfef1d28e6ad371ffcf148da53564bee93660ea6bea6dabd3
SSDEEP 12288:P9gg/Kf2CcOgzvyyYnOJ21ASFa+ykFEXIYn+Ov4SLCmtFfWr:l/o2ogrn4gkZa+ykFDSLJtxQ
TLSH
T153653A0065B7EB4FC97A8037473286CD6B746C06BB853F0573858D38986796EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5e18439eee6fa64e1a5737ccc5962931caf206df9e12b43bb71ca0b691029ed8
MD5 37e0657aa0990cd5c3bc1b364dc5da3a
SHA1 59348472e5410c47da2c2e7179da91f8a20361d2
SHA512 03063ad57ee98261ef6fd5e014ff86c4f30bdc1fa5c8d2327e3931fc14138c7781842ba5309fc81739f3b2c0782b17b358ce81d8d9847d90645a90b067973a7d
SSDEEP 12288:307HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10645237AD34C518AF93605B482EAE12D681B7E669F1044C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5aa91f7449eb34758de095402a2bd229ddaf7f1be1cf84b519dbd722729b7ac4
MD5 d4bfa03784e63a8bf2a71c0474117514
SHA1 e8ae17288bcdb1e2f9f337bfb960528b78532c7d
SHA512 e8d515fc83b94f046efd2125d732c7e90eff301309ea6c0e314448ce484ed1cdd91756185909074ba180472e34ac585eadb1f9ed16aba13e2adb2dc5df797e30
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYJsqjnhMgeiCl7G0nehbGZpbD:ogb4mBIBhGFWDmg27RnWGj
TLSH
T12D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9f0482131593c83cc47607f770cce9afd1d89536d6434b83b97d7b7751bad42e
MD5 e0e7828d60703d8fecff06f3b696f1a0
SHA1 c96fa63c5b00ff68de5bed193e491451f72c10a0
SHA512 9db64b628b7936b314dd84a2f39eef3f1dbed17259afd1759b2fbdd962e5a00b0731e29b2759acc85a73b6ef2cb876565df4b8dd8754b3668e7b549288702cc4
SSDEEP 24576:IG88u8FpJqH1bzria7/mCsqjnhMgeiCl7G0nehbGZpbD:r7ZFPqVea7/lDmg27RnWGj
TLSH
T12485016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3cda9751b9120d6f7ba46b282aa3fc718f4b4229d88a4944cc0d23f6f654a040
MD5 82395f574c1ef869bd3d24235f3c050b
SHA1 00aa59dcdc1f66a314222391e6ad4ff7c4b0863b
SHA512 d1d091751de4a7aac98836b1ae2acae817ec86bf06dacbd3d1132754c9a9d3545c9617766840fbd682457e2bc1e663b69ab5e224632cfdd3e969fba46d53144c
SSDEEP 12288:6HvUrBFrEjwaQmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:6PUr+NQmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C365F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 96ed978ad71ac80d27704d270a7f9b5b9c0b4de894ace315ff5dce437dec5557
MD5 07e3abce39e353619836e6ffaf7bba0c
SHA1 c1d8e7747e53c8eeed8f80a655d7ecbd456bddcd
SHA512 b219d8035d77488506d682a692e4808ff371f8e2ad5bd60969229046927f6dabb93d91c57a1002733edfc112cfb5a51f66326a8160b3fc1c797c7e61f88f9b9d
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaDmg27RnWGj:9G05lO43bnD527BWG
TLSH
T14AD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 793603b925ff96a0fa74b8078505dbda7f373c84de99c2280fb08e4143fbe220
MD5 f758b0b5a0d82b12dda5c124111b140b
SHA1 a62c509771d97a966ba8d44ec1bd62cbe20e6392
SHA512 892863936767904b88c593bffde0a94504b5e355bbba43f7dfcc0a616a8bd71c7704631858d028112b84eab89171abdfff50d1025451b085bf7f4131f6d5145d
SSDEEP 24576:1fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnYsqjnhMgeiCl7G0nehbGZpbD:Va5POZ3BJt2pasx2+miDmg27RnWGj
TLSH
T1F865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c2565fca78b3e31fbe8d16930520c880292ba7def72ad1c0b43c9f9de6f2a8a0
MD5 f4c4d22846a368a5643bb9b9c2ce6f66
SHA1 787af7c8decca03c6379b233bc1405aeaf9e1585
SHA512 89c05372245308f9a726b104f463cbba76253ab071439b961d3c56bb1dfc59856c98e16000396e0a6839d7d9b82216c833436af0e471b4e28e1544caf5b6540c
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7Fk6sqjnhMgeiCl7G0nehbGZpbD:XNc/zEOVHFFDmg27RnWGj
TLSH
T1C8857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 def3a30888093b8632e4efcc31799d45f4e2d04992d6671c64871ab25f29b60a
MD5 9784622ce87c08f40950ceaa3a40e683
SHA1 fea5192d483958f9723ae7b85c304deac8b631e6
SHA512 6fa88efea2e8ce6ade062f8046737ec3164236cb0354b6b6224ba9186953b4a2e7da268ab1b10d032806a8611ede888bbff6bc8aea47a876bd93a4605335f770
SSDEEP 24576:KTkNvNnaFeYhJNtmZBmksqjnhMgeiCl7G0nehbGZpbD:KTMwBtOmADmg27RnWGj
TLSH
T15255AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8d0e64b63fdaf6ffceeca6ba2cbaab63566d95284c12e910853ef3b35988a120
MD5 f7b2b80668b868107d76c5b163730725
SHA1 80299b94e9912cf58100b196b42b0035b60ea216
SHA512 f2ae2308c8b8e8e3af717502382bb181bd90de7082b94030135622df4f88ac368b9ff9b9f41e74518d8ef88129fbb8701b195667a2101364226401a7b44dec56
SSDEEP 24576:0D3FHshBIYQgAzsqjnhMgeiCl7G0nehbGZpbD:0DVHeBIAA3Dmg27RnWGj
TLSH
T1FD75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-87-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/404-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/404-81-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/404-320-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/404-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/404-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2200-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2200-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2200-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2200-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2208-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2208-113-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2208-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2848-301-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2848-72-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2848-66-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2848-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2972-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2972-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2972-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2972-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2972-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3096-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3096-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3096-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3096-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3096-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3428-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3428-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3428-45-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3428-49-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3428-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4548-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4548-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4548-306-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4548-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4548-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4548-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4760-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4760-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5484-119-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5484-127-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5484-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5484-125-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5484-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5652-286-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5652-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5652-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5652-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5844-76-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/5844-0-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5844-7-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5844-6-0x0000000140000000-0x0000000140426000-memory.dmp

Download