ba995da269f6a5b748baa059764991adae04a8c803614dc7d4344628c8a306a0

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.8MB
Sample260919-hs86bscf39
SHA256 ba995da269f6a5b748baa059764991adae04a8c803614dc7d4344628c8a306a0
MD5 4d6783118f7441ec6f9d514a08aff52c
SHA1 8d1af44d229e4d037a84a577a3462ccc65998d9d
SHA512 b4ebef0ea9054fe42792bd956f16dc617174554184e09ebf9f76a808763d26ebca8b2a56cff1922183c7a27588dbb4617b7e28b2627d9b2f737df1e4cdacd2b6
SSDEEP 49152:0tbIwL5D4Jc+b01tnAyB63TANQnMEu6Te8wT7HHk1HyB:mkPbiHV6ZukIB
TLSH
T15AD56C07B3F941ECF0AAE2B8D73156329EB2BC52CB34A5DF125416151E71AE05B38B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3384	elevation_service.exe
4796	elevation_service.exe
2988	maintenanceservice.exe
3564	OSE.EXE
4160	PerceptionSimulationService.exe
1704	perfhost.exe
1780	ReFsDedupSvc.exe
4536	SensorDataService.exe
3188	ssh-agent.exe
3696	AgentService.exe
3424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\66a5a8c73ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cff3cbb30448dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c97c9bf60448dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dacb2b40448dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b10bff60448dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7cc85b40448dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc40d1b30448dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc6266f60448dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3040	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3696	AgentService.exe
Token: SeBackupPrivilege	1780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1780	ReFsDedupSvc.exe
Token: 33	3424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3424	SearchIndexer.exe
Token: SeDebugPrivilege	2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2360	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3384	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2360	3040	2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	87
PID 3424 wrote to memory of 4196	3424	SearchIndexer.exe	99
PID 3424 wrote to memory of 772	3424	SearchIndexer.exe	100
PID 3424 wrote to memory of 1648	3424	SearchIndexer.exe	101
PID 3424 wrote to memory of 2888	3424	SearchIndexer.exe	102
PID 3424 wrote to memory of 1564	3424	SearchIndexer.exe	106
PID 3424 wrote to memory of 2920	3424	SearchIndexer.exe	107
PID 3424 wrote to memory of 1732	3424	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d4,0x1401ba6a0,0x1401ba6b0,0x1401ba6c0
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3564

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa341a88c6dbc0841b660f3ff1447a1a08915b6c4ee2be4c38a6ce767234aa08
MD5 0c511ab54947691214918626aed8bc51
SHA1 dabb991d7b790511866352f2d2ee7adb6e3033b7
SHA512 7ef6a023e130490c00e8856756500c29adce702ff4ee57191fe782a7a36c2d3613fab797434391b9229d0b7a0a28bbdc6e6e7344faf3a7043d2bdbcfe9c1df5d
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmHHk1HyB:v3q6HjB5kIB
TLSH
T16FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 862376a0e8bf1f0fd83bf116c90f28596a329ccceb890312dc2b30f67f3fdc23
MD5 a5bb6540f264e186221a1f2c08d7b5ac
SHA1 db3538fe163fab8d52a57d7bbe596577952d3ef6
SHA512 eec31b265a4e4a89d2284888b969e0a2950c9d30b374e1bcca85f353fa6aede28d24f896e8fc35e2b13116aceac14aca8f9c8f546a6612a4b3e32094160a2479
SSDEEP 12288:t1XLsswWkxy2lRq2czAu4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:DXYfDtczAByYHkP8ShemDk8laa4BC
TLSH
T10065012867E004F9EC67813DCDA2C501EB727C9547A0E79B03E499652F336E85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f0ffd5b820744417290bf2c2770dbe0cfb1deac9b7022b9cccc92f184b2810a8
MD5 0eafd9c5492128efd51e5a6a04a4bd8f
SHA1 49585704908c1c240349ca9b845d3abe5d27cf02
SHA512 ce8ef75ed2090d43837f4af7b95d911e7a10f882b2f3231288deffcc8c5d95887eb68963cdc631da11765907e52ec6c62b2b638fe2370e9a8685793a8641ca5b
SSDEEP 24576:/0Le5ji0hmxLrMeyYHkP8ShemDk8laa4BC:/Pji0AlPHHk1HyB
TLSH
T1B585AE66F6748335D073C0B9C5D2A68AED7130825B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c05d02caebaa4ff3f7989572852a6295115ed5cc401fb7c90ab81f8eb73aeae0
MD5 1416d1702d6accd34f2c6ce911d4b70a
SHA1 06c0b36df7083042f8cb929974d0eebc7000f0f7
SHA512 037d49613145f31645d1b55835638c62a12d0b36f43b9faa5414878f4562ed606dd31c973244861d0331927e98c65e716ce9be4f110cae6ec3daf4910857af43
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuAyYHkP8ShemDk8laa4BC:R/ezSC6vUzPvxHjyDHHk1HyB
TLSH
T116756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b958ccc6089c92b4cab3c63a452fdadc66514adca6844330ba792c7b854b94cb
MD5 141b0fe3261fd45ee6499aa4cf9e6e1d
SHA1 defac7f190ff1bd0603b13decee619317d75541f
SHA512 86ac72a0ce5ebbf5eeadeed7952dd6e28493a9b0761c9ff0e992120a0339cbc19c74a99fc9348428d6b3d0e0e3f4f7180efcca52bbb3f5143d22db929bd1927e
SSDEEP 24576:iVbqPb88hv/l+6tyYHkP8ShemDk8laa4BC:iVO88hXl+CHHk1HyB
TLSH
T15D559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e82274755fbeea797739c783b4917224afad89b8f88342ed3ece657be314186a
MD5 06d1a8c93a1c35eb466e7f7379338b78
SHA1 181e9df4e06b309153ba58264d82f724d4ec2235
SHA512 6423a3acb2dc33eda71b0fed6ab63b2a68bb9984e69015e17d7dc2be5827a3accece8c5e4e69b69778e20aa5e307e2cdf4a586bb0dd81c8606bdb26c7dc3008e
SSDEEP 12288:0zB4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:0zqyYHkP8ShemDk8laa4BC
TLSH
T1F45523E24F6411E6E906143B7FE5F0C19FA02CE48EF4051AA4913D80B974DF9ABB75B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f90ab51e7d4e9347f20506daf44887f11fc56495b272d8a8ce107e9bcfd9ce6a
MD5 1edde8454092e799a1cb9d95dab31ab3
SHA1 1075920b6622ff8ddfdae9e4d19baf5f528a7200
SHA512 02b616b318a8de34ec2dd6a3de292342938000a8615899804f39ff5b4138a17f9ee4ec925e7875f828efd2f9a7087666e1fc4905ec2480541b0d1cf5a5458aa9
SSDEEP 12288:0eBNUbTVO86UK4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:0JIUFyYHkP8ShemDk8laa4BC
TLSH
T1B375DF7BAE28FCE2C27A4D795B91C240D7B278704F61A3CBD165820DDE235E01E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 477312a851ce17d8c49a3267c0b99796a1019e5f6fa1fc927ec4728b1881309b
MD5 ffdb7150532def72a940fc1217b52737
SHA1 507dc903bb304e1ce62e1796a4639c5300b00d8f
SHA512 3e90035669af6989a9a85c68148af89892f4dfec5940686028a526bf9c5e9c7b41aa079790a553de90bf5ec1f4a0acbc85c4108e56bcb20e1762efe846ed35ea
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:SQvGAdlCEL8c/yRNw5COkIB
TLSH
T1B2267D656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ab392da062224ef9fb803a49df67906ea438dc4ee6256fedaca1931bb25d2d3a
MD5 97832ffd0b84e5affa8e9ead44c82a12
SHA1 6facd40f754e8a75dd03413a8578a7bf528bf5d5
SHA512 118d5ac0d98b51a8d0c492d253e15e91f2d6ab9bc7d73326f89cd7bf61c26be98944af6ae2a2e4a5c77f6a7c5c1bf0f7e60f174d281374e242434def869b47a6
SSDEEP 12288:OAwSfxL/2Dc39DLLmt0LDQewsAjE4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3m:zQewsAj/yYHkP8ShemDk8laa4BC
TLSH
T13C75E031FE74E036C67B0DB62B76D706586C79604FA11AC3E3E84E8D59302D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eba195fd625010d6c6924508f090ef1a21b1f487b37961d25dc09862e0f1c5f5
MD5 88d9fceb1c30373c41298f85e6e13a70
SHA1 e6e34fd793c6aa4bd793fcb7ed8cd43be853d530
SHA512 c4fb515d19fe8056673db1140693b4fd4ba5d14d228e146e8d24b2fc6211c7420ab740bafba1830aab87d819a3514933bf682868bdf115f49ce540386842406a
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHf:SUEtQevvqc2W1cpV2EI32
TLSH
T1CC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 697201e97840fba7996f479067eb160e7ebdd6df0d7d1a0ad305b837a294b404
MD5 204474ac515ec63387785e489e5fc3e4
SHA1 ca8e742eadd4b4eda01d5a9b5443a8108a5f6f4d
SHA512 547203b3b88b25d53b4836d5a14018532b6d3fd5dbf6b3a98c2d313b0c0205661e31a5aed1e8f33578cfb4b8b0cc90ba92778580b87dec9ba685cc70bfe7b680
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zfHHk1HyB:koquVjnmSkIB
TLSH
T19FD58D1976B8C2E4D1F6C77886A2C647F37178154B3197EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5b2cb056c2c0dc60ab158a55b8b097c502ec27f0b491db746c4d1b86f3bb892b
MD5 666766c9d25a2127e09b2c61c6ba72d2
SHA1 410d08b8c1cc7b9a889c536c6d059607972fdf9d
SHA512 727bbcbcdcaabd524dc5e4969e9386a0c0c7cc3af746c88bb55033235992d3c32d7978cd8e8a56ae5d85c19ef9bea43484bed4f468a3c51ad3f9d2a4475afd4c
SSDEEP 24576:aAhGLJIFoiwtA5l7S53EyYHkP8ShemDk8laa4BC:aAMyFoiq5UHHk1HyB
TLSH
T1B1359D81EBF951D4F5B3AA7899B69170EA76BCA65E31C20F2150D10F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2a9322f7c82ab3321d32be3ff0db059a162feade16e1f2a11b2581c2278cb92f
MD5 3d001e7c2297a57ed0e3c09ca1a57a5b
SHA1 38df8c4cc6400960aa5fd1a8d3d545eaada7fe00
SHA512 f62a3ba1a0df8cba71d486954619a8291441fb0f2be0a7d41048d425d6ad308b7209ef419804243de0d983c1dd85f4fc88e66c7c3d2601549a61396c31291980
SSDEEP 12288:2mw5HEjsChN2BFgl0WDm+C/4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:vwuHOWjyYHkP8ShemDk8laa4BC
TLSH
T1C765F18637A408F9E96741398A97D136F7F2BC512A71C71F13A0C6466F372617E2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 31f145b85e547b8c5b913c976ffb003e638ad100c5a8cbfe5f697a88c9f93d7a
MD5 eb3504eae73e8e9ffd9dcf5e97c61a67
SHA1 cb86f7a25a5253e670dcaa166f95678478ad1711
SHA512 5cc027fbf745e283ec911ace850779e3c4aec9d1a515fcb4fb315c1a26d8a9af69a8d5804c8000d85c403f0748b48c3ecef5b408d15eecabba62c4bbe9d419ab
SSDEEP 12288:zXZ1IyU4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:LZuWyYHkP8ShemDk8laa4BC
TLSH
T14055129A2BA420FAD453113EDEF19545DBB13CE25BB503CF11614A806F72EE52E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d38384c74b8878cd1eea9c6df3acb2c74f33182c73ac39337f946f09d78e8e72
MD5 ad5effc21b8b030ce0e4f41d181eb991
SHA1 9829b8ecf2cf344ad781c5418eb1ca6febb55b0d
SHA512 659f01fb7c4cc1127282fca80cc5441be0f791ba56e2a0027d35d70f95de492aa17272e5ae6e92ff9cb98376aeed90dd8644ec83dbae7106c5696a6adf2d84b9
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:2QRQyi36YOcPQLvw2gAf+PN3lkIB
TLSH
T1C0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4594b05504b6e172f4312355ab75c8e7b36926ae12da6882955016faf73c9b6b
MD5 d58f5dc80068597236119fb65c9ea26b
SHA1 8aafb4a07f22dc4c734f256b61c5b15f07dc059f
SHA512 863090eeb1d1a97395ecb07e580a3413264c02bdd3e285834d743dee7c61ba67431a9719e0cce7b432694c871cdeeb7297fea6e86e3324ec9ce76a367a93b339
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:kQRQyi36YOcPQLvw2gAf+PN3lkIB
TLSH
T108667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7aa4e3f355fa34fc61b5a39caac504d67dbbf7dbf1aeb4f0bc6971de5a03c069
MD5 ee07c9ad04d814b5bcea1f3318474a46
SHA1 bf73d53cc2fc3179bc3e8b5f00df38f146829bb9
SHA512 71c459d58cb5c31766612990cf0cef0b4672f6c6100e709bec70319af48fac0383f676262cc50b3ec03f22a71ed9be34ebea4d6a60c797cc33a8392e3291d5ed
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0myYHkP8ShemDk8N:K68Qg55nhheWu7PNU3/PHHk1HyB
TLSH
T1E7B55933B2F200A9C44DE1769F4A972196D27C758FE0E3DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e9b0583851252c9069c5d8fba8580214ad2fef2fd533e1822639374c84a88177
MD5 46bd88ca542e74f451df0736e43bbb84
SHA1 a4e8df81356b707dfab3511e15bd3a824124044c
SHA512 9dac6213afefc1f4d814134fb76f000ccb35ce517102288f55b037ce1910c57a3f14bd0b3c42427d1d71fe76f0a3c184fa46673dc7eb76f73f474ff3190a634c
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99h:0y5112gYy5azzVvL69nLKnhZ0kIB
TLSH
T190167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b3bfb75e8f1e4a1e8424e109b35a71ac2660c26a3f6e646eb2c4d312b95f7448
MD5 6a45f4dd52d552113d721333156664f5
SHA1 96de41b93f398c0def25cb8ea348a037a378edea
SHA512 5b5958a1965b696c076cba7d956448bdded06f8910b9c15558de73612c3bd1f27b48a9dd92e52da61aa535d05cefbdc847908b5003694c599f9b69f36ddb9f70
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVHHk1HyB:qu6JmVxd2dBkIB
TLSH
T1C6D59D13F1DA01E8D06ED479974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1969e251ccb5193d4052a53db1d1a5ba502a29a331fa3995e7d4fc9705f15d4a
MD5 7c758cc89b84a4034963576295d8afad
SHA1 8fb1b351387286499f2113892ef677ab2f6b00e9
SHA512 2214a6256ee0a669f095f5fa9e633aef82adf4208865e775b0978faf7bad37a69e3177500160a26e8d979e3a850b25ca59cd944c80329ef4b61d1e613782f96b
SSDEEP 49152:v1hpsNoJpF1A6UU44CwH7R4xlHHk1HyB:vmifPbRSkIB
TLSH
T1A0B5BE13F2D901E8D05ED17887569232EA62BC450B34B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1516da23b3869511d9f5fdafafe92c343d7b3f68de095ca1e90905b166af12f1
MD5 9b58ffd07e279a14a0813e40bd31faa3
SHA1 630b139b27aab03fa26240c3da94eb5dc0940189
SHA512 e641312f29f924a7158cc0e29dd3aa90b2f747b03313fa5644291a3f77cc72bd3e492bfd1a9a14450492b120b8a2c9623ef15962e3c56565d23ad27c1cd40898
SSDEEP 49152:gSuZQIY0Be2KRRVtOnks6NMHqWHHk1HyB:65dKTi61gkIB
TLSH
T124C5BF13F2E901E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1e4a9c0ae7289d33005faa767a3528d12c60b2e596d49cdae7399767253beb34
MD5 2d5e86734a8454ab92e098a01c27bf46
SHA1 cd395e5062b6775b0b08e6c82b9a44a34550d932
SHA512 61242484e76b7b057a52f267f6ccf389a711112544f5e31ed764c8e2adfab96656c854ec5c897c964f36bee1196160282866f1d49be0131d66bad173fe0ae3de
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wBHHk1HyB:hX2iyphmkIB
TLSH
T1F695BE13F2D900E8D05ED179C7568632EA62BC150B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a2cf3aa318bf4877aedf54bb16e974f615e88d2b7ecc6e5cfdff40690977b29b
MD5 12c4a8c5df26b4f1dac7a4d764f9970c
SHA1 cf1a19590ace66de2a6a2c486cb06decdd66a873
SHA512 d7e362aa1346875027c21d2da0df130573807c32555bb361f00ec859acc96fc4a25f6523672ea096c5bad5472a7c560619e3c43cc4477ebda32b16062d751620
SSDEEP 12288:YJ4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:YCyYHkP8ShemDk8laa4BC
TLSH
T1B55523E54E6512DBD802153BAFE1F1C4DAA02CE5AFF5011EB4822C40BA74DF92BB75B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 00fef8eb2edb1fe08de74c0a013cbed67a3c28d255fedb09a7fe80b642c054ef
MD5 0ca2dcf52465d35521db08890ea72148
SHA1 46498337b801e5dbeec20f932b0b001721e1616a
SHA512 b5ba200a370919175628a15b22faad99a2b79a2a9c652074ed776b1c2be5529d986a179bbade5b866f47d9d2640e0f6f978661173e145e37ebae52945e73f2a9
SSDEEP 12288:d44gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:dLyYHkP8ShemDk8laa4BC
TLSH
T19C5523E54E6512DBD806143BAFE1F0C4DAA02CE5AFF5011AB4826C40BA74DF92BB75B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 66ac61eac1eb2bc01e8268ca59515cc852bcb6466f49dfc0ce618cbffc41ab98
MD5 fc870cce7b61409aecdcd95fdd007ab1
SHA1 1a4b5233c7745271679066080d62bec2a99051b4
SHA512 c29a2e930c39df11e2b597df77bad8c6ac326877019f2d5ca46b419e54a20b3f7ab1b2da6e3c574c2132fd8d6faf221c80530ed7b4db89a516aa3292bd4207f6
SSDEEP 12288:JS4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:J9yYHkP8ShemDk8laa4BC
TLSH
T1DF5523E54E6511DBD806143BAFE1E1C4DEA02CE9AFF5011AB4822C40BA74DF92BB75F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 45f7f45bb30b433d668d0ce0d44dde02adf83644e2c8ed532449277e499a8f81
MD5 94cda7f0d1742c4373e28aaa7cd3c8a1
SHA1 951f996912189766215b64a833b20e461a7c74fd
SHA512 cc4c2cc6b4d72145d7b126645d48cfdff3ea8d6b7a09749149a6599f789ef5fc97ed0bb9a3970e1bb27c736f9cbef850fd2efc40484fcef4abc82c85f9897484
SSDEEP 12288:rVb4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:GyYHkP8ShemDk8laa4BC
TLSH
T1F15523A21F6501D6D802513AEFF1E081EBB07CE59FB5025FA5811C807E71AF92F76AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 96024659d3c565f83b9696adbbdbb6c7c52b1bd5719dfe9fee0cce6cc137b9d2
MD5 ad68c81e6c6fc25e43f87e1ad93a70ae
SHA1 7d3dca8d8c4a2e0046941419554b5d5db0704061
SHA512 f66aec5d89281b50b52402787e9f507d073095668b19d35b7c0a6284f7d39204ed52e9c246ac7acf368875a377edf24795d500a1289fceb924e97f7cb4442a30
SSDEEP 12288:oT4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:osyYHkP8ShemDk8laa4BC
TLSH
T1B45523E64E6511DAD806143BAFE1E1C4DEA02CE5AFF5011EB4822C40BA74DF92BB75F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 46db26c851dcf0377416f331895df91ff9c8cce85583d48967a8606f8e15b727
MD5 b352995d5c740a18afe4d616800c6786
SHA1 32ae86af874c3d06a8c743c5b096bea958c16edf
SHA512 af55d0a9f5328d8a1d5a91a729d6328254a93aba5378f44bfd8788bf3c6960632a5584074e4db04e98ed170b7fd161168ecb3c40d5479963a8931ae4a25ae400
SSDEEP 12288:bs4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:bXyYHkP8ShemDk8laa4BC
TLSH
T1F25523E54E6512DBD806143BAFE1F0C4DAA02CE5AFF5011EB4826C40BA74DF92BB75B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 108a31a4e4e7729cf6f125771e6724c7439586b43ed4f0dde4701e5d7146d748
MD5 b160d7fc6c878275119c0a663576d4ac
SHA1 c5aff62308f0c4836061e10585bff2bffec73608
SHA512 48a1aae262f56d19fee74d9e1fb19ab4aebb20c3222d4eca709e98881ddf828d5e9f2abf05fa54b77f579a1d2ae3ca026256479b461db6064ef28526dd9bd077
SSDEEP 12288:mw4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:mzyYHkP8ShemDk8laa4BC
TLSH
T1EA5523E54E6512DBD806143BAFE1F0C4DAA02CE5AFF5011EB4826C40BA74DF92B779B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f733cfba6f99ca52f4275731059183deebaf6f0a9da08131993fe4c6728c5822
MD5 a95be61950e43b11c5837d6c3175997e
SHA1 82c94ade0698772065bb371a3d1025a3bfbe2331
SHA512 ef31554352457eddb23b95895c8641b56fc4b8a93851bea5d7ed3e74642c3bb0bb1e014ba51be3046cc93899cd1bc737760017fa67a302ef62f6d1e2f52f9c33
SSDEEP 12288:9iZwbDzzFEoS2cPvyY4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:AZM3zFVSOryYHkP8ShemDk8laa4BC
TLSH
T12A7502A5736018F8EC63413ECD659905D6B27CA90BB0C61F13E43A566F333A11D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c98c986003488f39dd22c3041dceef3ffd003a161970408736d850ba954bd251
MD5 a46d26c8afca878197d5cf6b4ffc07cb
SHA1 acd3b366284fd0b8696094632fb3802d7223c56b
SHA512 cb7c3a9253ee9d75dc2d0808bc58942c4b2afee8802351dffc696596b0485eb512dbb12b3ba6f42e5c43e27ef1362f8fcf759ff6bd1d8049e477975e04a19cc3
SSDEEP 12288:XV4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:XGyYHkP8ShemDk8laa4BC
TLSH
T1005523E64E6511DAD806143BAFE1E1C4DEA02CE9AFF5011AB4822C40BA74DF92B775F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1874708dab1dd45a2a1a4851d21f7e5e90d3b6979c0270bf8dac2b3a8e141c84
MD5 a72603d86ea419dc1dc5bc34879a1c8b
SHA1 5308b2599ef7a613b98f98dda1a4b5190c9e3d7b
SHA512 3efd9589935bbcf7d4c1330101679e7b3343e5033db29c2e5e4a292ff8142eeb042873d13c1cd6d0e7ee6623d53226218a135d8bf2fefacb97a27e97f5d8452e
SSDEEP 12288:hR4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:hayYHkP8ShemDk8laa4BC
TLSH
T1695523E64E6511DAD806143BAFE1F0C4DEA02CE5AFF5011EB4826C40BA74DF92BB75B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f000d56b1ac53437d400772c2875bdfc1ce72e1a5aa220e0b8fb7259365c6069
MD5 f02fdcfe5f9ba63af9ce78e1b2e1028b
SHA1 059e5191426edce5f287ff575f05bcdd9048335b
SHA512 2ad7ece903a970cf2aba23b1917b1d3580c0b87ee6e46ab97796a79fb25a3764489d3e11eea29fd723b0d82162d7a5e9ecc2d66f068bc5b8f915c5242e08dc72
SSDEEP 12288:7yPz5L8U4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:2zyvyYHkP8ShemDk8laa4BC
TLSH
T19865125727A130F9D4275139CDA25A41F7B17CB64B704AAF52A00A623F336E16E3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ace9d97edde89fa7b13d6db17e6cbaefaa474664e479d52e786c32f3dbb95381
MD5 975baca825a6d13a20e59801f2cd50b6
SHA1 3d58c55ca829768dc7475edee401a57b3b90c6eb
SHA512 afd3329ca1516f856c0e5c2b2d8a3a3d6fa64c89022cade60dd247cb8baf4b32b81ceac786230b77d4a8210a80bc6d2cb2ec732684040c12584cf6b166a5842b
SSDEEP 12288:kV4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:kGyYHkP8ShemDk8laa4BC
TLSH
T1275523E64E6511DAD806143BAFE1F1C4DEA02CE9AFF5011AB4822C40BA74DF92B775F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4ee9281e16fe1862dc90e987b27c533f1d4b992b37c406ebc43147ff6f87fa44
MD5 eff9c73e4c298f3ea17bcacac76fac74
SHA1 72204bed7bff8a3bd83b024112ae8382d964776c
SHA512 b07b4521432fef00131acf9fcf10a330bf154800ddba29b54ddebf4a30d10bbc23d93525a748a7a0beb3ebb77e438b881d24fbbac088d6e56e92cab372a5dc09
SSDEEP 12288:UV4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:UGyYHkP8ShemDk8laa4BC
TLSH
T1A45523E64E6511DAD806143BAFE1F1C4DEA02CE9AFF5011AB4822C40BA74DF92B775F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0108631f2e39130132539698fa195e7b2a8ac7bbdcd7a07318e8522088f382ae
MD5 3173c765d0510ce3fa3fe3d20351cda1
SHA1 a91a6812e21e65aee526a784f1cbf1fde6eff359
SHA512 0a71491ccf0742dca51d982d946c818375842a228369ea01df695bc2c83c225ab42def5d46cf391f9183cf4aba312ce294bdcb3d2a076bf23c294321bcc60a6c
SSDEEP 12288:qyPz5L8U4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:3zyvyYHkP8ShemDk8laa4BC
TLSH
T1E365125767A130F9D4275139CDA25A41F7B17CB64B704AAF52A00A623F336E06E3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b99a4a74cdd9f2457313f92293cb985559248ffda88acf97886212ac50d2176e
MD5 881360cf9ff0fbce8e0f2053addf98b9
SHA1 cfaa1440dd449d3129b412c0036fc3e404c9dc97
SHA512 7ea0024eb2cc0ddbf2f4b6636af4ae3f211dc42b411f031411ba7377431ac6d540d7078bd26ee4eaab11e3856b054dcdf5433b2a0bb8e377bcd401f44003b07d
SSDEEP 12288:rCd9NWYoaLHF3z0z04PDvhC4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:GT0aLl3z0zDNyYHkP8ShemDk8laa4BC
TLSH
T1AE7502A4735018F8DC67413ECD659906D6B27CAA0BB0C61F13E43A566F333A11D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 fc7b0ba08426ce4324d79e66b24540f4d3ed1f569227efc6c5b888b10d942f88
MD5 22bbbb1a8d16e3be32f7a8a4169d5e8b
SHA1 445d9590ca4e631f818eb5aa73eaf2fffdc976bb
SHA512 ef2cf6ad536d076e89b1110b204d8f5178c64b451bff4131d715e17259256c30cf81c09a19c06bb29506f123d8913d6f2de0d8000a9299ddfbe9264a3e13c08f
SSDEEP 24576:231d9CHKy7GZ5yYHkP8ShemDk8laa4BC:Y1d9CHKyaHHHk1HyB
TLSH
T1F685CF90F7E410E8F0B79A358D769501DAB67C991B71CA8F03A425591F33AE18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2a8095645b770615afe412dff7f11cad45ba456d18984e68631a81e268a13e28
MD5 db5f7527832fcae94cf468291b25da59
SHA1 afc2ba9176e410e3c922a696d79a4aac4c4e1cc9
SHA512 04eff5234251953272708c6fdd6cd32ae988a0725d6f3f21a1db3a682d05343f735fc06ae2051c4161f42446b9bfc6d0e15fc63b02131a01669f3cc25a8d3c8a
SSDEEP 12288:2y4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:2dyYHkP8ShemDk8laa4BC
TLSH
T1815523E54E6511DAD806143BAFE1F1C4DEA02CE5AFF5011AB4822C40BA74DF92BB75F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 67705f8056e1aefdbd1010518e932699027559826bd376ccace0c54dd4591121
MD5 fd8c5093aa2054ed2666b72e8057b568
SHA1 0d2329b9affc056db5a929c3a05695175038d51e
SHA512 90cfe301ba1c87c286774550aa012acb8af54aff1928b5551c55191d55832c45c0d13a3d0de89830ca30086f820bfeb99c5bb57aa6a7a63cef7c2410101f7798
SSDEEP 12288:e04gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:ePyYHkP8ShemDk8laa4BC
TLSH
T1705523E54F6511EBD806143BAFE5E1C0DEA02CE5AFF5011AB4822C40BA74DF92B775B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d85ba2cba403283ca95855e2291273640fadb505d19e39bfc72f59be7c9de5c4
MD5 b328af6aa94d504f059d4c3fb30a7ed1
SHA1 f7a616d8f67df47c265c5c86a15e8b8754e1a8d1
SHA512 6fb880801239d9638a6eb0087120b9cc51679053aa4cbf37d89515c60123953095f919380edd164d85e77289c7095a38a692822fabc222912ba7faf9dac958ca
SSDEEP 12288:m34gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:moyYHkP8ShemDk8laa4BC
TLSH
T10D5523E64E6511DAD806143BAFE1E1C4DEA02CE9AFF5011EB4822C40BA74DF92B775F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 07a51ed760cf08598702fe565fd059811c9a699379b2023e8bcd9db6515ef6c4
MD5 eb11f904d6d1e2577e4e6c7af6211074
SHA1 cdc7ef69cfb08623e6e2adf6c180cd85d4d7e692
SHA512 71f9d835d0cc0597b99e3a3f426185bda4af5008c2829e60a68b1562cbe5f93841373451ab5c5b5c2b66bb45ce2255c605689508e32bb900fb4ba8ed9047985d
SSDEEP 12288:xV4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:xGyYHkP8ShemDk8laa4BC
TLSH
T19B5523E64E6511DAD806143BAFE1F1C4DEA02CE9AFF5011AB4822C40BA74DF92B775F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1018efd6560e59d862b022b3dd98af6a2178ae5c10cfda11c6b0cd3adb5c5742
MD5 075980117f8ff0ede26fcd8ce10db7a7
SHA1 0dfb9972b940c309596632964c573b1240995164
SHA512 7c75bc2183f29098bb6b43d005ac80ae217a53c2ca0643f00e5b245c10c9dd0f20c0814160ee3abbb86c99c5300789fcc897db7e45ff0733561aa776d7606120
SSDEEP 12288:oy4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:odyYHkP8ShemDk8laa4BC
TLSH
T14A5523E64E6511DAD806143BAFE1E1C4DEA02CE5AFF5011EB4822C40BA74DF92BB75F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1505cdfdcbd596c971798f80ac710ca01b3b62fbfc7055f4d7b28dbbe307984a
MD5 78c21eb5209d88a975ff3f0aeb577e84
SHA1 61f7d6a37ba566791f93df8acf614ec73941b43d
SHA512 be59274ee822aa3774705df4657267d9928b2504ee2617ac03ad518457abddfff21cbe79b82f9dde2db5ed57a107df2a4f22f67b7f06791a775bfdf4bfe468b1
SSDEEP 12288:nN4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:nuyYHkP8ShemDk8laa4BC
TLSH
T1C35523E54E6512DAD806143BAFE1F1C0DEA02CE5AFF5011EB4826C40BA74DF92B775B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1985d9ccaba69fb1a31fa1e6595dcafd588c599bc85ffd71dc907d76dc1c72e6
MD5 c1664c45c594926b9413b87a8217b441
SHA1 4d2ae2402b93b2965c3b4823a5f21d613fa9e01f
SHA512 f2ec2e5fde78545028fdbad8db076dced33b22d6a4c68db9f5fc47de857398bb61b2e406a2b22ff8ffb143c8853a58f06566e4dfb8d51b50e8a9891de798348e
SSDEEP 24576:afwv/k9RX6wkyAIKyYHkP8ShemDk8laa4BC:xMnYIKHHk1HyB
TLSH
T11B85C029EBD804E5E077913C9DB3460AF6B178691B31C2CF129A536D1E37EE45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0bc6064d0c8c7c70479db3035540c884dbcb1d728e9a0189fffe2317c55def42
MD5 449a1c6a4a2708e8845f020721553875
SHA1 0bfcd1ad326f2cbdf1ce8262106c38e011049dbf
SHA512 24660c2db29a8461742fea64063b9a3e91195b66406922d57f1b81fcf8b0f2b295040ed1da0ed7dda49ccb05d2eea1c978f3a29cb1c20f5b8aa9b06226c04832
SSDEEP 49152:3YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hHHk1HyB:TySzPFkIB
TLSH
T14D066C96A16801D5C1B9C1B98F1BCC1BFBB134490335ABEB02E556835F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2859c4487500e5dd07d31c1b8e9509f2fb5c304daed1a90549a75319b95c6149
MD5 c979eb4329573ff6933a067947f78439
SHA1 b322052f589638bcaec08ebd762e8932af16a1c9
SHA512 6ccb4b8c4150ed53799cc296beab26351212340ea7232b9d930aea0c452e5267871eda0994d3a23c9b1970d1aef9d2fd9b4e75feb7b5d3642f7f15377b695d49
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYbyYHkP8ShemDk8laa4BC:+47JUQj1irIhCnDHUPfF/RHHk1HyB
TLSH
T11F65AE1EA3EC01E5E1BA923885558A5AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1e0e05b9b8f21f4c7699a9f99fff11c34f898f16f50a1a9992b42fb27a1a7751
MD5 4e7684658c1bbfb1f1dd1605e17a50af
SHA1 0fb9683c38f87f080de73c3f4a7a14d56c8863a2
SHA512 e7735e834fc26ab704272547e36793cd6c2d06c12916674a0e13bc34d085252541b4dd69d3bccda9bf3bf734bac454480ceb35b0919ba022836a34c2acd75aaf
SSDEEP 12288:3ssfF4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:7WyYHkP8ShemDk8laa4BC
TLSH
T15B65F159C65402E9C05E213ACB919680F7733CA58BF193CB62C0F83D2F75AE45EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 49dd8d2c2f5e583e4fbcb1c0b552d26b1363bf03408f66d0c30b9f895f8f16f4
MD5 e53c8dc7abab4acc447924ce82397fb5
SHA1 326ac4e74b1df3ade4aa77f13f2ceb0ac2323752
SHA512 47bb17341954d7ee612933bc7811d3f231a2c2292b9806b1f813d9ea8e9c961edfa25b31144dd03761fcbd668a0a42fdb55d6be3c15ecccc9a36a9c393ad16ba
SSDEEP 12288:pPCDqcTU3fkvlpzHlY8ig1pAQLaRdG2bFwIXqzA:pPgqWUPkzl1pAQLaRdG2hwIXqzA
TLSH
T1F23518007626DB4FC5A950321E76C6CCAB70BD02FE099B1772CA473FD476659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 42ae9d2e0aea393ace00cb5f8afc072c586464829b4ca9780b1524b940436511
MD5 6531afc6e083d92622d085ae7683baa5
SHA1 044fb4c5990243f84afc89383a8e8c315f0da57e
SHA512 a46ad3825d36e7aa8250442339d92cd578b3f1a0ae07b618cf9923fa91931aeb47f83ef8fdd0284fedc9f48e55ff6cf45d675f699ce164ae7ecf9db67196f687
SSDEEP 12288:A2IGFKeMCs5hgXRkIJE760sFOQELbZDd2qXjnoXjQWXjQdXjQ9XjYFXDZ+uFXjQt:VIaAhI+mobNbZDqrGt
TLSH
T13E654B415477DB4FC9AD8037073296CCAB78AC02FB493F05738589399876A5EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66a5a8c73ebf6fe8.bin

Path C:\Users\Admin\AppData\Roaming\66a5a8c73ebf6fe8.bin
Size 12KB
SHA256 8f5edbfa05d28a974abb40b8c100a4a39391673875c74e1f33956e70f13c50f0
MD5 2b7d11aced8ff7377231a23a245be56c
SHA1 c17c922b9db72da877510de496395ff91f89bae8
SHA512 b447aa0f590d1749672625259bee244ee236bbacaaabaee9f132681479252e23a6ebef6ad1d6c65cce08ec20939562fce1074160d4fe7f508277ec6d7799c844
SSDEEP 384:ouc8WwiPLPX6tz69REKbt6O8Q+/H8x99P5i:tc8TcIexfJ4S97i
TLSH
T19A42B02C98E3B61AF4092987E540FD1115CEF33980B96F2648B45B37172E5D34AD293C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d2b6edb84772f8e69876c9f59c82279d83e56821138ea4ff0340d79d8b4d70cd
MD5 6f62bb07d0fd8ec7d3889a0e899c173d
SHA1 b90779a54acf5a43af9d90506519f5cb8b05e438
SHA512 82b6ba4d6fb6d3eb90c9bfe267bf7e42ada17acf5358b6f24c1e259d354f0f50074192e9a1c9640de6106d5a88397764f0d3bcd586156692a3a81327fa9b8985
SSDEEP 12288:zC794gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:a+yYHkP8ShemDk8laa4BC
TLSH
T1A25523E24F681197EC16153A6FE5E090AB643CF48FE400DBF4412D80BA74DF96F76662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 57c0d55b0673244aaf9453992ae8ae433b72ed1a62f0442844798042cfea728b
MD5 eb3b231f88058cca09b46d36fbe521e0
SHA1 8d553e4927d647763e4dac903ee5cf3bec9cfcfb
SHA512 7b493b77a09e6f7e2f2ac4fbfca01f5fcb62f6857cfedf57f05ecbdd29a864b83721a158d44299157776037ac491703d730c8ade18fa6a03ab9242489ece3971
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYAyYHkP8ShemDk8laa4BC:Cgb4mBIBhGFbHHk1HyB
TLSH
T1F165AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5a8ba4ea0fa3dd244a983bd8b7f996b54ece9d2fa9994b9c1f3af6a07227fb2a
MD5 ea8787b1bfff29c2b4e33736f756dec5
SHA1 40614362a505e44b6b2e5cdc1ba7405118a8428c
SHA512 cf645bb6cdeb5284b22e4e81c3652335f62d0f9f506421fcb570cf06ef0cb42d4b77657438db5be6150ac83686fca2e0244570025d44024ba3ba662657928479
SSDEEP 24576:PG88u8FpJqH1Qzria7/mryYHkP8ShemDk8laa4BC:+7ZFPqVva7/IHHk1HyB
TLSH
T11385F16567E101F1D477D1388E9686A3F6B1B8250374EBDF06A88A411F33AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 29b812fc95f68e3d98fee0b7b7653a1ee7e1d7e829fad27605764107349c8bc1
MD5 6a13f559868aedb34b8bc756c92449bf
SHA1 79cf78095c0a8c7dd4365f891a997d479e35dca3
SHA512 24ada986c890424b9575476dbead51c848f9d1d04efbdd22cc1a66ae1d71c7d801221dbacb9e0f027ae8aefe7f96f937da11dbf9e21f63f0880d81b4293b04ce
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXHHk1HyB:4G05lO43bMkIB
TLSH
T168D5C06A62EC11F9D0BBD17CDAC6860BEBB23815033556CF02A486A91F27FF4557E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2277a7eb2658db02d6db89632480321531b0add3a229408db2ca6b2bbd195045
MD5 efcd0a16d4befbcba571411d79a644d6
SHA1 6b3edbbdcc76a6157712b9ff8c5590ea84b6c43a
SHA512 e31798279ccecc9039692e21bd3606f6a7d6d632b883325f5ab7e79d718d63042131b05b4cb318be05d82cd9f8d9f93e31238d222eea100f5944d57d04bfe69e
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhyYHkP8ShemDk8laa4BC:ea5POZ3+Jt2pasx2+mPHHk1HyB
TLSH
T13E65BF5EA7F801D5D579D17DC683860AE5B1346253329ACF012182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b3e3574044865aa35b3e531cc62e4b947e40478111575d51ea6722553a125ce6
MD5 78c0169475ab3ba8270252100d75b1f6
SHA1 ac634fcdc717ccee568cc1e54f50a7cadefb6351
SHA512 4035f025b1c65b448ef8df52f865bf73a78834ea5083b84ed4f85d55861ea21983a5baea76dbb47201659df4f5ef819c01f37e7dbf925fb23cee91bd49b7267e
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkDyYHkP8ShemDk8laa4BC:wNc/zEOVHFoHHk1HyB
TLSH
T166858C2623E901E4F1BBE1BE89779546FAB17865173086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c2bafdff4ce1006f15032a474f1c9a9d0f452e8be874cd99e2a698a73e2e2080
MD5 cbaaa9211147c35d227f5a921ad5b40a
SHA1 05218e36fb74aa88bdf33d57f98b2fecfd9dd9a6
SHA512 8ed91b46ba5d47a8e9aa42c32bd198c406f44eee4fca779676d9dab7577a5294b23863e389a5faa22cb9209f8d86b50618f1737ddf5cfa8df56ef29f0ee3f722
SSDEEP 24576:y8kNvNnaFeYhJNtmZBm5yYHkP8ShemDk8laa4BC:y8MwBtOm5HHk1HyB
TLSH
T1E455AF6EBAB806E4D1FEC675CD238512EA727861073253CF5290C13E1E279D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6f80f7f99dc65ecab66c98d2d68ef27884362672861b249014a7a2cca5b15f9f
MD5 a3f6d9c0b288bcc7ee88391db1cba0b3
SHA1 1e3a2e5d6aa527379b2a0e082cfce5aa4ec19126
SHA512 ac55df68620a8329e7d70408d22a07e68696de0d077196b6a3fd6de68b34e118fd3854652d399f2f8dc075fd5a3d6797145474f26bc97a49f5005b2f525296b6
SSDEEP 12288:rHvUrBFrEjwaQ84gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:rPUr+NQHyYHkP8ShemDk8laa4BC
TLSH
T15065F26F26AC18E5E576A13D8A828709F77178A2075192CF01D0817E5F77EE87D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8849e41e985c36ad913d8f90f2a933280e80615bb7f92e07bc4215cbd0fb85d3
MD5 d8dd353e86a6ae9100d45b23facd000c
SHA1 0ed9961d36765375b8866c6e858f9ce15b2a9ee0
SHA512 5632c9876f53a4006bb419edd7226fdb723c7a6207cdb14bd4b73f737a63a5de97e5f532b7081d4e7464134ca37b66ae1135ebc52166202ab31da0e6b456ab51
SSDEEP 24576:0D3FHshBIYQgAiyYHkP8ShemDk8laa4BC:0DVHeBIAAiHHk1HyB
TLSH
T19475E17EEA9C00E4E47BD17CDAA38606E77138A9072255CB11D081B56F6BEE43D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1704-93-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1704-319-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1780-338-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1780-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1780-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1780-103-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1780-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1780-97-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2360-21-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2360-108-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/2360-12-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/2360-14-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2360-20-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2888-337-0x000001D4531B0000-0x000001D453830000-memory.dmp

Download

memory/2888-404-0x000001D4531B0000-0x000001D453830000-memory.dmp

Download

memory/2988-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2988-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2988-55-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2988-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2988-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3040-26-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3040-0-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/3040-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3040-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3040-36-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/3040-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3188-121-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3188-325-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3188-123-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3188-129-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3384-134-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-38-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3384-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-30-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3384-37-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3424-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3424-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3424-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3424-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3564-303-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3564-71-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3564-70-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3564-77-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3696-144-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3696-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3696-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3696-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3696-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4160-83-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4160-89-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4160-317-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4160-81-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4536-116-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4536-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4536-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4536-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4536-322-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4536-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4796-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4796-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4796-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4796-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download