06a3dc155fa36e7fe86dc79a0de10d8e6356ac8090f5ee169c0fc6bfaceb946e

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.8MB
Sample260925-xbpspatfra
SHA256 06a3dc155fa36e7fe86dc79a0de10d8e6356ac8090f5ee169c0fc6bfaceb946e
MD5 dd5a87003b674fd524199098313e6dd9
SHA1 2b0dfe0b8d35db5046f0c6d407bb6878ee9099f0
SHA512 7183df104f353b8c1969d1cf894950582578181e738dc748ed2fe1cb297caab18a289167c0c2ea075585e04c720a97b06485e8f4fc57dacc3e6c6a02959a4007
SSDEEP 49152:wtbIwL5D4Jc+b01tnAyB63TANQnMEx6Te8wTjgFIDRRAubt5M:CkPbiHW6ZzUf
TLSH
T18FD56C07B3F941ECF0AAE2B8D73156329EB2BC52CB34A5DF125416151E71AE05B38B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2624	elevation_service.exe
2604	elevation_service.exe
4552	maintenanceservice.exe
3552	OSE.EXE
4956	PerceptionSimulationService.exe
5432	perfhost.exe
4204	ReFsDedupSvc.exe
1512	SensorDataService.exe
3628	ssh-agent.exe
420	AgentService.exe
2752	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
	\??\F:\	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dfa2c0e07465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c4935731d4ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fc320741d4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fb3a8751d4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000508198751d4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000037b5fb61d4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce981c731d4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bc48b731d4ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5012	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	420	AgentService.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: 33	2752	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2752	SearchIndexer.exe
Token: SeDebugPrivilege	3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3320	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2624	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3320	5012	2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	88
PID 2752 wrote to memory of 5500	2752	SearchIndexer.exe	100
PID 2752 wrote to memory of 2016	2752	SearchIndexer.exe	101
PID 2752 wrote to memory of 920	2752	SearchIndexer.exe	102
PID 2752 wrote to memory of 4164	2752	SearchIndexer.exe	103
PID 2752 wrote to memory of 3304	2752	SearchIndexer.exe	105
PID 2752 wrote to memory of 3032	2752	SearchIndexer.exe	106
PID 2752 wrote to memory of 4764	2752	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-25_dd5a87003b674fd524199098313e6dd9_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x2d4,0x2d8,0x2dc,0x2d0,0x2e0,0x1401ba6a0,0x1401ba6b0,0x1401ba6c0
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1512

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3628

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2868 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2908 2904 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2868 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2908 2904 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b06106d9d1e77f0d7cafce9c64609d4ddf817926156316c9c56b254883c4ab04
MD5 0fd872ef8de7805140ac1bc6c7c70966
SHA1 75c6cd0de391bba700332e4ec181d870833cac8f
SHA512 94c4f103483332de5a2de7ad60b5041b9e33064b9b8b6f1efd4159c900574677f26476c0e6f596355b4f488681e2616896ae8700ea230dc8ddd0cd06bc2fe269
SSDEEP 49152:bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnpgFIDRRAubt5M:p3q6sjBtUf
TLSH
T179D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 74e5c9e37b4a3b94bb356545053e58e8d8391b9908d185fc4eed915f88bc8fd5
MD5 db569d3d747253bf98b6c1f06192519c
SHA1 d7ccda309ecdb25f6c16705613be60b53c94bc04
SHA512 dc58012f0b3a669c8c00ab4ddac58e32fd8f7a3758849fb031e2e43c690f2aebcdc7e3c118e66bf0d8e866220b7dc4335528a101dd1cc2a93a545e80df48216e
SSDEEP 24576:8XYfDtczAUVg9N9JMlDlfjRiVuVsWt5MJMs:7tc/gFIDRRAubt5M
TLSH
T1F285F12873D409F9ED678279C9B28601DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2e286a4f10a2e28e70a1e88ef176d9c25cd9c733a7c03e4c1074161cf8a0f6dc
MD5 5c91e7872197970ba2334fb3556ff335
SHA1 44486f7f85a9f4326d92fc29bab92497691f58e9
SHA512 5f81bcfd0e8e8761be646d8d3e935ae12569daab9b1296e90a8970a9edc2d19967f2939a0d6cd2a3fba9af8d3021a0a5fc4a17fa5d4355bd78fbaff2a27f0950
SSDEEP 24576:Z0Le5ji0hmx7rMzVg9N9JMlDlfjRiVuVsWt5MJMs:ZPji0A5mgFIDRRAubt5M
TLSH
T1C9959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2801b6546d4dd9e5ee9f5b3d527f18071150634575cdb979e2f974778ddc180b
MD5 0ff641dc35f6e9c2d09962ddcd1f7e79
SHA1 c3ba56d04111f14c1e7db4684c7b301f9f852e85
SHA512 da9fe428aec64453c5f53696ff662b1f7c96d8338ac1872976fe81732e82016232c74775a1f7f754beefb60c44b5efa873d5cec1789ae2cd7c1fe027f24ff277
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWn6q8wyu1Vg9N9JMlDlfjRiVuVsWt5MJMs:5/ezSC6vUzPveHjyqgFIDRRAubt5M
TLSH
T185755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 87540e167e1b1d6b93cf9b6af40234bcc3249535389ed5d65f0c877ffa08a7df
MD5 05161a70ecbe7906e7a4c5af857dae91
SHA1 03d92024726bee461b6458e170bd3381ee30deb4
SHA512 a712f1ed55daf62610a62b31a2de55ecc6514b7459f54ef54e2ffea3c3c508220c7a4a0d1f15df7e667e9818a5b245d687ef0fb8c0f3f6c5309470cc3c878738
SSDEEP 24576:bVbqPb88hv/l+YAVg9N9JMlDlfjRiVuVsWt5MJMs:bVO88hXl+3gFIDRRAubt5M
TLSH
T137559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3dbbeb4d2f209936e60fb40d01706b13d2815211450dad95688c20e4518052a8
MD5 de23975404576e763959ac8a7e73b67e
SHA1 d9d43c224a260212809c208d35a6e734f0680033
SHA512 1fcdd9d10b7d6302de285865f9a3905bede9c983d3d87cf21b6dd78423c87cf137a71172ab83c5088ffc6324753a465dbba4e8e61a66c5ec6924aaf32abe1cdb
SSDEEP 12288:99tV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:99fVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A16523AA7645A5F6C65B82B1CA73538ACF226F5835C58547C2B019D1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 0a3cc6e4fa10ae519532fd082e3359fb40559cd5afefdd7455a1969160f6c8b4
MD5 38eb5719a14baaaabf8db4d320aacd6d
SHA1 7ae4fb3637ea84378b2dc8275dea77359e5dd364
SHA512 fa7bbc8c59aa536c9780580cfe1784376542272d44822871e836ec55d8d7649ca42caf7709675d740d54cb51e408d5e946a44ec7f6bfd95cf29102ca2023df20
SSDEEP 12288:XeBNUbTVO86UkV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:XJIUYVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11485CF3BAE28FCE2C27E8DB99A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a21d41b242425768799d5a4d1a9c942cbe7d4ca5cb4f485e86e792d80ec43ecb
MD5 b505bf9a48dc18a9571464b17646054b
SHA1 921f733c90f6ce8ba6c2f38eccc91eb0ee6567b5
SHA512 80dfd27628dc9a6f9451fbd2918394aa9e9f5138e86f0d965c4c7fa291eb0603bde5278bb09176883be37cc79053da4fefb4878acb39c7016b2835aa1a8987b1
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH3:ZQvGAdlCEL8c/DRNw5C4Uf
TLSH
T134267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 70d1657034ea49c40cceb4875eaaa7d5e441c7c1cc3770cc0d32468eba617723
MD5 5ab85594023f07ffcecf8bfefd5ff326
SHA1 38fb5cea759c7bb8ae1f6f8a2518b08bdef8efd4
SHA512 98fd35a9678532c22a45dc1c4cc89801879d9cd78c89871c79989909ab56f3309a18ca091f61e4ca9b21f46ca4c20d4f8933b7d650be2a0e1850bb1938e1118b
SSDEEP 24576:aSewsAjqVg9N9JMlDlfjRiVuVsWt5MJMs:xlj2gFIDRRAubt5M
TLSH
T1C585E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7ae0e7bb9ade17fe4be936a32319235e5328484937044084fad7610241904918
MD5 b2628a6127f8ad3c568e50c8b1a309db
SHA1 1091ec9656e2e3bd4a09abb722683a8a7de95cd7
SHA512 cb6f95b2ddd594ddaa5f6983eaaa1e1c9719d50b564bb565b76e681880519860121a4817b0957b111f50160a372a3d67fe72aae8ab050e2b991b5a8079758e45
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfUf:YUEtQevvqc2W1cpV2tI32fUf
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4e6b3e134b038d778cdc9d7123f0c263fade11d99a200921893d71b0434f1cf8
MD5 1abbcd17ec6debd2b330d0d792050901
SHA1 1aa167ea25d9c86426eeb8742f696c11f21969f1
SHA512 9314823a240af417849bbf427bf93cf3e4fbf111636e78a0c240054453f9d84b3f65d6e9a0a6549c268293cd6d5ab7eaa98cd94656426ddad99df07eb5c70adb
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zWgFIDRRAubt5M:HoqtVjnmkUf
TLSH
T1F2D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a69f7b60f9a044a68568145147095a5f8d7764d4a100d87fa577a09c14535858
MD5 ebe3dea9fe6579cd53479c16f4739558
SHA1 dc732589600f8464e89bec10d3c006ce5f9eb598
SHA512 431bd4281c3070c4b92f18e4943892a30b8a5b3a7161ad5cd5d853956d1477958286940fc76e64b08a3ff13b8f72216f499bac59d622ae4297f8c806027678ca
SSDEEP 24576:EAhGL3IFoiwtA5l7S53pVg9N9JMlDlfjRiVuVsWt5MJMs:EAMUFoiq5jgFIDRRAubt5M
TLSH
T18435AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8205921f4cc39fdb4edd5b767ca8934b9cbf828e2708a4a29d062a900b0b599f
MD5 4cfd4d6f38485508b25c37c84020587f
SHA1 756a36fc468da5328c5d8c95952a965aed66c0f0
SHA512 1aac157a3299b84734218f3e128c7b514427399e63daf788c5e39babab1ce7219794e78aa10ecd33a398d8b22bf568705d7d925e8f73741b93d81437332a2d74
SSDEEP 24576:bwuWOWOVg9N9JMlDlfjRiVuVsWt5MJMs:bwZOngFIDRRAubt5M
TLSH
T1D385F14A32A40CF9E9678239C553C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 dd3e2f67e5a2b3a2a87666da28d40e6050ce875a74b51aaccbb9d97d897b9515
MD5 19ab0d4adf8aa35738614503f6d0c00c
SHA1 7a39b68ca957598a12a6c232a28fef3846505fc4
SHA512 92b64205b7ce1dc8d9610a43906ed7f9108bc2e3eb2471f2d08d831eb92e21556b56df74f3ce67a14c862d932b489e84452d963ca004867168de16d0c639fc48
SSDEEP 12288:50Z1IyiV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:mZuLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E77512AA33D420F6D1A78278C9F24345CB72785633B683CF427006A65FB66D25D3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 48678db23ce624278e0af9eaf63dac5cf8c1ac532650dc74393d4c3f14814fde
MD5 5ceb50d4f41986b916f6f9a7792aeaf9
SHA1 66f6e8ab9231562295a365ada7ae5482e540d5bd
SHA512 f2150502593678f8c8e2d729bc6e5564b2c243b7e1937f1d50e256b07a1d64dee89d11ea3a424c6f3123cd2c936fd1cd3c7a690ad6acdabcee2c22a0cd9d3e98
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uj:MQRQyi36YOcPbLvw2gAf+PN3BUf
TLSH
T198667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 281647f3b123d4ba687e28a52cf4622145db75f897f41d78f51839d9835c6e17
MD5 98e476c9dd933c5c6591f7474a435582
SHA1 f51a22262760c4abd55c14fb239dd951ec62916d
SHA512 afb74dfb160e0a7b204fb486726ed89b1784106a972d8db1309a40516ca4db403e56e6997afae37d0a432e65e69e6506ea74b15160cac74d2d9dd472210e8e1e
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uj:VQRQyi36YOcPbLvw2gAf+PN3BUf
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 392167c05cf63dc7886e4864a58031bc8c2a602e099f6749978fcb5fc13eedc8
MD5 ccc60d21176627198805441462d371a3
SHA1 617cbe34006c27f583330cf41b7d6f9d97575956
SHA512 b5e0d899809d6fb3a48822688d4a4f71acc77bf5924a3f351ddfad2d49c04fccee5d9d18f3e409b0ee339c91f598aa04385a473a8e28ef40cf1ddbdc1c314524
SSDEEP 49152:h68Qg55nhceWu7PNU3/mgFIDRRAubt5M:fthLRc/HUf
TLSH
T126B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 adb9a8f04f7138a6bd8e49cee8c782a349113ab34b8c5df162a8361b1f56d8c3
MD5 1c82bac8e5000a495758676e2d8bbccc
SHA1 1f7081042f2afbe038e841b4a0cb94861fef7528
SHA512 45409436d5a929946ac5f29a9b1483461c813c4250b3bc75c5e0800f93d779431930f764094a59bebf9adb1e4af5cf197723eba936dc0e00f71610edfbbe3ca3
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99t:sy5112gYy5azzVvt69nLKnhZKUf
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c177c5a161c67459c3e343ee57b0606408facb192306d49b730d4f191e99e168
MD5 7f33d5c9ee5d798855021eec6bcd2d09
SHA1 8db323ed1556f1c3c7d3b2db299bc633ddc4bbed
SHA512 5f2fd9210cb5057028cc883060e4ed989cafe3d16b1fcd75f11e01de5daa6eff86bbb5e0ca0f6c60532c2defc2d292734ab0f90916fe53a6bf60cf6d0f71be8e
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glhgFIDRRAubt5M:du6Jmdxd2dmUf
TLSH
T1A8D5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f1bf59dfcc9d119f8f08a5e262e93a02560e1b953fc24524bd7f7c5cc6714d13
MD5 f59c590392232cd6c300425c876a4b5a
SHA1 d88bfb34814235e8392a4ce692b7f9e763a813b1
SHA512 7612ba39ac20930e1e80186818fc7b4b596a09b8c34d633d2e77fdce0c37ad0976c8b05743388d268d38dab786dcf755c76246a144c80f694eee01da6bc5f8b3
SSDEEP 49152:F1hpsNoJpF1A63U44CwH7R4xIgFIDRRAubt5M:FmifPWRkUf
TLSH
T1E7B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3df49b9ec73cc61ef6d259d7e2c9c3fb39be84bf5acf4dea653378f002d6f5ed
MD5 249542102a9ba0f9ad1a0b4eed51bef0
SHA1 f92a07c1a237587fdd92dcf081607c23f873fccb
SHA512 9649ff5fd072e95414c3a19cb357b3b555d414a21aa3b64a3ad9b05a043bf891d1f689591e5fde1fb82671d5c1056f2ba3162b298f5997b5adcbbbd7d5a6a6fa
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHq5gFIDRRAubt5M:A5dKii61+Uf
TLSH
T113C5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 157e92909d257d92da892ba9c90e1113031cf032e928e606c5607669b94a86bb
MD5 37c5fb62920c0591601abcc9912b37c4
SHA1 936e2cba22d5ad68f31944749f65fec22ecf8cb2
SHA512 bc5c0f0872846af8842bba72c180e83fbea055ef5f8c09776bfd61f18785031522da5807255c9884923492d2e88d611689ce1c11e1a2e53b83603db42628c39c
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5wUgFIDRRAubt5M:vX2imphAUf
TLSH
T1F695BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 96c4a828d8ef5d8d0386d459ae9e1aa3390ff3f4913edbecffdff7f95ae81ff2
MD5 b05bef101a83f3d12204f53e78dac1bd
SHA1 cba04368872b3b0f72ed6f0533f35c679d641fa2
SHA512 69029a67c7963c4dfbc900def0d0b8ba96af95286783e05bbd808386031a43852ddd473dbca8d84c926867809b1a8d0ac2455329545c3bda2d3ce35352ef8134
SSDEEP 12288:N1V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:N3Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1AB6523AE758695F7C50BC2B1CA735389CF262B5E72D64147D2B00491DAF81A2AC1FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 71042d745cb0338da2498d6044ad8677361e66f3d00fc006345cbcdb8fca4729
MD5 7d36006d9b3f9a2019ae775880be0767
SHA1 4613779e1f48d53d59b38f66d05fd7debe68eebb
SHA512 fa60cbafb841d785054b342fda11c377ca0e366bcfd7ca4bc81ed2ca607582a142da77a55b0088782783cd8e8850c9dea7f9d1fb91631ac25c06e6efc96d514e
SSDEEP 12288:FmV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:F2Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1866523AA758655F7C50BC2B1CA735389CF262B5E72D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 808e486e7ccb221cefc520af65144e3c0e3a937368fd9c0e9eb5e00a2922af73
MD5 c12b0bb64e9a1a04064f950c62bde1b7
SHA1 09164468e6949bd5599d9e01bd52abe8b102e32f
SHA512 73cda93cf14833ccd539132dd3834fe1bf0ef86fd43aec2cf51a6d0959463008459410664149b1715f3f433f8bfe68178b91f6a9ab6166652d40a6bd3ee944d4
SSDEEP 12288:sMV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:swVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1006523AA759695F7C50BC2B1CA735389CF221B5E76C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 86b488445b3ff1213cd597057f1c8b7e166c0348e908662a8160eb90c8830405
MD5 a82ade3c3cca81815330720e61e68762
SHA1 306a230e4b710762f760cb36e845a8a18eeaa93a
SHA512 26e29d4be23e31409cf563894a340abf916e41772e4afcaac01d539bf77a149d1912225f38da0254bca2d301bec63b83808b2f644372d9336aa80f886797468a
SSDEEP 12288:bVjV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:LVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15965236A369651F7C457C2B1C9734345CB727E5973A2828FD27009968EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 1774f47e6618b7fbcd92e7c4cbada01a1d3fff2ae245531f794e1473eb7fd7b0
MD5 d54d5a7b0c9213ec2398698c0ab6a67f
SHA1 304bce8cb85623a8e7d004510504b0fa7a31a8dc
SHA512 20ac7ea34de54750ac64a019996f7f391571b3177a8fa633b5d706a4f81853a2f8e4a0822c7ec1eab5fa8da9525cba855809ce8050cc3c53141bdb7247d0afe9
SSDEEP 12288:HbV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:HxVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17C6523AA754695F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4b11cde8bdba477576788f25650c5672b061a411d2f9a7d8c0170117bedf5614
MD5 dcc8003517550f08db92cfebdde03f15
SHA1 25e61e45fed97d2f5c4b64981a8f521f1a4cd6ad
SHA512 9928651ce1c1afd0e3a411cae1d2a4563a459c02176a7ad3ecd4fb2bcb02f868ee86ec842b1347c9a328a845937cb9b826a4395e1beebf60b5c1a6163b9267b4
SSDEEP 12288:v6V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vCVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E96523AA758655F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 97c312caf51b1aec68077119176f6701ff750f522e054d7bb1edbcb256f93e09
MD5 840ad7b9b253081d9be092a0bf943e9a
SHA1 a567866b7a69153b4cfe75fe562d19d35e8421dd
SHA512 cd8b6f9d0d539b8d0fd39460490fb690dc622c86f2f00febfb323461bfe9741ea645918e6f66420487f2815b2754412e87926abc1889fc978ca4db21b07ae51b
SSDEEP 12288:3+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:3+Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1356523AE758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7778a972fcbfba03f82dadf4591b4be36c25bdb744f01c6e0d2b4c4b8d841325
MD5 ac38c32e040da6d88f4fa36ef42c29b6
SHA1 4331a66f0e988f9e7cdd83b0f8638c565d4bba1c
SHA512 530e46b8a6ccdc4ca707c785d50816466c98ab24d855b34d52e1fd9fbbd0a97d8709859850693c6d4d70c817d5abdabf53ad547fb3b3ee58671f6cbcd99c00de
SSDEEP 24576:XZMrzFVSOWVg9N9JMlDlfjRiVuVsWt5MJMs:XZMrzf+gFIDRRAubt5M
TLSH
T1568501A9B39018F5DC67823EC9628906C6B27C5A17A0C61F03F436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5f218d6657262142aab2b4a9c1a0e5248a1566a102d2ef169a72d63af05468de
MD5 7ee256e2ddc338746fe4fa2ea7f2a902
SHA1 b198b8350200de54d9986f96ccc8163b7c8ddc69
SHA512 2c0339287de58d1111cbf4a6c9ab0875e70c9fed7a21cdce6ea0e8982f4fe08f6c89667323f0edac93b0bdb583a495266a80d74108257de4d19bb894bbde14bc
SSDEEP 12288:1hV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:1bVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1686523AE755655F7C50BC2B1CA735389CF266B5E72C68147D2B00891DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6f7b0d2032564fb4e8bfec62f1ea5820ea2a3bd7975ea25f3242a51ac9ca95b8
MD5 64a01aa718b2b79bb042f90a21f7fad6
SHA1 7bf4f983188bc140857c29ba421ade70183acbbb
SHA512 9a1264d04fc45867c8ef0b2f7b96762f4c62a50dcdc32cc6b0e3224105bc78f981c48ca4ca3d8fc91e19007fc4003d086d2aa2c74d4756749c106a846db487f6
SSDEEP 12288:XdV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:XvVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1026523AE754655F7C50BC2B1CA735389CF266B5E72C68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4add71e07feb62f6e7ee5257ba7aaa49551a1777f7a3c5680e4936b907985bfc
MD5 f9d9007f6a242f9b90a00a82a2118f60
SHA1 5e34536287ab9e43627182b7fbf1713f1f2f5032
SHA512 5a47c5084d660cff60d68d9d9c007ca9f2ba95b2c72802e04dc7d4cf1ec7b7bea7af122fca8f51e278a27cebd27412752bfbd7b54bde59c0f35721e739e5378a
SSDEEP 12288:UyPz5L8iV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Nzy6Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EE75125B73A130F9C1278275C9621B02E772783617608A9F53B006B66F772E19D3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 1cf7ecffad9b86c254eed513bbaff9bf885f4481ebfca235c97e26c633975573
MD5 be53345f1d115283a12546886ad03edb
SHA1 712f3d3f34f973118050420baec14f4d87c1d084
SHA512 6cc991ddb2bbc182caa3221d2fdcd71c2f209f8ef79a8a5e53671578fe2397b34c74df237be0bf16596bac98d67a9eff6866d2f4cba8997d8208e0fb65b06269
SSDEEP 12288:yhV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ybVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1466523AE759655F7C50BC2B1CA735389CF266B5E72C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f166f8cf2fe88b98a0ee81a5893065c672eec746c6a1ba6ebba6eeb2af061a83
MD5 c9af68a824b81e0a2fc795d95ddfc3cb
SHA1 d2370cbf19448598d4dae57ae13e88fbfe3cf759
SHA512 816a5180a786bfed5f22f2dbcd8007286dfdf99694d0d2c367173c6611d060efb6bc317bf785b056a46b8642fcd346f56f0ab8a529de2b807926f87aab7c7b54
SSDEEP 12288:hhV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:hbVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11B6523AE759655F7C50B82B1CA735389CF266B5E72C68147D2B00491DEF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a438a1f530eb73311360080a9f33f4e2c86b67d9765c8c474b031f5d1214e8c3
MD5 05cba7fc73e24657d042e173405b597b
SHA1 5825f9640bb846688c21998238173380f9140240
SHA512 4ecbdc10744971029a246598e9d8c6f1bc549588fe1e22bc1da1a869f69a9154979b58db78185a5fb2be3d34f9693e4aacc78201fa9a8756ecc6a2cd3e97e875
SSDEEP 12288:5yPz5L8iV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:4zy6Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1BD75125B73A130F9C1278275C9621B02E772783617608A9F53B006B66F772E19D3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 72e2a8d0cf382293d15fd569dc071e7f6d8bd1ccf8297fab77eaccac290b888d
MD5 91e65112f11658cbdddae24a47bdee24
SHA1 6624b8e9c2cf7d946bb60bb32ab3b393cb3a1e87
SHA512 bc52750ae9ea4d74f16565b42229a7d88f3f9bdc6befe098fa475b715cdc578ea2bc04095eae2e4057354e2da1e2ae5dc18b58975b25d46fe29985578ee9024b
SSDEEP 24576:oTxaLl3z0zDgVg9N9JMlDlfjRiVuVsWt5MJMs:oTsLljPgFIDRRAubt5M
TLSH
T10E8501A9B39018F9DC67813ACD628906C6B27C5A17A0C61F03F436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 25914388b6d4cd68735357ad8f15b04026fed281605fde3e3ebbbeb439482be4
MD5 6800ac266090dd2add0630fa4e6ce983
SHA1 f22a60a9476957c44058e991232b67c6a9e325ab
SHA512 fc67e587946ddfbf9320a5c4552202ec5d20b9245898971fd1cb0eea518668a5c2c081403f648b32e9f460da6b8b181accd1363e3a71c717ef0fcd672acc84b6
SSDEEP 24576:n3Zd9CHKy7GZMVg9N9JMlDlfjRiVuVsWt5MJMs:3Zd9CHKya+gFIDRRAubt5M
TLSH
T12495CF90F3E414E9F0B7DA35C9725602CA767C9A1B71CA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 53be8c90a6b4f638f2d67a71170a60ecc44b08cfde213223f5f23d1dcb0dcd5d
MD5 31475afc69717da4311568f299c00927
SHA1 84f49f3494a511b4c1c753eb7c6bdb31d0700056
SHA512 37839cd47a1e2d5077d30b9da8233e0ab179a10e3da5580b260787723dbc2e718fddb54636189cf117544c85caea6943b479490681f81629da238df7b6c04628
SSDEEP 12288:asV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:aQVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1006523AA755695F7C50BC2B1CA735389CF222B5E76C68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b657555be5018fae037460135f321f3072893321dff990f554dbc52c5e794442
MD5 f9729ecdf2a9d0c260ee1a0a6dfb0b9c
SHA1 4780a81c972f3c8b3a3d4adacb6b239673f6d76a
SHA512 78f3b305c51bfe757de0d7bcc6d9b87e2399c05a8fd2b67a8acd4069d34174c28dbb1aa3ee4cae634b4723680aebeecefcae642cc436c17cf4b389f6f84a6486
SSDEEP 12288:FCV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:FaVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D96523AD759695F7C51BC2B1CA734389CF262B5D72D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6fa69ab95d839cc2c988fd896de75abced9f37602507e612683db81c02906ff8
MD5 bc776597551e17f6f2369007bd5ee234
SHA1 62980d108c2bb34dccfde8bb080a5deb3ada07c4
SHA512 b97dffdb2d1ebcb045c7c93c4d168e8dfadc22a83c9769c5b0280f8907b66a9c17da0d6a08e546d33f6a42feace34e5f32f0b8ef09b260f3b9b5575c3b9fd796
SSDEEP 12288:lPV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:l9Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1706523AE755655F7C50BC2B1CA735389CF262B5E72C68147D2B00891DEF81A2A81FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 e554f0edfc6a8f20861f5dfa0340b50a5f22443b8b62ea427eba82669ce31874
MD5 b6f97d3956f5df51d5fccaaa315c492b
SHA1 e8d6a27e8bf61a2c3a300954a5dc766a8e7e8665
SHA512 78f9db7fbebc35886ad8cd7fcc7fe15082b9e3a8141ae83f8e4a4aa13e92b3dbf2eb092f414e1fb594084ee12ec2ff2ef7d04c67bd7008b4689fa5186ebc3976
SSDEEP 12288:RhV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:RbVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1086523AE754655F7C50BC2B1CA735389CF262B5E72D68147D2B00891DEF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 34f10d59e8885b9f87e8b12a2eb60259562565d691bb72c018f8dea75b1f9fc8
MD5 7a901e8df3f79256b42990a556638850
SHA1 39afe84eae1fcd6605bbe3396a7404ee95cf4156
SHA512 260c5e028bfe5cf28c4360ad48b7ad43efc2a150a4f270860c50594817ed6accf09a16673f2ff9efd264f4fc79c49d47144cc3f6e2fe47fb856aa08efb0898a7
SSDEEP 12288:NsV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:NQVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1596523AA755695F7C50BC2B1CA735389CF222B5E72C68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 6e3cdeb6497b4898cb7b8ef03a2279085063732356f4f06592e9a91b5bcb63bb
MD5 1feeeec079a6e2f287fa06f8000f26b5
SHA1 bf838fa5fef382d3b725ec51fa32b89ed206d5d9
SHA512 410bce07d3008013c89455783c880f45739efd1b05f0157eb3e3a910b04b0090f07ed64ead24fc7591374493c31a796497ad09992030dff292c0af47c6912722
SSDEEP 12288:HZV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:HjVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B76523AE759655F7C50BC2B1CA735385CF262B5E72C68147D2B00991DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 5323504741c0fbd25f9adb2eca405ab643404fdb8ca338ebd57efeadd1c9e459
MD5 ef5a261f1499bdbe694dca332aabfc4b
SHA1 30cf348f6ffa27a2142c29ad037a7e500275d93b
SHA512 aea2db1fe8489f0e5df9ffa19a44298e8b16d05c34f3e2f8c15a2957ebc1ffc3e0c358b60a767a1a936b06f0af437abaeddead2e96d5c7bd3e83f56c98f48f09
SSDEEP 24576:ufwv2k9RX6wkyAI/Vg9N9JMlDlfjRiVuVsWt5MJMs:UMnYItgFIDRRAubt5M
TLSH
T1A795DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3dd3d165ff935ae1f2679592ae69a206d2db57880bfd4659e4fb96dcabcc2c32
MD5 6a877f800bd751ae9de7a01acea0f1f1
SHA1 2c458a93ea9ea3fe8d1c08d51651e8c1257d3361
SHA512 d7f4bff6b9b0ac8ec71e48959149badbd6595ac8205ab3fdf7a6f4dfb0d5b2d05ac441365500248a54fc8f713f0b9534f202ea5a53a4aaacfc3bb2d375fae108
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00gFIDRRAubt5M:lySzPhUf
TLSH
T18C066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 383409b9766a2163bcc3f3bb3dac43246905be1b15ee85df8c42cd852dad41ba
MD5 1cd46d20399891c64b0cf798502ce517
SHA1 7c9e278357bf2fb6a7e394888bf431ace4ed3c5c
SHA512 3608119b5a79c221aed15761a26507eb459a6d56cf760ec8a6f8dcbfc32d496478f279e4c2e04238ecb235147bb7afdb83f152b24d58896c44d1d79542acb450
SSDEEP 24576:H47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmVg9N9JMlDlfjRiVuVsWt5MJMs:H47JUQjTirIhCnDHUPfF/EgFIDRRAubE
TLSH
T16965AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5062cc3abc78e1b149261318d48fc80b6cb616a6bff9f8810d726f6b4f91f7e6
MD5 1ed2fd84cab2d7508467a06111462d23
SHA1 abb173dc547299d48a7288121b9f88a12ae48ee5
SHA512 e1974b4a6285a299c9604f4af2766bdab894ad138e94458050252ee19db57773c6ecc070ecb0fee71fdefb1bfe2f1f5cebe6be1dec186a859e5d823adc6d4857
SSDEEP 12288:/VsfxV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ULVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17375F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1f5afd6c57595ac2aa5d6dbcc43ab56cbd7dc09190aa8f8ea10c8b359a0d5467
MD5 274f25f5b057fdc78fa7afef6c2a0481
SHA1 90de88753bb07402cfae7d26966e5abc70be8250
SHA512 cad13be97a6ad427306bcf8fe76dece916a27f8561dedee87645a32042582cc29dcfed4c2c2e4305be7ce0217509d0ffa23742a2f2d0f8794d49992ad838a6c5
SSDEEP 12288:eoxYSHXKU3fifeihXDqSzDptKZGVNN9JWn1injlaEHaRMwhq:eoxYK6UP+4SXNFC1ijlaqaRMw
TLSH
T1B14528417626CB5FC6A940321E32D2CCABB07D01EE056F0773C9873FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 35e1879806f5a352c3d30046270adf1c0ef4fbb48701ad77966e54391612eb29
MD5 8910fe079d1342db1ec20b8e74913cb9
SHA1 ca9dd0a4fe8e73289617b0b6acad766942de9862
SHA512 0f9bd0e59e817f118cf975d159c714606e71c859d95405e4cef005d8a8c480057c0759b0a41c477943ac24f8115619c079cacc52814098e49f916b9ae63a631a
SSDEEP 12288:CfVyvAF5DD7b3MctksOgcI6DO83JotYrSMKVES/Ir0XphsN0w5u:CfVyYFwjIErsphsN04u
TLSH
T14365F9816136E78FD1B72132072A5B4C77A4DC07B7096F27B3CA457AD82B652A0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfa2c0e07465cd71.bin

Path C:\Users\Admin\AppData\Roaming\dfa2c0e07465cd71.bin
Size 12KB
SHA256 de65bd4c03c53f1e20ed9c53b38d28fbf2a43825aa3f491caa0803d3a5ff9a4b
MD5 a47a3bfb1fe60417b9ffb0b9136a4d97
SHA1 7b5270388182f3cb6c198641474c5f14ab958a74
SHA512 feabe1de5dd511eff3b17b6bec04cdcf4ce76972b0bb16b316fb55cca17bd8cdf96b10aa5e46afc44ce2ac092dc5ee90134563e7a5f624c4930a927456434b67
SSDEEP 192:kyFWt4cb2LqMqLR6RFKu6kl3ZPSNTZRTqZqHbY2BpQ3rSqNupauI6:VFES/qLW6kt6FqgY23Q3rFcpC6
TLSH
T12542CF55F63088C4517B306B245A990BDEBB1D8CA776E66A3A35213B133FD081A87EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 599a0617644a95e1ffdcf04b3fe17298182e31bb8d7fa5ad6ca777776ea256f2
MD5 af7a42b34b33b3925fb9ca626a4436ba
SHA1 fd10ee616ebe729d8c00a29ac74c3f4510faf9ed
SHA512 5d1a31ae3dfb7f18a7f86e11658fcbbf1e4da0868c98b262416977cbf6066ac27c6c393648ccf723fbf05d2adc6a6ab370183aee5bee5a3bc30f09b4bf7cd966
SSDEEP 12288:K+7pV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:hTVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E465237A769999E7D46B92B0C97383058B2B7B683BC181C7E17005D199F81D1AC3BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 918da426f4cd0eff96f365023ef9ddd37c39a6471bf4c2d7987cc8dcf9544e06
MD5 230ec6737d40cf7e22b34ee1bba9fff8
SHA1 ad381abd4c4bec562e42e3334c985afbcb76bc3c
SHA512 0da53fb76be54c3d8eb13deb4008b24233b7378e0713a6a1a808aed669d856d8926c2f5dbc83bf6a1be8be2198b864caa24cd66459de9e1516d849bd97a5152d
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bY1Vg9N9JMlDlfjRiVuVsWt5MJMs:Qgb4mBIBhGFigFIDRRAubt5M
TLSH
T19F65AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 3d8f0b4a9feb6720413385b79463e3f07e581657713051ade1b039f2d3c44644
MD5 9e2f32d1f47473f44d0b8147756d156e
SHA1 676194bdc399351e5fb59ca19f996ec2998984cf
SHA512 870e946e30aa272f67f3cc2d5fbebce6167799a851dc043cafade658745356012743bb8d3def4a117f11e08856d55932e2016d57285f28fc42d03e8a0016a8cd
SSDEEP 24576:KG88u8FpJqH19zria7/mWVg9N9JMlDlfjRiVuVsWt5MJMs:x7ZFPqVka7/3gFIDRRAubt5M
TLSH
T1AC95F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F236E14B3FF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d66679eb03f543dc5d1d7c5bb4b3199370b612cb0892450f158604c27a173b9d
MD5 15bbb2de260fdc81c8c547099c8a6833
SHA1 c4aa41641fb6729866d6bcac2edfd8023d9c03fe
SHA512 34361d76fe420f4b9785d7e35376f109d344ffb949f23c3eef0fa8e4b04e917f7bde3e4953d4e6494c90135953ac7d9dcf945db46c42dfdf2b00b1f917243a88
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjugFIDRRAubt5M:ZG05lO43bSUf
TLSH
T1D1D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 17b4bf9cf57ccd3bc6282968f1fba298b708b2a67f1518e399640cd6acc66f55
MD5 9eed616ed11a86c582b0f07838f4d5a3
SHA1 96240a06893a0280ac21032cfecd4672167901ad
SHA512 02f04da2d8ff3a357240b767ddce457bb7e4683a66b44f5d510ef78d63427688a271950eb900e907904dc14586960a7401ecd7dd2bfa4935fadc075427c0ad94
SSDEEP 24576:Qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0Vg9N9JMlDlfjRiVuVsWt5MJMs:oa5POZ3BJt2pasx2+mmgFIDRRAubt5M
TLSH
T1C565BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8281b564543a8e323eb53482fbf1c0ce6f3e3542c8ec90cdcb84ad81648c3793
MD5 c81d36585558e5a6dcfc3fd722d26eba
SHA1 5cf4c5633919d3314f4638bd5ffbb053a75cbf12
SHA512 31a0d68e65620ff9dca42d1c3006dbc4a67a8a478ce3c6baa30c659df575b12d35aeae4dbc4549c9106b5eae373f2bf4bf63d3f1b08f1174938cbc61b086d774
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkuVg9N9JMlDlfjRiVuVsWt5MJMs:+Nc/zEOVHFXgFIDRRAubt5M
TLSH
T197858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7a9e2d878b7a95215d06286c930a6ce4b6827df5f90c184d1025644405bdb7ac
MD5 c3707e15e8a1a426bf978938bff7bbaa
SHA1 bf3a3101fd5dffecc4a25a90cb2e7473bedfe4e8
SHA512 8e33d34c0182c4f3be06fbc27c8c5db912ef03c147a41883ae228cbc3ef1ad12aeb90a88f68c5c2114769928ae0e02d74833710e71185b7f911dca4672ff5e4d
SSDEEP 24576:VTkNvNnaFeYhJNtmZBmPVg9N9JMlDlfjRiVuVsWt5MJMs:VTMwBtOm9gFIDRRAubt5M
TLSH
T12455AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 468f85e02cd64d641e9338e6abe65010ccd430b7ca04de770343d142f594ddbe
MD5 fdc1ec10db326315fbc923043ee1f064
SHA1 6d287bf5e7e060c337128bd9263788fb4e566f86
SHA512 f2f6e46b7adec2ef0752964fb5fb5f74d50859749414119d6b4274d424c469da54663ca91411754a3cd965cfec4bb32b7b1623811ec0c6a35d16f535815233d8
SSDEEP 24576:GPUr+NQSVg9N9JMlDlfjRiVuVsWt5MJMs:GJQ+gFIDRRAubt5M
TLSH
T18085F12F32A918E5E676E17DC9924709E77274621352D2CF02E0417E4F67AE8BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 d5ef1693897b706ab72fd9f23ad65b825a610957907904263e29bd9026d1cb5c
MD5 3b2ce2f6a99a53f37bf8a6d1f3236aa9
SHA1 246e3220144a1db4ed66a0240dca24c91b72a758
SHA512 e5ccd5349f76100b02004f0b9632f36596ac25a2dc277450505710fb93189f7e8a9655e15967b093b3347d305ca678dfe526c6296099e7a31d86180e3f83578a
SSDEEP 24576:0D3FHshBIYQgAXVg9N9JMlDlfjRiVuVsWt5MJMs:0DVHeBIAAFgFIDRRAubt5M
TLSH
T17895E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/420-143-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/420-149-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/420-152-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/420-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1512-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1512-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1512-328-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1512-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1512-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1512-123-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2604-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2604-187-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2624-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2624-34-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2624-25-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2624-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2752-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2752-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2752-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2752-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3320-115-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/3320-16-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3320-12-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/3320-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3552-71-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3552-293-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3552-70-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3552-77-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3628-129-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3628-138-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3628-331-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3628-132-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4204-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4204-345-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4204-344-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4204-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4204-110-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4204-104-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4552-55-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4552-66-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4552-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4552-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4552-68-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4956-83-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4956-89-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4956-310-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4956-81-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5012-51-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/5012-36-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5012-0-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/5012-1-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5012-7-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5012-8-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5432-94-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/5432-93-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5432-99-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/5432-325-0x0000000000400000-0x0000000000577000-memory.dmp

Download