c081fc69fbc05e72e9f6a92005c3bc77ebffae9fdfbe0be8bdc9bff5e9a83f4c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.8MB
Sample261102-xec83awwc1
SHA256 c081fc69fbc05e72e9f6a92005c3bc77ebffae9fdfbe0be8bdc9bff5e9a83f4c
MD5 efa891a1d3eb6aabf7c315cd7c184f1a
SHA1 93b8e63a4ac47c67c382d86eea03db2e99fec5de
SHA512 779c81f0ef1e5255a5995468d18ed2f47607605e48e2265eef2f2d732dfa198a950718f36ab481ca7970b24f288f903eaab625b64966dc8ad65802d8350976a4
SSDEEP 49152:xtbIwL5D4Jc+b01tnAyB63TANQnMEu6Te8wT2CM/XxvYT/u1XMHM9:/kPbiHV6ZmM/XxN1cHM9
TLSH
T1D3D56C07B3F941ECF0AAE2B8D73156329EB2BC52CB34A5DF125416151E71AE05B38B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4688	elevation_service.exe
2864	elevation_service.exe
3240	maintenanceservice.exe
248	OSE.EXE
1160	PerceptionSimulationService.exe
4580	perfhost.exe
4864	ReFsDedupSvc.exe
3596	SensorDataService.exe
4996	ssh-agent.exe
2932	AgentService.exe
5596	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\839c341d4b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2ab0766fa6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8038e66fa6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084d773a9fa6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8cd4065fa6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016ef45a9fa6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009270b265fa6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c20e9366fa6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091df9b65fa6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe
4688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3296	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2932	AgentService.exe
Token: 33	5596	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeDebugPrivilege	1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1708	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	4688	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 1708	3296	2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	90
PID 5596 wrote to memory of 5636	5596	SearchIndexer.exe	102
PID 5596 wrote to memory of 1212	5596	SearchIndexer.exe	103
PID 5596 wrote to memory of 4588	5596	SearchIndexer.exe	104
PID 5596 wrote to memory of 3032	5596	SearchIndexer.exe	105
PID 5596 wrote to memory of 2096	5596	SearchIndexer.exe	107
PID 5596 wrote to memory of 6096	5596	SearchIndexer.exe	108
PID 5596 wrote to memory of 4644	5596	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-11-02_efa891a1d3eb6aabf7c315cd7c184f1a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d4,0x1401ba6a0,0x1401ba6b0,0x1401ba6c0
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1160

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c4569ed3d163bfdf6bafad6ae630de9ba47c60dbd225db3744efa605a686444
MD5 600f06f1404cf07e406c1693c53a3bd7
SHA1 f655ebae72461cfc3d4bfc454f4c32a1d4b63e38
SHA512 d5a13eb7f69651d3aebb28dddf7492eebbf90ec32e5c27e3001f048f9eddeff99c95c9632204aff2e6c04465c7cdd8a7a95e1792391417dc536e1694d4bc3dfd
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRCM/XxvYT/u1XMHM9:g3q6HjBXM/XxN1cHM9
TLSH
T1B3D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b8a5f708586dd3cf2d802166c840af37ffdecb9df55c0f37f576d692e4404c3a
MD5 cb7a965695f7ff4c5871995ff82430cc
SHA1 4276bf6559c0798a84663db8d9332630571a46f9
SHA512 6155e2d1fd2a07d70cb3ddc770b9a3d9506593b5ddbc0222618329094a81f8ff361149a4f82da904ce263a9599705a6b0900ebfb404551ceb85597039ea84054
SSDEEP 24576:dXYfDtczAnQCBq/McxvN2T/u1mWXMHM9:ItcPCM/XxvYT/u1XMHM9
TLSH
T10885012CB7D408F9ED678279CCA28512EA33786447A0E7DB03A499751F336D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 92b4379b8f2148aa6cc2e408427545dea93a541809a07d02771f27dbd8a48b5e
MD5 d0964faaa08e2177b4391108d33fd93b
SHA1 88c726ec5aa825f0d593f965794edc3f342e4a7c
SHA512 5317a8bee528a926460b8ed9b9306b0f18a478e7a7a7d4fd22be9d33d41f8f2ab97427cf39915ebd20270c80013d548d8f040882411093c54a9e3050fa045d44
SSDEEP 24576:D0Le5ji0hmxYrM8QCBq/McxvN2T/u1mWXMHM9:DPji0A2yCM/XxvYT/u1XMHM9
TLSH
T183959E16F5788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9c6778d63280202598bd50b0b79b680ae8ae9049fcf7e334fe14c15ec6e80cd0
MD5 362f64d741598fc882d64caa173e625e
SHA1 9ff1fdba329128fb727e8a1f6610a1fec342715f
SHA512 0d7fe036c2dca44fc5c59a49f55fe557ef73ed0cb674eb8389b55969bf43401cb4d9848f082ff5b6794109f53dc88a0d57ed63c3551d5420dea976452c45778c
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyueQCBq/McxvN2T/u1mWXMHM9:M/ezSC6vUzPvxHjyeCM/XxvYT/u1XMHK
TLSH
T106756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 52aea70386458e95ab6d962dcd0d540f24cf83577b8adcecfba0448b0b8e6ca5
MD5 560c4a28445bf1fd5b5299ecf7c2686a
SHA1 957a4750dcd02021eb8c683147d7ab60cda0f2d0
SHA512 16b25ff0cdcf0cf80c1a59fa8bd1a686d3b449449ee77771fb0fbf087baa71e2662c18851f89aa82044f4797da9e0cb004949af57240eb33816f7d6bc48b083e
SSDEEP 24576:vVbqPb88hv/l+6DQCBq/McxvN2T/u1mWXMHM9:vVO88hXl+lCM/XxvYT/u1XMHM9
TLSH
T129559E66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a84767e5372661da77e5391524f1250abd7fdde9efbce68c20e41c03c2a331a2
MD5 75e74f725ebf14c2334e90c3d599c5cc
SHA1 37dac29bbed0c9f94b4df2aa826870aee1ea32e9
SHA512 4e21bcfbf1a0178a8c271637776814b521ccfe7396bd8ae633a5369ea7f1c35a6cecfe912bea49b754d51d5697bb70d1538627daec9ff53aa9d9d251e4562f65
SSDEEP 12288:xH4VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:xH4QCBq/McxvN2T/u1mWXMHM9
TLSH
T1A965231EDCCCD6D6EB478BB248AD5A7B0E26BF78FCD484B165103AB41770CB2D429909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a7fb7b1e64872a1df7733fac71ae23c93f385743f56e94982267769b3dbe0606
MD5 c58581f28961c7038e9833624ab773c2
SHA1 b81d8f950d918e5324deba08a1873457c58cbc04
SHA512 8309e07c9d4e832f6b847ea7e41f9fe31b8621675fe891db81e4b78c433b8469aadfe6330c4f977e4a4c492474bc8f22375469cd59c03d5c3320d7fc4c134b65
SSDEEP 12288:GeBNUbTVO86U7VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:GJIU7QCBq/McxvN2T/u1mWXMHM9
TLSH
T14285CF3BEE68FCE2C27A8DB95A918740D77278304F6193CBD164820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0e4da7fa5c3f1be6e23502b373fac5d0d99bf6df938cad2cd05a7527a9280e11
MD5 aaad75d24f9e301d5365f7d1502f174c
SHA1 68e697bba62907767d78d1c5e686ef6ebcc551bd
SHA512 e5bb46cd39a857a412ba117511e12648b494edaaed91fa7206f33cf01534bacfc16a439b7c1e4b641fd8c4943a206ff8159ce86414705587b535eb900d1ad2a1
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:XQvGAdlCEL8c/yRNw5C6M/XxN1cHM9
TLSH
T1E7267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 76b6fb5b76cb623fa753cf9c088dcf1f64abd992224825516afe30d774e24eb5
MD5 e0d3f36e69b5329fae44695fe3a5ba8b
SHA1 6fd93ab5313c07d48d90b2df02762ccffacd48a2
SHA512 3fdee5ab08991830b7899ebc670b93aa4142be4229a4c41ed2203d274713419b3db756e461f3c0209ec6272b9273c965511ed8103f5cf3253fe5106161367926
SSDEEP 12288:YAwSfxL/2Dc3SDLLmt0LDQewsAjtVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wx/:97ewsAjtQCBq/McxvN2T/u1mWXMHM9
TLSH
T1ED85E031FEB4E436C77B0DB21B26C716183DBA204FA119C3E3A85A9D5A301D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8a90a17178602e5c2fadfc56016171f58d77ffd1d4283eeccb2728c3e1f3f01e
MD5 caff5540f69fe9c9385dd4e1036c37b4
SHA1 ed251766b37bd10da05b7a5ba973ad0746b31121
SHA512 b8bcb3af9663f7d1d089d1dccc45819b71a92216fab3ec1d16bcfa1521c7db14f08e34ae5922bc87d19e2455065b4715edfec2618d909e280f8a3aaf01e96be2
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqfyHK:qUEtQevvqc2W1cpV2EI328yHK
TLSH
T16C474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 530c9368f8145554da35746d726f749cd3c272dd6deb2bb2c210c508b9c7a0d3
MD5 91cae83709e9c0a42bec0f977db77a7d
SHA1 19fa739e470140c05a5a924516182c9142a6c385
SHA512 f4d65e5e6f4e66055daaf0367fc09fcfdb5736b615e5f6d9f29d1695b7d3e92720ab855be8b103a7a6b9dedfec08ff368c519061dbdc4a6d8002319530cdd791
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/ziCM/XxvYT/u1XMHM9:8oq2VjnmuM/XxN1cHM9
TLSH
T1D3D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d4eeb71aeefa39e3c69956c1eb851bb0aeef9d856eb265fdde479503b0e4824
MD5 a6e7dae8471f53e477d548db738156e4
SHA1 e50290f4b1a9b7f3bcc17d227465162ac88b20e7
SHA512 c2932b3f563bb041db254fbf9f96daaa0943d0bbdd3bb2af698d2c7f7f90920992a064172de1646007f4a0777ff47a372f14bf31957943afd56a9c01b7083026
SSDEEP 24576:6AhGLJIFoiwtA5l7S53yQCBq/McxvN2T/u1mWXMHM9:6AMyFoiq57CM/XxvYT/u1XMHM9
TLSH
T1D3359D81EBF955D4F5B3AAB899B68171EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a8ca00f3fc8044436161625160f51726f8908d0cfe896c66e85a681ec2ad4a20
MD5 69cd2429af8a3d284fc4e8582ecb9e32
SHA1 e0f12f96311371ea54fbc5b3fef3bd067290b835
SHA512 e30f8acf08a8ae69b3e86884aa79f00525604e4b7e3282bf8f62505110cb9205e566754c9e70888b7e5e3c222db8a0d8bfdfdb61cf97e1893b8e4197d79e0f06
SSDEEP 12288:hmw5HEjsChNzBFgl0WDm+C+VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuG4:8wuSOWhQCBq/McxvN2T/u1mWXMHM9
TLSH
T1CB85F14A76E80CF9EA6782398557C536EBF2BC113A60C71F1760C65B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f7c529c7a9e0c70a53819bd5fec15ec9d4995b428d7a3572e6221c64f1ba6872
MD5 d1155a3af645758e98d123079bfb1292
SHA1 98f07a279bea85cd8c416505b97bf93d30201026
SHA512 04e88dda1d6db9c8ce4d86a741d9a3dc1d20816e05e1ef37699238d35ee9a9823628e1a6efbb0866b2dae4109fe4ac106934519219f78c63b9be14c140450410
SSDEEP 12288:6jZ1Iy9VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:2ZuUQCBq/McxvN2T/u1mWXMHM9
TLSH
T14E75125E36D861F9E2938379C8E94616DB7278757BB083CF162002B92F32DD25D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6cbfb6c1cde43925e80069799ade369ef1bbc5161515f590b0e8869af0ad4da6
MD5 40ef6ffc4152561422e744b91b5b8248
SHA1 602360ab71a16ca36460c2f2a9e0dd0d3e004602
SHA512 d55c235e3d28ea1c395cbfc1cf8392065748e4f8384809ec6084c0882a983c2f3273572e90e3c0a93318e00638cae61f46efd01f4d5f66913bc1e94d22eee2c7
SSDEEP 98304:hQRQyi36YOcPQLvw2gAf+PN3zM/XxN1cHM9:4QyiKayX+PNYfyHK
TLSH
T187667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3bc4a7a445b7c44bb60ec1090820e07615b7639f842da07084515bfa23b5f85e
MD5 9318684e398fca3166416734c67e1beb
SHA1 cf1e6a1c613eb67603800f4093752caeb3d49e93
SHA512 624f3d5047921fb9e5dd70d425122c4b1cd779e3fa3702cf4eff81fa6dd27b94cab7e03c82307d311d37b423d971a30f507654f810fdd9547d09e2b1854d28dd
SSDEEP 98304:YQRQyi36YOcPQLvw2gAf+PN3zM/XxN1cHM9:PQyiKayX+PNYfyHK
TLSH
T124667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ce3b055bcd636983c17dac1a3a990fbb45936cc47cd9266ecb0cdd0cab7308b8
MD5 595422848e7c19e6a57fb038546e7f3b
SHA1 4f4346269a00ab8d77051de82696dd1d322c9095
SHA512 f87cee5ee34f87163d66db2c361d637a1409611a0a7fd6b10534f2b40fd74e7fae254cd025aa8108b13f758fd566356e3ddd948dd63ecaa013b184f3faa21714
SSDEEP 49152:Z68Qg55nhheWu7PNU3/yCM/XxvYT/u1XMHM9:nthWRc/NM/XxN1cHM9
TLSH
T19CB54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 29ae1f750df04da9e004e64c863068cc54e8a6e4563da448ed1d8f61a5bb65d9
MD5 c89246743fea89a132b4be8b19b4d514
SHA1 204332e762ef2480669b52df59f46a28ee952d25
SHA512 20a518b27f4a0365485e0adc2b6691193896d3960e012482c01e91fec337214d60b927a734074d75a471be9d52588d58e98f667ec862d680fd23ee4effb0273c
SSDEEP 98304:0y5112gYy5azzVvL69nLKnhZ4M/XxN1cHM9:1LIHmWhNfyHK
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4f9b67873ea837f1a6f48c03198afbdbf78bff25cc0e783bfcf62f4c50a54e16
MD5 b01ab9cbe3213c16249d6b820d56b3d5
SHA1 49414e3d71315aa310a426e31f90f7d8d4f6496c
SHA512 72a8c8f4f5d805a004119a35abae2e4433ced5fc9da3fc4ffeb4848fe76d6b689136db5bd867ff04e81a73726724e184d094619524c8ba164a64f41653518d5d
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMCM/XxvYT/u1XMHM9:Tu6JmVxd2d/M/XxN1cHM9
TLSH
T12ED59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 58655599d22d698bf19afee4498d439395bdcbbf1dc90c0b512218ca9beebd29
MD5 cc0cca46b8b123471116051af2787cab
SHA1 9ff9fd78588fb9cacc202386e8a74321cc107e75
SHA512 f8b91f013fd81b3e6b4ce610da7bfbef53967877b46ec5fa7ec634f9b4165ebbce317b78a61200bf09bb3e93b4e79c9e03d1811075f3c56251c2aa983849d36c
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xsCM/XxvYT/u1XMHM9:emifPbRuM/XxN1cHM9
TLSH
T14FB5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 487807ce5775e75bb44badfefee501e89599fae27ef548b76b20f1cd1a5d8b77
MD5 1648975aae5bf396e2280748242b2f46
SHA1 0454aba0570a8eed985242160eeb014012c81e88
SHA512 84122ecf3dca78aff4bd757df7fe0f24f4c5d1c09d31a5bdd76842b0acec2bc29fafe4aad6f5fd527592a55ea479af2d1c800eb0cb121f228681d3e99b7c8a17
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqhCM/XxvYT/u1XMHM9:S5dKTi61UM/XxN1cHM9
TLSH
T144C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cc4029825ac028348c99439e309fc20eb17c55a4c1caf16229ce7c765840750c
MD5 c08bf26b7668105022b74234ad74d92b
SHA1 3909c6ab58856e88876b9bdb782635cfc071b7df
SHA512 2ca4312b1f5f04b4b6f5a11a6f775e1968078723648525ab6f60808572a7bd82f1595c2cdaf6012d62732ec62eff67dbc639b36374075ebb33b98d4f5b1dcb77
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wQCM/XxvYT/u1XMHM9:hX2iyphCM/XxN1cHM9
TLSH
T1BA95BE13F2D901E8D05ED174C7468632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 cf60df6d508cbc880485fc27642895efa6666cbf27abff45e1c29fb52a71d8ff
MD5 0ed5d875ebaf1bf33996d2f9fde815f9
SHA1 69122ffb1cf599e027ef61726d248901d4dd99f7
SHA512 3763739a08a83f4d6037a105096dd4433bdb9d169987c311db617be74f047685187b3641d64097e76629389dbf3815305467caf639dd8b39345f3e5cad336522
SSDEEP 12288:AQVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:AQQCBq/McxvN2T/u1mWXMHM9
TLSH
T12E65231EACCDCAD6E703CBB2886D16BA4E697F7CFED480B6761421742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d8f84fa293ab4cb3892943c2edf2ec5437c67b63b12afc846464567b7c0689e6
MD5 0660f01116943f151dd1a2e96501aba5
SHA1 6d96a607475ea0238ec156a0e5642954afc1d808
SHA512 cd1a5487ac6feaaf6ee9c046d306d5079051c6e78e95ae52679e531a5561684d02a2e3815e2cbffe727a8d1a4919595856eb3b27dede7394e8650cdaf654fa7b
SSDEEP 12288:hJVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:hJQCBq/McxvN2T/u1mWXMHM9
TLSH
T1D065231EACCD8AD6E703CBB3886D16BA4E297F7DFED480B6761421712770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 34a6b68cbbc2417946886a99edff94982aa01268028c8d461360dcd093980455
MD5 8f4669b8635f957665fc1888be907d14
SHA1 c3048fd2aa57fa82fee0b73aa6c0c03718d70f7d
SHA512 3251c556f1540bb69bc2f74ddd419feaf3a62822ceb9a89f66bd2529bd170242ccc996bfde3ea5093d9b1329c322d334e56c6321fc5188076259a9f07cfacfc0
SSDEEP 12288:IzVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:IzQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F565231EACCDCAD6E703CBB2846D16BA4E697F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 658bcf56b68d7386acca0a6a8cf0b90659a20401aebffb89715dec25e2e02d4d
MD5 dae2435709537cb504ba715f3b25ccb3
SHA1 08e724a71e249c659651aa81cf6882899e7f89d5
SHA512 a853bbf04efa9def6c21259f8704f802022b7cd3f6d4fabbb8cf736a1dd01fd90ef3eae65a15b1eafa6872927905387f6313622cfe137c3c907d07f019490e3a
SSDEEP 12288:nVSVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:AQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C365231E6DDD82D6E703C7B2C86942769E75BE78FFA082EF660015B51F709E09838E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 cb70332e06befc4a686249d15568aa90fb3e8969b002518bb6d74487a3269944
MD5 a2e37f938e6d54949584100d96f9f5c8
SHA1 09185c5bbe7aabe9cbee7c25d9f4128f601d0898
SHA512 728345c7d051c07d2a2d9d1b1d84ad485e371190affcead1e0180e76659f68c5ba8795fa8a8d69af8e8e13dd6fd27db0e33d249df7baf79b7af2bb0117a7ad19
SSDEEP 12288:TaVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:TaQCBq/McxvN2T/u1mWXMHM9
TLSH
T14565231EACCDCAD6E703CBB2885D16BA4E697F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3bc59cff31b68e8fff5c6490633d642c9e8a0218a4ca18e70de2c655a1ab4929
MD5 89aeae4a53a210f1d0c80a23d01c9b5a
SHA1 60541121f055e898a6eda340a0cd5dee83d182e7
SHA512 112ae66bb3217cff0c784878e8d95fffa7d5bd33183e66ac2c542a8099514987a4db7c835580dc569b992c88b1a7abf86fc672a7da13d1eaebb62bc465ce444d
SSDEEP 12288:8lVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:8lQCBq/McxvN2T/u1mWXMHM9
TLSH
T12B65231EACCDCAD6E703CBB2886D16BA4E297F7DFED480B6761421712770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 55cdf44232093d8fa9707554cdd0df697ca21cf78b21ea92e463c510a92ff823
MD5 2881eacfdb61e08f3e1a6dc88889d0b1
SHA1 8e90e31b59c9215b121604a927b81b31fd156a22
SHA512 9237d41f165b65282bc51d3820d3ed08d16f1d94d70affbdb9178e36df7586369bfa68bc9269bbafa51efc0794c94edc2b44b4f583022d68972c115a2bc9812c
SSDEEP 12288:PRVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:PRQCBq/McxvN2T/u1mWXMHM9
TLSH
T10165232EACCD8BD6E703C7B2895C16BA4E697F7DFDD480B6B61421B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 8fae4025e9bf213af644623dfa94e58c4c186c9c9b5884aa439e86d189fe5e28
MD5 916096e45e4f16b422c290e4e729d9f9
SHA1 2959c62926409742111cba6be52e7f8aa5aeb2d4
SHA512 c1a3f01d0c96a9339f698ad9933d9c46e41295ae4ef9d63aadd9a7cfe06bab80c3788a571494aa82f7087cbed6d6f12106ffe9af751aa8d062e2c240c79511f5
SSDEEP 24576:6ZMEzFVSOpQCBq/McxvN2T/u1mWXMHM9:6ZMEzfaCM/XxvYT/u1XMHM9
TLSH
T102850299B39418F8ED63823ECC158916D6B27C295BB0C65F13A436661F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0d39b2d96e2a8774726aaf39e91b26a31a0ec33e2a441e8de493eb3e8f0e50c5
MD5 3189e2c21f9cc82c5c95d1adc4104de4
SHA1 8a9a25955ee7884e0afe21b4e202d4fc75f4a734
SHA512 231a1178f8969fa0b141b8d448ef3980466cbc536fea441240954156645cfa3545ab26b180abd5bfac6df74fc103b4fed52ed5a47e598538d9437df5428718e6
SSDEEP 12288:dkVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:dkQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F565231EACCDCAD6E7038BB2845D16BA4E297F7DFED480B6B61421B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 da4ededf1260a19b47d0e85171d55fe4f922ae21736136d7ffdeb70188d85704
MD5 5fb1abb247b678c48e4602975330c7ca
SHA1 f83556a7727492c8d27cc2fff3d8e16aea8c0817
SHA512 dadff8ff97b78181dd226f883009cef634def312e2cf5aa57b6c4934855a41ea2f466fa9594e3ad6697be72bf736c4c9cda972274ea982841dc65136512886dc
SSDEEP 12288:VIVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:VIQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C365231EACCDCAD6E703CBB2855C16BA4E29BF7DFDD480B6B61425B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 7ab868d7b94eccbc60a36caae2e75a9f7b21a4a13f1c2a5aa498496daf979189
MD5 59a36d7ebac7bff080c39433aeea94c5
SHA1 1ecb5df05fc5df05d28b98959761e236b30d78e7
SHA512 43c1495129897d4045cbd89ed5f889877e40a072b2ef691fac4cd5963fb7eb3b42a0c0828e719c057a2a8dbd96edcdb25b12a04d9a19ad9410913193fc36d863
SSDEEP 12288:YyPz5L89VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:5zy9QCBq/McxvN2T/u1mWXMHM9
TLSH
T10275121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 071e8c61eae21198efc4e670ba2f0f076a58584da6278756404340bfc56220a9
MD5 de574a535ed1df6f885b85680e0c4f18
SHA1 c074d4ee001520ae16373da052fd2243ec6b1d74
SHA512 6f9de1feb0500d1111b0658efb7cf68cc04f50106276eff58dc7ed219e5f62707982028b2a565603edadd88a89441a7ffd058fca21179eaa66b8bc527a1a1ac9
SSDEEP 12288:GkVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:GkQCBq/McxvN2T/u1mWXMHM9
TLSH
T16465231EACCDCAD6E703CBB2885D16BA4E297F7DFED480B6B61421742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1adcef3d816a57f45132aa2bfa4501fa2c85f2c302e654a6a063ce4bd6253b46
MD5 f404223b64dfbd9826f0ddbc1970b733
SHA1 26e9cd0c4078934952b118762b55e3b070be3891
SHA512 7f252663e411c5775809be2e753a1aaa14e82e0183d567a2e175862c40f2c4f320710b1ced9056870df5455a08eba607d566055dafb5d658ff59938e4e03d409
SSDEEP 12288:GkVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:GkQCBq/McxvN2T/u1mWXMHM9
TLSH
T17865231EACCD8AD6E703CBB3885C16BA4E297F7DFDD480B6B61421742B70CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 9b97483bd3597f8a0ec7b83538b0e190dc879860ec4609e09bd3354ec7de3354
MD5 c0cb3175448e11a25cfb67cdd0e9a934
SHA1 63fbc89bb004ff4f7067f0d228d6715c7c07b516
SHA512 ef8571fe076035161d85a412c64b7f944965a8dc7b71002259af265cef09eb99fbed3b3a4cdafb754e26658b9bbb31949060d13ea73aa17db32379161726e35f
SSDEEP 12288:VyPz5L89VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:8zy9QCBq/McxvN2T/u1mWXMHM9
TLSH
T12675121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 edb312ee12996e91bc5690d31101aad7baeea80775e9aaca31f5875cb9467c8a
MD5 3d9766bd9a678546d6ce2f3e4a286c57
SHA1 a1eb3c9b2716b0625280129c93deec3b74f21636
SHA512 76df376a002be3c2db8810b00101a564bbce22a6d57273d87938e7d3ada14f2062068b1be68a77803e9de2b60ef67d3aa3b28387a423a494b9e142553ae5ad64
SSDEEP 24576:ATdaLl3z0zDjQCBq/McxvN2T/u1mWXMHM9:ATwLljfCM/XxvYT/u1XMHM9
TLSH
T19A8502A9B39018F8ED67823ECC554916D6B27C2A0BB0C65F13A436661F333A11C3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e02a0c9e54fe783a9f8fe394885a802bf793afb2e0aa35d02ecf9c1a01ee33aa
MD5 0a7dec366a4a273d74790a9149eda7f5
SHA1 24ae0f705ad5d4fe045ff306a38e68baa7107607
SHA512 bc77c04cab0941d77d32b943cdbc1aac81beeb7773fdbcc775c9a273322e9b6910d38b2f18325fb9202fde0ec069cb87131cb338864723392bf38336c4340bfe
SSDEEP 24576:435d9CHKy7GZfQCBq/McxvN2T/u1mWXMHM9:C5d9CHKyaaCM/XxvYT/u1XMHM9
TLSH
T19195CF94F3E810E8F1B7CA358D764512DA767C695B70CA8F03A4265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e3a1bb42f2f2f3b46a727cf6745a572820e497a21bbb22411f6f2e79161bdc69
MD5 f9be8ab320833645bae8f4d07e0148f5
SHA1 fc8ab99b4ccc34d5f3f7f9bf98ff09e393b8ff88
SHA512 5142f57622680290eb482533c95e968e9514f386482197b254dc9920a78a3d4e757fcd7864122947c779cfc95d767277e3be7a096c1b8479b39d95490af01cc8
SSDEEP 12288:NTVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:NTQCBq/McxvN2T/u1mWXMHM9
TLSH
T1ED65231EACCDCAD6E703CBB2885D16BA4E297F7DFED480B6B61421742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d40479837b9e97f6806ee96883fdbde27b9501437249ebced45fe5b57353e4f9
MD5 7685b3e051ca9389a75e1a23f5be3c70
SHA1 f38c0e322c4493d9d3e015077864a4c72b0468bc
SHA512 8bcdc8b4d489ef3d04557362630505de7a1dbbbd35a4d026110b5b46fa105441a21615704d7f15e44f9f21703b830948fa8f3984e1f42d57eff3c1de02420bbe
SSDEEP 12288:pdVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:pdQCBq/McxvN2T/u1mWXMHM9
TLSH
T19065232EACCD8AE6E707C7B344AD167A4E697F7CFDD480B6B61424702770CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 fbd4baa816f0136f6ef9729fece27cb17caa030f1b39c1e5ac2504cbe0636a33
MD5 7aa1241caa7b831a5cf741cedae067f2
SHA1 4c81639f977a067494f3a6b4db963e27e82013ba
SHA512 0815bab7d9d92cdac43eccbb6549505ebf3ed9c1c70a6142106501cf95006675469bc46b45dab2bcf67e4a23711acc056cf169aa60848cbdd1621a21175bb7d9
SSDEEP 12288:nmVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:nmQCBq/McxvN2T/u1mWXMHM9
TLSH
T1FA65231EACCD8AD6E703CBB3855C16BA4E297F7DFED480B6B61421742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 d7d813957d0b63dd068b8ea6b9eaf222b48e42731946da740948514b11e691a0
MD5 930684333892903b37e3496a73223dc8
SHA1 7034e5d0925219bfd13ab34f7d06b09ae5304b76
SHA512 baba166d8628e3f44c2a40b547b47ff9f64f416b80c30a6a69bd771e691ef4bba4394a73e284c216bf21c10d4d20ff25fafde7693fa108b86e1bd049e03e26b5
SSDEEP 12288:IkVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:IkQCBq/McxvN2T/u1mWXMHM9
TLSH
T14D65231EACCD8AD6E703CBB3845C16BA4E697F7DFED480B6B61421742B70CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a56dbfbbbd5a90cf0d03057c1c5038999b793db7987d73b32b1284fb4528ca0b
MD5 4a406b662b5f586e3eb22f19a237cf4b
SHA1 17d173ac3b149d5585ba964ebf00da99b5872455
SHA512 06bbc14c3b783da3699d49eb029fef14f5436ac31236137b3f1f8a049b7ff8449bf326d6c64a9a0847ae098eb0fb96960b65866df5fa0088d3ec34d64b665ed3
SSDEEP 12288:dTVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:dTQCBq/McxvN2T/u1mWXMHM9
TLSH
T15C65231EACCDCAD6E703CBB2885D16BA4E297F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 7b96b5efd164c6ef9e3fc4786ffaef7694fbb764235aee403f03db522c299a43
MD5 a8730cfdcaccd6da93930bb65037fff6
SHA1 2d23f36d0402a7b479975f99fb5b848b9059b3f2
SHA512 32d133679010f762bea5e5489e12c38c082091fb9ca070b33cde046b802fbcddf81e8f0cd7545b95668a24b42ab044ae4258d77c8786935bbaf3898165c0ad13
SSDEEP 12288:xsVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:xsQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C265231EACCD8AD6E703CBF2895D167A4E697F7CFDD480B6B61421742770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 0be3ad36bf2f410823df890c0d0cf70a39599023d0268fbe045e1682b3983b63
MD5 64be9970ca1522e9236aa618dbdd93f4
SHA1 6d5bd8576fd4d4dbe47bc1f0c837a935bb4c1232
SHA512 b628a3552fdfe1261e5b1e88136b77208710f89144a60d9c488720f647667dfea68117d14b4e48d137ca53eae5bd16e851dca90c43c29646115ea5f11947eb8c
SSDEEP 24576:+fwv+k9RX6wkyAIYQCBq/McxvN2T/u1mWXMHM9:sMnYI9CM/XxvYT/u1XMHM9
TLSH
T14D95CF2DEBDC44E5E1B7923889B7460AF6B178691B31C2CF129A53AD0E33ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 359b83e5c163093fcde91aa053c6007b670e6514bdcdaa52c50ab0b9636d24d6
MD5 f2257f13041dabb97c6e8e5c906dfea8
SHA1 f1b6569d6765d65f63262f696e987ec598d40df0
SHA512 747767aeb66beb955657cbae533dac8f7dcb14fb22bb9ef311ce2c8ac1b28be592cc3e57d15031bb89abb6a9a3ae93a4204136bbcb83a046b4ac910f4acae197
SSDEEP 49152:cYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wCM/XxvYT/u1v:CySzPTM/XxN1cHM9
TLSH
T1A1066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 54a1d5e2e823594e2afa061ba30295ffcd1544c90a54165d34d674e3486b89c0
MD5 033936adf6c931794996c4d2f7727ec8
SHA1 dc6bd042cf1c65e3eb27dfcd11851db9278d3123
SHA512 783b9324021b0f2b37143dcc8598cdd1ecf0e8530f98bcdeee594b71c5a8bdc98372ff5d76cd49ca792f19d09cedb16ac1c4804e6b65314b17a113a01f37c877
SSDEEP 24576:q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY5QCBq/McxvN2T/u1mWXMHM9:q47JUQj1irIhCnDHUPfF/ACM/XxvYT/c
TLSH
T1DA65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 111269abe9fb25d2d8432121dda269bb5374c17815a2464c269a8e2bfbcac1ed
MD5 75dcf7c63b3629992707c31b2acfb43e
SHA1 5802b2907e52e73453595a50c411265cafb98e7c
SHA512 33b87c98a0e43ed44299e30ef95558cda46ca1c9953f6422f7c00550d8e87c1ccd146698b93911e7af912e77d2bae0c7fbf852f2aa1456f3a8c6ead7f708efab
SSDEEP 12288:MzsfUVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:LUQCBq/McxvN2T/u1mWXMHM9
TLSH
T1AF75F01ED29842E8C15E9276CB594A51B7337D349BE0C3CB62D0F53E1F359909DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c878a42bcb529a78ded5de2cff3105e07e17018a30dee110de9081245b75f33e
MD5 cb7f1b35068dbb3d9e823ea76a30bdee
SHA1 0b5949020f7effce87dfcb6977d2f497112342b3
SHA512 885e55929449e2868bd2f7e77c59706883e5d5be25dcd00fbdd402da7d4e225eaf0f309c649ec35a06faecd20fd8e6777d588b58d188d42318f5601d2839b7f9
SSDEEP 12288:6uBB2K4U3fbNK3TaihhJKrTWn+nmXTfbO+p+ar4yE:6uP2LUPM3fKranqmXHO+pl4X
TLSH
T1EA4517007626DB4FC6A940365E36D6CCAB70BD05EE046F0773C9873F9476A59BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 ea5526d6d24428770db22de00b975dd18106f9d9e90bd30a1b6e717f493ec1c4
MD5 412ce2045f6103c7cbc914f24f6fe8d0
SHA1 629fa56fb2528e163f567e8e6eea8fb0bbc1ccf6
SHA512 1e80aec3730139f70f7f9b30581015d9fc0664ed64af1c16dac44c59a5d3c5608cd50dcf8bba250d854911bf3ce4bb3d8c5073a24a076468a6d332ee0801189b
SSDEEP 3:OlH/lyUQUprUtNRiuARl3yjIl/lllo3mCllltGlslslslslslsl62F:KgtUKzVADOIXymCtEEEEEEE/F
TLSH
T1888192196B204A60EABA717044C543480B22E149A9C8E7AFA10820D15D013A8DCA7628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6cf251f3e1c9e22779ea248e784704d0f8fc2ae1aee31e27cac320f4bc33861f
MD5 35a96edc3c7c91c9002805c19d0e2ec8
SHA1 7ea054a916e421f3429a6ae4750ec4ba965d1f00
SHA512 9ff82b557b6bdeaa2947f75b2eae9d26326220722f042371ad28a761f957a63b7fb6c47228a6dab436d25b93c971be0a87772063d4a5ce3e7a49b872410e7a6b
SSDEEP 12288:vb2RKT91t9e4qxFu1J2gFDWFlc4v+FvjRThFfDDnmlxhTQILR6NaCbXMXKRlMdSp:j2RHzxuFDWYwYL5edQCM0CbcXMedSp
TLSH
T1F555190065B7EB4FC97E503B033296CDAB78AC06BB453F0573458938986795EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

839c341d4b315ee3.bin

Path C:\Users\Admin\AppData\Roaming\839c341d4b315ee3.bin
Size 12KB
SHA256 474133d7d299c2fa1ee75d480fb53e71d91d91247744e4de9a7da872ea396af5
MD5 6480c91cebf904912a433401bff2835f
SHA1 653e1a00055adace9beb042e3dde114018b3cde2
SHA512 a2f025370a8e6f723169a7982a65e4bd945f75b941860ea58082c9a1d9406094574db7d5733eabb638acf0a078c1f7674d47bf0c447ee2593e86c349192cae30
SSDEEP 192:n0vap5hQIloUsD3mnzXcmEGtmQos4rFuMaDLKRHErUsCJNvp6cUzygVyR3PLI8bt:n0vapzQILsDQEGIFT3wULR6b4f8w3d
TLSH
T1BE42C01FFA8243A60B7583EADB058CD8831962913E5281B744D897B41B3E1B1AA2B659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 bf314296dc9e7b58db557f779958d556da60a9b38fc22d735b187db08bedbc5e
MD5 81535cac8429940113eab5349de962c4
SHA1 899cde05533b04fd9493dd4e64692d72a2cda3b0
SHA512 9ed0926141dec3ae9c22841578373001c6c77964f685473f08f800287fa9177067a437a2732907e8ffc87bd2602275f93db50e9e26894ea02dd8c08a9b18ccc7
SSDEEP 12288:iL7cVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:ocQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C865232E9DCC9A96F75787B1446D52361E2EBB78BF90C0E7B50022B52770CE19C39E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 850c5f4e1b44c7e74143a0934c9f4692a1d45526f6191c663d78a4fc746ffcb0
MD5 2113ce036103ceffa765ec66b36228b4
SHA1 c589c8da0672ea0e5fbf90d1967e8d5d436c3af3
SHA512 43c91246b37b503f8fbcc89790fc6e801f5e97d5bac41e2774aec8a29756c7b807e09e82d1a6381d9a5f69e920cef3009cb3fbf6f2b6ec681048f67062006d44
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYeQCBq/McxvN2T/u1mWXMHM9:+gb4mBIBhGFGCM/XxvYT/u1XMHM9
TLSH
T12C65AE1E22EC02F5E1FAD2B88DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b3422240782aa63758f48071ba60b6598ac119e2df866ca8827af0dad1303ef5
MD5 c9134e82e669871bd84c4e492bcb6484
SHA1 91b3e6fed103542839c31304ba316e40712aa050
SHA512 ae3a5c4cdb5bd5480c5045040d697a7004ee7d86410eb68cbb7571e6de8d3fc2f03e72f95208fb9036597ea7f2dc54653955e9c25aa42e7b4fa23bce9a4e0bb4
SSDEEP 24576:nG88u8FpJqH1hzria7/mpQCBq/McxvN2T/u1mWXMHM9:G7ZFPqVoa7/XCM/XxvYT/u1XMHM9
TLSH
T1DE95026976E502F0D477D13889864663F6B2B8251364EFDF07A88B511F23AE14B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 646ce58a7f4264f155f9556ebeef1d8b4cd250f6cc66b56ac9a03057bc7e9b07
MD5 94afe36c17bae50cf73cd564092c035a
SHA1 afc8312afe4910c8419918c2f4dd9e23f4ad79e2
SHA512 373151fcdde9b412267dcb4057a2eb18635dd8c3b08e673b7390bcfdcc1d66e2f8d74091af655abbfd8342b7f15fb6ee879cf361080447f30d6962341f2397b0
SSDEEP 12288:PHvUrBFrEjwaQ1VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:PPUr+NQ1QCBq/McxvN2T/u1mWXMHM9
TLSH
T1AF85E12F66EC18E5E676E17D89864719E772B8721751D2DF02A0817E0F23DE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a17e3f92f93f2aa4e39602fbf90eaddc3eecf3714b0bfed9a69d341cb8435dbb
MD5 5c9a30741a86c2abc354fdbc53dbdf9c
SHA1 496634bda96ef6bd62f957c6e4fe39e737e03317
SHA512 d155561da2bae1ac4647e656d1a601090a77d09ae4705e14f3662031b3362dde0700760f34d0fa851c8ed7b291bf2bb9d907567c94e7dd3ad191989c47ca1575
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKCM/XxvYT/u1XMHM9:9G05lO43bgM/XxN1cHM9
TLSH
T1E7D5CF6E62EC11F9D1BBD17CD9C6460BEBB23825033456CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2d249751fbf88afbbf7397e31d9a9a1c62be18560408f385e6f87f4366b289bf
MD5 28a266278c7b137623151e4caaaefbd8
SHA1 0e2e16a3e122228497674137c78c874764c5172d
SHA512 a5df352ac5949cec00e5d41e8b5f3c27066b32f6a2ecc56f0939884ce18ea30dcee7871055b25f2fc2b602137905ac9b9689d23f4ceb4b042e420f9e588a4517
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHQCBq/McxvN2T/u1mWXMHM9:8a5POZ3+Jt2pasx2+myCM/XxvYT/u1X/
TLSH
T1B265BF5EA6FC01D5D1BAD17DC583861AE5B1342553319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b276208a8600b4810b8a3034d94dd7c92f956eb4287dcce89c823b53243f882b
MD5 9e18a7890e4bf4dfec5b26a0aeac0cf4
SHA1 e984fa1f100683e74f8cfa9bb52ec434055ac5e7
SHA512 2ceebbe92b9d0c8b52b854640784e768d29303f4f82896ea3d760302883477fa8e6edcce4fae63880abd3b2e826460a4410f9acd21939eea05b8e5d6241b8afd
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkBQCBq/McxvN2T/u1mWXMHM9:TNc/zEOVHF3CM/XxvYT/u1XMHM9
TLSH
T1D7858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fd4ea11eddd2b56a3fc014a7e7fadf5beda9759537cbfcd24331ba2a5bab10b7
MD5 db5ac06938a7f614afc1b27877ce74b6
SHA1 0d58ef0497d50c54c76d0ba688701d8c3049f815
SHA512 06ba5504d241fec91a2d8cc23ef50cb0501413e27764d3128e4836533b0d88929e291e4d9d0d16c8376cf396234c3de84600738e6645e31cee54252967216f9a
SSDEEP 24576:w8kNvNnaFeYhJNtmZBmv/QCBq/McxvN2T/u1mWXMHM9:w8MwBtOmQCM/XxvYT/u1XMHM9
TLSH
T14355AF2EBAF846E4D1FEC6B5CD238512EA727461173293CB5290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 6df85f3084a928f6e621c85d86bfff7f4da147565a4c1a4256f017fc3f080924
MD5 fc800ba44a141f7643191d86775f7066
SHA1 bec4478b92ce0f5548e5587fffe5ffdd892afebd
SHA512 4a86ecb2aa5c095327ea9979fa61e57bf40725bbc0a76a5708d18f5ccfd1d6ffcd1c5fdabfc60b3d777ed6b5fbbbac1ef2c51dda0b821c752dc7b42f35032a74
SSDEEP 24576:dD3FHshBIYQgAwQCBq/McxvN2T/u1mWXMHM9:dDVHeBIAAFCM/XxvYT/u1XMHM9
TLSH
T16895E13EEA9C04E4E57BC2BCCA638A06E77138BD072155DB129481B51F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/248-70-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/248-215-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/248-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1160-81-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1160-89-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1160-83-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1160-311-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1708-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1708-103-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/1708-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1708-12-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/1708-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2864-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2864-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2864-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2864-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2932-151-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2932-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2932-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2932-143-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2932-149-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3240-62-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3240-55-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3240-56-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3240-66-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3240-68-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3296-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3296-0-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/3296-8-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3296-7-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3296-24-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3296-28-0x0000000140000000-0x00000001402D1000-memory.dmp

Download

memory/3596-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3596-330-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3596-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3596-117-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3596-123-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3596-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-326-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4580-94-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/4580-93-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4580-99-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/4688-138-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4688-32-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4688-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4688-38-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4688-39-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4864-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4864-105-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4864-344-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4864-111-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4864-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4864-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-130-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4996-136-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4996-139-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4996-329-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5596-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5596-166-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5596-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5596-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download