09d51e800d0fb01f741a91782ffc185a0d9438d71966053eac08d6e2b289496b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.5MB
Sample260629-ers6yacy41
SHA256 09d51e800d0fb01f741a91782ffc185a0d9438d71966053eac08d6e2b289496b
MD5 a8d4bee3394226df08e01ef84596aef1
SHA1 963701b058ffaea5bdf1e31ee354d63980ea67be
SHA512 e9ccaecfe8f644ed620f214895450d4532f96242f04d2d4796683af4bdd3acd8860cb1dd8726dc50ec52c6a184309e2eacd7584c8d8b279a0fe2a373baddb7c0
SSDEEP 24576:TbtRszoh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TbMohLNiXicJFFRGNzj3
TLSH
T19765F05577E80CE8FABB8239C9628505DA727C554B30D6CF13A0065AAF33BD1DD39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3756	elevation_service.exe
2088	elevation_service.exe
3328	maintenanceservice.exe
3912	OSE.EXE
6092	PerceptionSimulationService.exe
3248	perfhost.exe
2308	ReFsDedupSvc.exe
3256	SensorDataService.exe
2712	ssh-agent.exe
3244	AgentService.exe
2692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\23f4b03f585f03fd.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acd3ff507d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afaa79507d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5f73a517d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec85eb517d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4df0e927d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fa9f8507d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7d62a517d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3756	elevation_service.exe
3756	elevation_service.exe
3756	elevation_service.exe
3756	elevation_service.exe
3756	elevation_service.exe
3756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3244	AgentService.exe
Token: SeBackupPrivilege	2308	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2308	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2308	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2308	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2308	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2308	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2308	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2308	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2308	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2308	ReFsDedupSvc.exe
Token: 33	2692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeDebugPrivilege	4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4552	2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4572	2692	SearchIndexer.exe	101
PID 2692 wrote to memory of 5780	2692	SearchIndexer.exe	102
PID 2692 wrote to memory of 4532	2692	SearchIndexer.exe	103
PID 2692 wrote to memory of 3396	2692	SearchIndexer.exe	104
PID 2692 wrote to memory of 124	2692	SearchIndexer.exe	106
PID 2692 wrote to memory of 1012	2692	SearchIndexer.exe	107
PID 2692 wrote to memory of 5628	2692	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a8d4bee3394226df08e01ef84596aef1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa06872481bba4e6320558aafe101dd8e8a1a67c8ad2a75ce7b07aeafe6a2401
MD5 59be9378432a5a629aaee5a896d153e5
SHA1 a2f38c6feb69951d5ebf817255c8ef4ee9b18a65
SHA512 1beef799d0eda9ece93e0e479ebc12d1a8bc8ec741c73a2b8e5123dfb96cb65624871550130f415fb858af82f7650f81724eb2598ef9e1283bb48a685754e85f
SSDEEP 49152:xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn7LNiXicJFFRGNzj3:33q6mjB87wRGpj3
TLSH
T140D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3662457e122f1ccb37a62cc6f2db39747e32daf2c6581382db667e1b2052ba48
MD5 2960c85ebe5b81e1a358a3cc1ce36ce9
SHA1 23a88def873fd03af9ff614c0664dff9ee702e2d
SHA512 90dc0ab3144edd3cdfc194abf177c38c49f4368014fb1343306a0eb70a1fee0e4d753c8ed0be7601b382a2ac7f7703cfc354e5bfebcd17bb4ae4e46b7cdc44bb
SSDEEP 24576:jXYfDtczAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mtchLNiXicJFFRGNzj3
TLSH
T1BE75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e73b8519ee208b294b5728589178dfeb1011586abbcb0aac133f6f721b32a80c
MD5 ddda9e03dcaddb87d6371b55e29aaf76
SHA1 7ba298b77359af64902c6e23653bce2f16256829
SHA512 6b715a7b18e6eb8306d82b9ac0eebf7f99548ff832312470ab1e7dc28e18d7e386e2d2b4e7aafe34fd878e56f636c86684d19a5a1994c1f9f95ed142006dd933
SSDEEP 24576:z0Le5ji0hmxhrMj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zPji0Az6LNiXicJFFRGNzj3
TLSH
T175859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bd009c3576c256c36feda0f1d2f057b3ca76dc81e1475bd34c471a8d1b090b28
MD5 9716051f1fd855ba9f4e3be11b8269f1
SHA1 809f4ac1e2190e10bc1dcef8abe45359c9bf3de0
SHA512 e7a708c521c23b802eda108c12c6b0ceac4c39f41a91a872af3d350344b9a128c073a626ef74420c66d8725a881a0d4db823e2de24f3478fc3dfafcfa805c000
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWj6q8wyuR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A/ezSC6vUzPv+HjyGLNiXicJFFRGNzj3
TLSH
T1E1756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5109945c66dbae48ae5f6ceb833bf46716a334899c46fab893a421744de1b552
MD5 22f9f773e5f31a3287ba925458af901f
SHA1 d6bb99ff17401e15d3d1ba47c96ca7c2c408b510
SHA512 10c971b399b505cf9179f6c266ff642011edc157d075297fecf566b4927f0cab3bfdf75fbaeca38884e304335f324c3001efee99417a1850f19897b38eac157e
SSDEEP 24576:QVbqPb88hv/l+Bs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QVO88hXl+aLNiXicJFFRGNzj3
TLSH
T164559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7ffbf8c4dfcba36caf41560e495dcd1a884ceb8e90beea0b07b221f3d931a69e
MD5 da9070e66e055ae98189ae2e6992f572
SHA1 5464bbc1b43c60567baf515547524c9366608aa7
SHA512 7f29e3a2d05571ab929e20d9351ab49608df3ba3c001e43e5bbab7f098b59df6a5b889d12b22190621f2585bd01d953d03e9599ad45666bfbe0b79874fea89bc
SSDEEP 24576:nG3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qLNiXicJFFRGNzj3
TLSH
T1B45523D3468854B1FBFD003A867A5828B5845E2CDA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0a674895514f40f41d395d26c513154fc3e8d638bf6075b69f7174f51223ad21
MD5 2986395d1101908f05e1e3c0f9542f5e
SHA1 8fb586ebf0e4f0fbb0ede812b2073098e833f69d
SHA512 6e7328b5a8094f9a75f490ca4725246954742440a50940cec4fff836665b9105fa10084add7152605f6a53f6d932bece2b2f815a28802686ce2ed47d30a0fbe3
SSDEEP 24576:ZJIUU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZJIUULNiXicJFFRGNzj3
TLSH
T11D75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f7644a261577aa5a4b568a071a925ab7fb06150898fccf6ac90baae20b61b069
MD5 7b356e77c24c54e7a33cfdace0e0fb05
SHA1 b5dd2a788ffb066ee9c30d11be46cf2b17fa2289
SHA512 fe28282b10ebf19e3965630c4d5fb900a65b392f037ecafd3d12fdb2def0399ba18bad04e695f5a3c95774b82863d55d33e24d38c4b51b78ea617cf6e0b12f5b
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:4QvGAdlCEL8c/WRNw5CB7wRGpj3
TLSH
T114266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 16fd19b292284f3b7d9862a22f14c1c5d5f147bb9e380a8d8f96e4b1f329bacb
MD5 70fef35f3468b842af0732d17676184e
SHA1 600cf742c77206c5db6fa0c6d14b85d4426823c6
SHA512 cf3facf38a804eef650b87c79c8b44e7d6364a1312477b7726383b523afc91be20de521e5d9ae82f8af96cb7ac97d95aecf53b074001b993a6a3d6d0eb2fd86d
SSDEEP 24576:pfewsAjq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VljqLNiXicJFFRGNzj3
TLSH
T1E375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ad2bc25a1bc9709264276004c3a607e21a90a822d66d7bff2dbd6bc5c2024258
MD5 994aaa1176b76a2fc5a10d37b9616067
SHA1 d63281777bd00f8d495cbab0a555cf3de02fcfc2
SHA512 19dd96ba15c709a965610e65f0368e4502e35ee35d4b6a133f0b99e8bda0911a7005016143729053c17fd89db5dcd8ca94acb0d299235e20be88eb69094c8f20
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGF9:PUEtQevvqc2W1cpV20I32q9
TLSH
T188474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 156a28a4ab5a37546b8f8b7fa43bb649010c694c432ec2452011639450f290fd
MD5 011ae3ca9407f9eb675b6c60b827dd28
SHA1 e3026d812a2420d1045d016232153e2da06f3c9c
SHA512 0f6d38962bc0688491b9234c488b64182135b1c4231cf31fb74629e591d0f13b0424d8cc5016e5e69daa8066d770fc2860348c61273ade031a6b1e9a6aeeb9b0
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/zKLNiXicJFFRGNzj3:hoq2Vjnm97wRGpj3
TLSH
T18ED58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ca8b7aaaf6fe977719fbb55cbcf05f98490a1070dc45dc4078176cc630a3ab6
MD5 a1c403ce37900a1e059616e9f1cb9ff1
SHA1 bfb08b20cb20ee0ad6a4ec8ff40097190e8adaeb
SHA512 1474ae7006243ac0ca379ba13216b84a0eef67ba55d34cf023adafa049aa0cd6769d8a8a64798de17d657a9caa51bd2c7ecd7897490d55c0f6dfc5bd83b977ea
SSDEEP 24576:8AhGL6IFoiwtA5l7S53d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AM5Foiq5tLNiXicJFFRGNzj3
TLSH
T1DC359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f56c68ad1adc2307be916c5b32b1aa9c8e21987e96c37f095aa7fdc6981d01ed
MD5 7e5c97148f6f6a57f1c27679d8638945
SHA1 85ea65d6f62495ed4303db48f13118fe06e73e59
SHA512 e0dd0ae2bf88db2c94718a90408d23814ac3430326b277245952fde811c19154f6224e26976048dff182ba03451ab7b544876e95b9f0a2b519ec9ecc6841dfe8
SSDEEP 24576:LwuROWm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LwSO5LNiXicJFFRGNzj3
TLSH
T17665F08672940CF9E9BB41398657C036F7F2BC152A21DB1B5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5c18fe3f435c74613c58c082fc3dd037b92ff46f6e740e28ed137293411c7eb1
MD5 664732898bb3a7fcc8960ed9775cde26
SHA1 5cd9aff7654a33aab906398d445fe628ba7de433
SHA512 187c73b2f6828546eb84763f0e38afa8bb1c2b66ce2eea2849adfe06c159fb9658f3d213aaf9ee83355756384851cf95c6de8b3ee7e48803bcf568accbb285df
SSDEEP 24576:AZur/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T18755129622C420F5E2BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0109012a94cdaa5c2850de7cb73b7fab0ec452b4fdf41a98953999bfd8b422aa
MD5 435f76fc2d3cd4cb190f919122e287f6
SHA1 af8ef8f86763e72dff77683b114aab5ef58b8ede
SHA512 f0578444f8980a8bf02d6510f29755854be34c7862ee4cb9af205d8774023b28e0509e5a2c1287224ebdad5dd0b359bf5ddb2b2b2c93e197b8bc3402de6e46ef
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3w7wRGpj3:lQyiKanX+PNcF9
TLSH
T170667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0b8777e2d2488e22cfa591a74117b5c48b06fe8193333dd0bead03d30bf50077
MD5 5ca322797ab6f25c9afc992a68ccb84c
SHA1 cc70d2a295462151e89a1bcdbc1a17e85fed649d
SHA512 5da9c9d9066a94d67870b68d58cae137ae688c7125d5e7b347f7571f8a78cb78d088f2a93fbb77c68d217da89d682820c6a850d358bafc56b8eadb09e66402b4
SSDEEP 98304:gQRQyi36YOcPDLvw2gAf+PN3w7wRGpj3:3QyiKanX+PNcF9
TLSH
T1AE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bca2a6be06ce59a318f73180cefc58504f5cd46641113efb2ac38edd5771e01f
MD5 512a019fbd0bd3c0a672f9d7598dc107
SHA1 ad4e3fdfe24bb87d9cb461aa64cc62a1a36878cb
SHA512 08e5602e8dc532f58be4c18665e7cba50879111e93aef345d58620ecbf6453869955a8c715fa89f17df8c9e74d277232ce7d7d7c8d589dcac2ede92485cb3397
SSDEEP 49152:k68Qg55nhkeWu7PNU3/6LNiXicJFFRGNzj3:OthTRc/67wRGpj3
TLSH
T196B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 843563818e61f69caf567be3cdfc4b774ec9cb3e131e4f0fa8288a62e82948d6
MD5 2c7719cdda23729eb7a6527de7114f3f
SHA1 99d3618e0d3ecbf0a08bfc17b6f761b883380a69
SHA512 c2de7f03b26906cb372e9d92825550895bd93725282f2289f129443e9b45999c544bd176eea8a3ce0b097cdaeea654b3364b03b894385122f522d58fc44cd33f
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZ37wRGpj3:XLIHRWhpF9
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0134553588b53e1768260d7b0254a629185dc519395bf8e881872ab6871a5067
MD5 5fec7f21c3fb03a1f45816fc5f4588c0
SHA1 caa0ea24d9cb952f84cab833d2842db1290bcb67
SHA512 41dd4a96b74b68eb6b981d568ffea28e11cd9293b6f96cd690db4f9bbf02c5106e46272b8c2685035db185345fee088770316554943a1f0060f1ee9d44ac5a4e
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYLNiXicJFFRGNzj3:5u6JmIxd2dY7wRGpj3
TLSH
T175D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 da97509914261101eafc9f5741db0cb9aadefbeefbdbc9f9e446f51342e9235d
MD5 ff6e9bfbd78fa3c18bb28a2196e7d249
SHA1 3fb779e21da31874be4c04e48e2d9085f1d1e12c
SHA512 3f82b6a877a0279642a686b640b2359942a89a4e17d55d7566f724a4a45e2bee7e931aaf5a9127fb2d91b5094b8d5f623c8b98a73cfe8ac75e538085ce38011d
SSDEEP 49152:b1hpsNoJpF1A67U44CwH7R4x0LNiXicJFFRGNzj3:bmifPqR97wRGpj3
TLSH
T14CB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f0fcdc4ddecd14634180f3b181cd6e3e56e6a8781d91c7653d1041ebbeae2cc0
MD5 7e43cf44f7446e7d7090ccfaca622fe5
SHA1 5348924883e45ecd456c79bf069b4dfdfc2e5e1c
SHA512 c453468bed2de13e80fe7e1245a6ac47709f374f7d8675b7a8d6c5be87511a0d690cb9a1329dd0cee2ffdc592cc367e0ba407ef26f7d0df57859ae90166ff28a
SSDEEP 49152:lSuZQIY0Be2KkRVtOnks6NMHqrLNiXicJFFRGNzj3:r5dKqi61r7wRGpj3
TLSH
T1F5C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e9f7fc6d6fa56f77a443d4e8c3bec96ad694e0271b549e6dadd65d409c2e8da5
MD5 244760fb030887b5ad5e50d7648d5893
SHA1 265016e0180c09807a90ad8e48cd46b6d8814c5d
SHA512 9e41b72016d180891d80c85afd8d0344750a544130785c95b141e03dde3c61e2a4eef24e06d2de9ddc395be5a2473ea14533f257ee41808e8d2f3047f6685e3b
SSDEEP 49152:GhtSn8EApI0figjgiDn0AP5wILNiXicJFFRGNzj3:HX2iWphZ7wRGpj3
TLSH
T16D95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cf8c1f98399ee4643bb6e1953a4a6828217880afdaecddfbcfdebeb1816af8a1
MD5 ef678ac403af2c6bf173be44f867038f
SHA1 f94d2b478284cdbe9efc868d50de620f18c3ec55
SHA512 b44abf62b0fff72bc72e55c97481f0666035a2862bfb7de18b11c6fc3a67f7f050502ed01cfa8335b17a170b252327a6fbc50a5e76c748895045458945b250bb
SSDEEP 12288:yAAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0ec87be3510edbd2d5d63f49cb38e53864c9aba76cf77c90b52f696113e61549
MD5 4c7d0c3fb3b27e6bd1e4ee4e84899d4c
SHA1 ad934811b58952dd4029bd59b009ad354a686526
SHA512 5e3b8c40bd8ebf678aa61ac97b1d0fd305d0020029f11b9d38443590d4320488f0586c7d9738c8f72072d5e311849483d20fb99a95a6b45f563470d9a8b78130
SSDEEP 12288:NLAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ne/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3558955B1EABC003AC6754428F5881E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a4054d87d911685468faef958e845fe0d543d1872ad4254ee68cbff66144b133
MD5 dce7372ad6cd33e19a82834046579c47
SHA1 caeab88b063933644760ca0a074d9eaa973cf68f
SHA512 671f3a3ceedf6a052a71a44165b24d5a42b39ccc9605036469cb6aff5e864804d846644794cdb9b7009fc9268cea18daea4557c97832f92be254223713e4dc09
SSDEEP 12288:INAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A5523D2558955B1F6FC003AC6764428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c7facf2d88b273b4488005c1a7a433f1edf6c7aa90255f6268e61193f5276546
MD5 07753f00b174d2c0b6f8ba2ea2a5855b
SHA1 aea0e1547d6ad44f0182abf401196898f60c4e54
SHA512 01eb7a98c8c3174fe17ec892322ecc660dd64bbdf81cfd39c507b7794f024282e1671615f39b56671dc3de0e55acc025f1162b306938b8a65a5d6e715530adb7
SSDEEP 12288:qVaAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E552392168900F1E9FD8039CA764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 653138022b151a68a5fbcf9b7224dd1841c6868d2997496878ae483c694902f8
MD5 0bfda55871d887794ef6e427a531fafe
SHA1 d80b3dbd4132a03e1d89dc89038aa7f90f5bf573
SHA512 401b6dc80cac3d998de32e63dec51d8cecf2d73dbed4935f0b6fb016060aba4fca81cbc1e97832c157e3f489c089b4d371409cddf0fee30b75d7c5d5c58fa49c
SSDEEP 12288:GyAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D2548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 473071bfa290d374fbf2633fb8bcb8eaf7fed8543ce62ee5879c568570426899
MD5 e9119e8779d0efc7abad113a83a828ad
SHA1 6dd15c6e576261e234730b82f4cccc4dd567f4b6
SHA512 e2a14dcbcb4f38ccf2c92831897dd286afb994157d8908410a587eda5104b60fb3380aaea1974bb5b72a8ba53d9e0a05537b720b0afbc136231a94f5d79f898b
SSDEEP 12288:cnAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3558945B1F6BC003AC6754428F5881E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e20fe0db17add3c880cb20eddcf92bd7f8529d610932f16b27807bbb04459583
MD5 fe014ebf11ca039614ab44ac92902667
SHA1 e379063d31c32bd2c34795ede464d6f5eed1447f
SHA512 7264c942a70f1a04fcad1f0df663c9085cb20b8def1b2bed1cb2ee35dc9ef7bc17b150749ad386634a9b143d920aa0654d17c4cc2a27412b6a3951f840589d72
SSDEEP 12288:bDAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D15523D3558955B1EBBC003A86354428F5881E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 862eaef580c159c5f07d2c28a674fe1419c76cde22bff2e319c4e2259064cf63
MD5 a66c1f17ed867e91ee223edb898153a7
SHA1 b3c13c10ea45b5c2773870c7339c0a7fd65a7dc2
SHA512 2ba0adefec3365ce10d33445b3b37750db388cc786f8dc8020f29e0aefa30d3e96792d369ca7bb63ea2ef392c9874d6c247e48e2a081daca51b4158a5b4edf20
SSDEEP 24576:aZM3zFVSO+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aZM3zfCLNiXicJFFRGNzj3
TLSH
T1B7750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e7f42fefb1638cc718f46ad1a9141e77d5166922f7a57aee79ef5c9ddddbc7ef
MD5 44aa63cdadde37e6e4aef5efadb7b790
SHA1 595aa9de3ed480675f5b086d979b6ed49852ed9f
SHA512 1f9776d29bf7f8ed347999fc7219ebd8064cc16eec20e979fe9bc5e91fc0526203e7355211604a7f259352f97e5ddfc48633fa27282baaf7f5a970804428a687
SSDEEP 12288:HUAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1FAFC003986754428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6e0b1da565a41ca8eadd75e8c63615ebb69e1dfa90382990b40865dc68929eae
MD5 2f083de66c0d745a9ab65e856da42723
SHA1 a5f3d7b53c4980eb160a7deb28b7c3eeff9c9330
SHA512 45a001340d9df40ca7d795f0286d9b7d86396daa72eb37c9e1c7bf9b8d3fe5a6e196993d80a3ee9301b35c7bbefd10ed4fb85d7f31c85217e605bd7a355d0b08
SSDEEP 12288:WoAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523D3548955B1FABC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 26fc94a2f368c07de2c5ae842572b6450c66ba26867222bfa66edc67a4949d8b
MD5 3f3daab021824aa39b58e685dacd9d6a
SHA1 461a9ff53845017acfd0a7f0a7a11ca030a6f8d5
SHA512 6af78b4d39de7c4883a5cb5aab50d9c83ddfdd919fc2ba008a546a436b6b9930f83e040c08eac1ef08774759d5ab5a519adb6aea98f3d9ee88ed9d1222be76e0
SSDEEP 24576:Hzya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HZLNiXicJFFRGNzj3
TLSH
T10D650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 037fe5c61f8f751016b371130f278545672510ab54070b4360f0a298433f914b
MD5 4a651d8d25fe2ca60c4e7da3c27f29b1
SHA1 4b094a52155a247639380baf43b6a4d66524599b
SHA512 e7a28af8950a3d5eb49de5ef09224a2072ca2f97f4909613771c22299948b9179b2ca1ec89aa6c735fe81240e26e9fa9bdc05505293446bd6fc095c8a6ec3d4b
SSDEEP 12288:CUAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14E5523D3548955B1FAFC003986754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 51537b541cbadce5f96f3a34ea445ab79c45dcb100de692131ac5aa25bab3204
MD5 a604e010aac9f0952f54889cea1943ea
SHA1 62208e990af32e999bfb5cee39037eeb5a8c6c80
SHA512 02043ecf86428f0c67a2e4d2bc904e85e4a078b001017c31b60a8d59c2b1619073f090904ced05aa6ebdaf932e909a10917d55818aca016487936a8c7165dddb
SSDEEP 12288:QUAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3548955B1FAFC003A86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 276aeb32f6da80caa6eef011b4da2acfdf5b7a01b3ccdeb7adbf98dccafc80b7
MD5 0e196ae87a4dc2b6faf3679cec585572
SHA1 581fb619998ed079a634133e20c7a3c79e639780
SHA512 b5b7ead4264779251ebe4a0d88376025c5ed5646120da729aae3507d8ca02e787e976f8a61dad2474abc3205e625d19d0b0d5107dd6e6320e6927b259ae35e88
SSDEEP 24576:bzya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bZLNiXicJFFRGNzj3
TLSH
T111650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7a2a91af68ddf80313a2f7e2d144c09b97940f0d753f25477b4b046846a42f9b
MD5 229b6b9066bfef122b5d08b0fe30a2df
SHA1 cd21570fe6577b15615219142fe2658944a4d4cb
SHA512 240518b1127ef49fcd9646ba5706af13cde91ab73cfdc587ccf9d41fde99e4d7a6a67a2ae3238e07767a63bdf6cfc0de6fc20650f885fbb43bc6f438c0efe1cd
SSDEEP 24576:VT8aLl3z0zDM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VT7LljRLNiXicJFFRGNzj3
TLSH
T19E7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b4694b49f2dd052e3ef8cf28983db16f0398a8c5bc20c9778ad51758e1887dfc
MD5 59233e8bf13850d74dad56840ff092f4
SHA1 51dfdc88b9a065a3751783b4b7c48556d29bb874
SHA512 c1a0827a04303bea4bbcbc9cf9c069fe8c48cfad448299cd57100a6bff9f6f9ab8f28f9c047781fc961b474323143ff15311afba9b9c7e9fa36b35914e73beb4
SSDEEP 24576:v3rd9CHKy7GZQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/rd9CHKyaCLNiXicJFFRGNzj3
TLSH
T1A185CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 269ffe1cdb9f4c872157ccf384ac7460af6a1593808356a7c5aa720874cfadff
MD5 86fb4e63e05f38090684f13de29f068d
SHA1 9cc963e0cd72aa3d8d731ce0f22169c79892f6a6
SHA512 eabdff47b3dd1d3462ad001e50b2f8d4a7c0304dd546df1c5ff70190ab297ca12d26cfa333f5f4f345c2679c9b65dccb50cde3b642729b5b6491e911b4576691
SSDEEP 12288:qtAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D2548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 46edd57b0a336a9bf7987f8464978836c4df7ea4af79691a329b5a24dd05421d
MD5 82e22a2ce1d7d691fa016a14e8ca1bd9
SHA1 79ed0950135461626d42a4a2ba40df553de79bdc
SHA512 0988669db93250accbba6d62284dc2a9614132475f814e513999c50f44eea3304bd633379535941473e82b29b48d4566436e405bdb8ac940e47e38b85f201d09
SSDEEP 12288:9PAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:96/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B95523D2558955F1F6BC003A86794428F5882E2DEB5619E3E2443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 541bd16aef975c290a0928386b80a3c363fde71345fb6ba3d251e6a1803e7653
MD5 2e43a40709aff7c415fab85a8ad2ab93
SHA1 e4ec84ae963696af904ba0d57cef4fc175140dab
SHA512 8eb2698134fa5143176f89e3764b8f5d11b835e813eb1222cc02c4b9d62db59075d0066d57b9573fb19eda40efbb55f5c988a6ae591f4987c7046aabfb171c31
SSDEEP 12288:+uAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3548955B1EAFC0039C6354428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c9d74cbcdb98bebd0ce4a421345b9c92c5eba147a047258aeb19184e054e86c0
MD5 e8c3e1bb6af9c831e55bac2f36ad38fd
SHA1 3ce39bb49ed37c8a8bd9ae5dd48820e16dfb7208
SHA512 0b2d31807a37e68781384256c70b0147dcf063cf2b427c741e183709e19caf67644ea8487b100e57f6168fdce3cc6c7428e5438d3e3e1c639f6edbd9f08bf9a3
SSDEEP 12288:9UAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1175523D3548955B1FABC003A86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c520418e9d2377fb4788c2c84ff3087a45790622746985d1fc21ffb4c53acf8c
MD5 07e47aa9b0c2014d77e006ae1062b194
SHA1 b01e5c6ce8c8d884bc26017fae812ea09576ed71
SHA512 5dbdfdf44fea58f46a8f154d7873f633a9989af203af9eb30321d5faebda2c2b8919e493f277f1c8aecb8ff407e27853492b417be7c589e12c0330d017063e05
SSDEEP 12288:htAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 07b00512aff6976e35046a0a7cd4de396eb6fdf336475d553d683dfebebf7c81
MD5 c1f50e56bc354014c93b68d0306a8ce0
SHA1 936c7eef92a12c2e87b54d94e39efee8711d700f
SHA512 91c52da50812cd51a9c38cc5dfbba18cf2b239fa38e2c68ab8215bf76ea281381ef7ed68f252a1234e6bd82522a3b91c0942f9764c84329250dcfc06b19537ff
SSDEEP 12288:zMAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D2548955B1EABC003AC6754428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6304ff3369227b48c4dd972b6a2cf0d69c3f993410d07823e5d0a89663c2f9e2
MD5 e3908dff977a9b05d337086a24e490ac
SHA1 2f9c4c70d4feb7a9ff40f71a69bd2326301fc32d
SHA512 c0ae970a2d01b2e0a6600e1602b7f979a19d660a99ce2826992b5a03bc3eb818e0061568eda7b4eae69356dd8dd987b710479beafca0f6b88ae7afa9e1714001
SSDEEP 12288:KyAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D2548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 82f393318a72e94f1d3340485ab4e34565b0c18476e4bb0343445e7a7b359c86
MD5 6af07200574ad9e4b2fc19343a76e16f
SHA1 14dd457f1d25e4fa7dd8a53989be9af1749ff0b8
SHA512 7e008dfddd5466c034c787dd5b1720236426458b8c543d9b466ca3d8b60272501daeab0155e64c1f513cdc3b73c7bf30714ef511cc0f23292ae810ab253f3770
SSDEEP 24576:qfwvzk9RX6wkyAIX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RMnYIXLNiXicJFFRGNzj3
TLSH
T13185D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 65979d505f93b25ee10c6ab6e0410dc55dbc1b2fea470a9d929b7aa3eadffa2d
MD5 d71db0df5f58cee2e2d5e91b187f5e72
SHA1 29b29b4391dc144ef112f4ed1a308549e1738930
SHA512 b7fa8fd06085e675b18dfc92fad81b0527dc2c2b350b2fd27433be1c0ebd690fac041072bcee8a024cf6ff7f7df81a7f864c59eb546b98ae337b707eaba22ce1
SSDEEP 49152:IYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oLNiXicJFFRGN:HySzPQ7wRGpj3
TLSH
T122066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 43db144307e9041e82f7c377045a4ecf2a306254b5af8907d24f34cb190eaa8b
MD5 d320cf604500324c6b2e751d094469fd
SHA1 43346d5de2992c947d4e0011ab270af37f31fd7f
SHA512 8ac2f7f12de0adcdb2e1d698c42cdaad8bc9340f884bc8f982ec002a7a07b1b59fad883860bfe0e6d67fc00630f7e327156b514eac76b29a2ee854ad3f6fb494
SSDEEP 24576:m47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m47JUQjqirIhCnDHUPfF/YLNiXicJFFS
TLSH
T19965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2ee0d8d33e4d4d6a1008b39c49e176d1b434f79a6ed049c9a41b17dc5b05086d
MD5 c1642773fb3a92a39a7bb5a63697f89f
SHA1 3fcd8c202ad2e3c13aecc03467179bb28cfd8f26
SHA512 c47102260861ccfd95c1eac452a7d49835650774ba223b79ef84d7dc426177de6d9b280b78eb13048bfa3c150d31ff1ebe5ac935fa31b32f6b0837d9d9c90029
SSDEEP 12288:bpsfkAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D765F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7b8ae36f877fd5c705cb9950652170968d2b1d07ed2c3a72f8b7dd2c0dbfa28c
MD5 3145b0d791389571763832661bfe6197
SHA1 a656d66656eca1d586407a2ebeafdf93198cbe62
SHA512 5d501a4269d38f50eefa63b226dd27b0436c3253ac1a0101a11fc0dd545373542142574d0c380c99ccc1f3b5d3dc7c187ffabdc9b377067362fffb2683608854
SSDEEP 12288:k9kN7TU3f2CtyIr8l1yi5UHmGAv6IdbzHnd7GVd+:k9+PUPiLp5HxzHnm
TLSH
T103351700B666CB4FC6A980721E32D5CCA7707D41EE056F0373C99B3F957265DBAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 1013dadcc75f1a44f4afbf5162d5d95493cb42ee8715f172f489198ef182b5ce
MD5 698b8e1b94d0e4e06f682b39c0062fc5
SHA1 8053194c25592d885514d359e7f29939b6d034a3
SHA512 2c28873a82dcf77992c2ca4fbdbf64385eab266affa777011c8d6d53dd18e30fdae2305ef3bf5a3f1d94baa8ef0d25f4ab79a639a241c144e2d3aa3ca9719413
SSDEEP 24576:oABckKf0BYb7OC1rGe9SZPV09M5bCQhxyi8TGfX0:G4k
TLSH
T144650941A137E38FC0BA10B2072A5B0DBB64EC07B7496F2673C9453AD866B55A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 171ed2d242de2312bd549515625d75e15b5e7424c0f323914a545d7565634d87
MD5 028dfe408bb33892c0b9a76d7baf6d85
SHA1 43b73a2a2ac237a30540b7f07aac2f3d5932e5d5
SHA512 ccfcb47a329966caba69dc6b11b17113c80fdd325f68d88b80993bd461df11e3b0e71ef28cec22ff58f586f5a3f4d57c9b9b0c38cd81752e587525812510aa90
SSDEEP 12288:+F7cAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523A3568D59B1FAFD0039857A8434B5487E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6dbfefab09e3313c149186dbbab126233375da15541cfc176468a5bd5c723c29
MD5 5f5bd006bb29a3d9c391fa0239c1f3ce
SHA1 65b997bb9cf86e8e9651a5b23f23f056971dc587
SHA512 9f1860fc7ae3eb53298836105ff37e694efa48f89fc680547f7fe1eae8bde29f8e3153474f956dedaeccbbaf3facb2e120f704b57f3c97a4e2b30e780b1fd859
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7gb4mBIBhGFuLNiXicJFFRGNzj3
TLSH
T11765AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 efb30f7b1d824c45159faff63b1ddc956cfcd73a0fb53da6b7b8ce590a32d411
MD5 b0759c4b725f9ad16ea3c968960ff1bb
SHA1 a2aba05261cabf6c8e41b54b72dfd8b19c2c80cd
SHA512 26822519168ddb342f53ab608140214ee4b6d6bd3056c57e130d698474c85a901465add1939a44eaceb8918e0b30ab001588097459b4328470f708cba7c5a92f
SSDEEP 24576:uG88u8FpJqH1vzria7/m+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l7ZFPqVya7/pLNiXicJFFRGNzj3
TLSH
T1F685F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c939ed9fd2729189945e86581c34579ce4298a86e6a18e323983c9d9d639c9a0
MD5 f30a328c846eaabd99e5da3e95b85fff
SHA1 5db74a1702704865744a885390fd6b27bfa33eec
SHA512 fb3a1ae01eb48cd72f1a374816f6fe3e3962dacc1a4defb434ea7c4577a26bd8870a2fdbe330ad9b14a2b3690403833a6ef3c7a679c7a1440fd480218f3f7d61
SSDEEP 24576:zPUr+NQC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zJQCLNiXicJFFRGNzj3
TLSH
T15D65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e337b1bd81d91e6934dfa896cf8264bd15c9e4c93ac9513a63fccc5c3a84a1bd
MD5 2d9a715dcf6db276a11dcc5341ead1ac
SHA1 b0d8b8bd92312975695464dd541d63a4a12f443c
SHA512 5ecde77425261066cf5fdcfbf2679ac12e2ce45e942490701e19b48795b051ff41706b1f51b88ff7c9b4cc61f96fe8ea6222f143ff01777911bba66e94ae2bce
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSLNiXicJFFRGNzj3:XG05lO43bP7wRGpj3
TLSH
T1F4D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 75f5978c0d4dd294a85ba7b69a0afb9ed564498689fd33e264fbaa5cf1781a18
MD5 babd873cc93b3e23bac1b2899d2d3b47
SHA1 cd7e93a9a6136e1b24a49124e0183c9ef1c03ad1
SHA512 c466f4e95f392b0edb2c47e882ecb9118228364df736317930e87e31e58755126120dc6df32589902730da400046b618f2bc21541faecb204b66a0da5f697872
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidno/TwSfVcYG3K/cJHlnFR+IGNe8jg:La5POZ3lJt2pasx2+m6LNiXicJFFRGNf
TLSH
T15A65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dff03057b2e090f7e303082c63aa9c930db69b42e36db6ea780abaf6e37b88c2
MD5 06dc44382f926f82c9b8f95f1bd266f9
SHA1 e18226da89e988eb83ce8c493132a906dda12aca
SHA512 1d8a831e343c294047fa134da6edfc5ea3c9ab0b751bce9677dcbf99dc098040d27da1f8e08b5c8e0a998bebbb39d62f0a301e51fac60e3c9a58ae5dc2b16fac
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nNc/zEOVHFJLNiXicJFFRGNzj3
TLSH
T15D858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 106fd81a1af594b319615fc9a20f14e4a7abdda03caec30eadc0e34bb39cde16
MD5 e0178b17618a721e8b595911b16c9088
SHA1 465c9f3d0e3e65f0a7e0108d0790a71c6b6dbc73
SHA512 899e87baeb8c1d8896e379a8df9c745dfb026a44a4b9f5f909c30ad2df6ac086000cf1d74ab08a356be1e2a0b79b7e19c2da1e3f17f97fe451328d88fb12888c
SSDEEP 24576:yzkNvNnaFeYhJNtmZBmE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yzMwBtOmELNiXicJFFRGNzj3
TLSH
T1ED55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a4eb17174c1c35004266b57dc7e3940b912f7b9ac6b9360bb8cc6de51cdfe86b
MD5 20aaf69ea75527ffdc7b718550aeed9e
SHA1 a73a79a399a24a7458e8373db14e883aff3267f1
SHA512 410aea033a1fa8fe3b1247a550c3a20fce8175f1fa6cde230aa2a0cac6a24d81c8fdf3409b77d1716bb730638577a87df1a73c88d50c9cab4eb247e73c06f507
SSDEEP 24576:0D3FHshBIYQgA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0DVHeBIAA/LNiXicJFFRGNzj3
TLSH
T1CC75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-221-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2088-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2088-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2088-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2308-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2308-324-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2308-84-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2308-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2308-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2308-106-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2692-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2692-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2692-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2692-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2712-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2712-113-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2712-111-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2712-309-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3244-132-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3244-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3244-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3244-126-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3244-136-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3248-75-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/3248-108-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3248-80-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/3256-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3256-101-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3256-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3256-95-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3256-310-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3256-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3328-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3328-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3328-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3328-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3328-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3756-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3756-124-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3756-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3756-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3912-53-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3912-59-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3912-105-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4552-110-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4552-0-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4552-9-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4552-2-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4552-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/6092-73-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6092-70-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6092-306-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6092-64-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download