a29f31ca48510729a10068f63256c00c070a90f5d9a3f58b0f5f9db79dcd0fee

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Size 2.5MB
Sample260630-pybkksfv21
SHA256 a29f31ca48510729a10068f63256c00c070a90f5d9a3f58b0f5f9db79dcd0fee
MD5 144fb41dc7a4f805f623b6635a9a8ff0
SHA1 f97ef57a42a541eca14943752293ff18504f3b1b
SHA512 0a655840ee17986600a4404907b6be2b40e19aaa9389989ae449b1af0a0c82d4a907dc4a0d3eec62b57d15bebee8035dcb99823d22463e3516184686d8494721
SSDEEP 49152:8BL2RFRBrrtegmc/YckjsVc2ot4+Ej2ED+l3eFqEfQthymR/9ecDmg27RnWGj:LBrV7/YckjsVc2ot4+Ej2ED+l3eFqEfp
TLSH
T17DC5BF16B29C02D9E17BE17C49868B06E7B6F40A03749ACF11D105E92F1BBE54D3EBE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5812	elevation_service.exe
5944	elevation_service.exe
1096	maintenanceservice.exe
5100	OSE.EXE
1288	PerceptionSimulationService.exe
1312	perfhost.exe
5484	ReFsDedupSvc.exe
2504	SensorDataService.exe
6044	ssh-agent.exe
5156	AgentService.exe
3492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\54087a304a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029b0c1688e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ee8b72c8e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd24a52a8e08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bca4bf2b8e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004da1932a8e08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9569c2b8e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f67bd12a8e08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe
5812	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5156	AgentService.exe
Token: SeBackupPrivilege	5484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5484	ReFsDedupSvc.exe
Token: 33	3492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeDebugPrivilege	2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2892	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5812	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4784	3492	SearchIndexer.exe	100
PID 3492 wrote to memory of 4904	3492	SearchIndexer.exe	101
PID 3492 wrote to memory of 1904	3492	SearchIndexer.exe	102
PID 3492 wrote to memory of 5908	3492	SearchIndexer.exe	103
PID 3492 wrote to memory of 2964	3492	SearchIndexer.exe	105
PID 3492 wrote to memory of 5020	3492	SearchIndexer.exe	106
PID 3492 wrote to memory of 3968	3492	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1096

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1312

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2504

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c6cae4704764f1503dd4b8a23d34141607a865d1b77ad71ccb3b8d9966019211
MD5 d24ace2965d2b7bcad4fa6085b335bf9
SHA1 ec5e8b68a02a2dc4e890a7bc53e6dc47bae768a8
SHA512 399c6fd7e73a543ce19c5076d4881b076e305ed104914fac82dd7c4cd5fd5142d5052917b08805cd83f91005047a3e41297abb3c712f8541bede3b576cd29ab0
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnGDmg27RnWGj:t3q6sjB1D527BWG
TLSH
T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e87782d67a6b6d6fd130d7be68e28a57e0521cff2659db43dc06bc49d3f91757
MD5 e14dc362bf7bc23afb0dc06a12f1889f
SHA1 f49f21ff2306cdb88ebd5e245847ccf2f5f91dbd
SHA512 8de08850d40270cf1297e822126d01c4850eba21e9eede1e72c9774559957d35205d39c26c3ebf501d1f39e69f43493a63a917fdc24c5ff91aa7c1de35e899ea
SSDEEP 24576:1XYfDtczAtsqjnhMgeiCl7G0nehbGZpbD:gtcMDmg27RnWGj
TLSH
T16165F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 df954827ac5a16a4b94648cd58e7dc62aae0103220fd9a689092503e3ee9028a
MD5 73837d07a3cfaa2135f9240c8fb7da2f
SHA1 e48dbe2d7d2bd10902ea3f30fe939e26a47ff0b5
SHA512 a44c3b57f178bb65b74ce41a07ca612ba9c4af4c3d40b559638d76670a22a1a85622895cbc3b6f9cbff4663eceb3adcebf25a99c69e31e02431e8d4b556a5a70
SSDEEP 24576:F0Le5ji0hmxxrMKsqjnhMgeiCl7G0nehbGZpbD:FPji0AjzDmg27RnWGj
TLSH
T191859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c696bc1937167a8f5f7d2f31578243643eec36edb188054b760cb7230b736d64
MD5 7e65d315d548fee024b81960d168d5bf
SHA1 a6bb50b1f229aebeca0ac116205af305f7a627a4
SHA512 10e1d18ce074132beb916683751119a8eee23ef4c1d09f0cf6f7f6f7433a5cac3fcdde6ace96f3a40478ddca9b7d51c0c4ae9934a09659e0a185e621611be022
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWn6q8wyugsqjnhMgeiCl7G0nehbGZpbD:9/ezSC6vUzPveHjyfDmg27RnWGj
TLSH
T143755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3565f2d1eee67cce65e6386318431523995cebec396b137ad370b61f640cd184
MD5 cb74e6eaea23babab326192990f4604d
SHA1 4b9b2b918f4fcef55c5ad63715fbf72d2ea51e08
SHA512 7bc16de849aebaa0d8f910406b41c19bc4964b27c0ef8be81ed758880d5eeb89804c951cfc3997a32e9d27e5385a2f5c161ef8a2f730a6c7d6407d98fe25569b
SSDEEP 24576:DVbqPb88hv/l+YxsqjnhMgeiCl7G0nehbGZpbD:DVO88hXl+EDmg27RnWGj
TLSH
T17D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d0505ad4c953d2ba32f8609f02fee23b97f2d01fcd060e31a2410e48a080711c
MD5 31535b1fe7dd76eafe74e0d65598cc23
SHA1 f55e41bc449169e11c4b9c6d18ab0329b000f6c1
SHA512 0e704b4d32285622b2b768e24c08740cec1511bc0422a1f0771f0639958dc55bdf1f5018ebf00f52c8908af4f016edbdd1369edd37d7eb3196de7311a36bac7e
SSDEEP 12288:TL+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TL+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d698d1cdbbdae6ef3454fa2e26af0ee6955621c6c3d8399966ec6e684660a359
MD5 7281e93a2f7f34cb040ab01be2b84958
SHA1 5cabb8e9791133823f1a7857e0576ddf38dde07d
SHA512 9216fdf11738f86db3f3327072d3566061fd65a35bca2a8198c88d7125825cc6fda4534f00cadc3044094f177cebab3f5359a5fa83c6b44897efb6629f4e02dc
SSDEEP 12288:aeBNUbTVO86U5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:aJIU5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14865CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6851ba169f2a2278fea01b768f5d430e6524f482b95cc90c4c65fbd703a868bc
MD5 59b3a46b2c7974a80eff4bc26151f5e2
SHA1 972ff0a7f17edc1a898435f43ba04bfa2c2c25a5
SHA512 3edf608cc84fbd73b1abbdad68326d55244a0cba19ddb58115288764a1d844e582bae26b94996b761a49a9f6c095d4ce0fb6b96987e99d31e18e1ed95f0878d2
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THY:NQvGAdlCEL8c/DRNw5CsD527BWG
TLSH
T1EA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 599bc4dfe9619b6569138688589ee49a589f1b3bbfcbca591709e568c1b9d90c
MD5 14e830bde6d5d464dfa2f188a708a427
SHA1 4648b9b0a2031a6e86ef3e7a5619cf2c509fc6eb
SHA512 8f8c4fab80db5519b3bb263e587ee9c3374f6a71dea36153f6d6d5e81a7afe3aaed77d61933e632f1f6591f88bbc52ccbf158c5360c283072f86ed1dbf6bca98
SSDEEP 12288:KAwSfxL/2Dc3RDLLmt0LDQewsAjfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:f0ewsAjfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18075E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b28f3946a2b2af58314decd2b908c5958286400bdc8c16d8049f68e32bcfd4d3
MD5 2c34c3920a50f88f51b010f8e00eb10d
SHA1 1e2ff335eb2724526f6fd5821cbe14dd401f0624
SHA512 5970f2bc278adb795d21bf09600801a9c5a598f5e9a7c5063a35d34c4f3bd3eceaf24998b1e00f5c4257078e3b9d512a205bc7199e618523074dafac2512c694
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrVQBWG:sUEtQevvqc2W1cpV2tI32CB
TLSH
T166474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1292f74b6537f1085a4b950cf8d92dcdb9871ebc5ef005afa41895bdaf5ca675
MD5 6da4f1f8cd14dd148e7698c3bd9a0378
SHA1 57190e0f9a497b6efc5df863d2146013b427380f
SHA512 23e05397f91dc838cb6b4f2efb3fe9731efaa63e786fb097d2d58436b324cbc54f9d85cc014ccbda9d79e9db8afc6d975a90ac7d1677dcf4786b22df2be4b03b
SSDEEP 49152:lCbRquA/m2yL5zTfFiV+XenmE3/zjDmg27RnWGj:yoquVjnmID527BWG
TLSH
T1FAD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 42fd8d5d794262725e172740051fa5785cb29c149e3a86b312f4c020363ee3d4
MD5 b762d654cd66ad29fb05e13b7c36e356
SHA1 c5bf59938fa1804ff47ac5c7e52b50601bff3512
SHA512 aff6dae01d306a096913dd415f6a1fed025fc3086e5ddb1bde0301d54999f82ff25f22d026c97aa88d0de430636da5ea8ef5ca7aa697e41ea656d9740ad0c70d
SSDEEP 24576:bAhGL3IFoiwtA5l7S538sqjnhMgeiCl7G0nehbGZpbD:bAMUFoiq5YDmg27RnWGj
TLSH
T1F8359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6e74715da0b8736bf5daf525932ecb577989e6ae4cb23ce826b398822307906b
MD5 d18963226090e8f16ec369104d17beb0
SHA1 d5ae4ecffa45e2c78a591980d4a5ce3783ddfb31
SHA512 3d78f6027bbf55116aa2871a1e78f09fb6fb97bc81dceba4e0d987bf84bffaf6a63b207b22087abbc61f880063bc821616df977185dfd8b69db0eb52ad47b987
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+CAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Fwu4OWLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18465F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1cc38d9d21d33ea07919df4b1e2bc7897b4ef00a3e57cff84fa48733336ef467
MD5 f7eee313e7eff3d2bd62cb225e21036e
SHA1 55ee84fd77fff3924c566404d69d13c4fe4365db
SHA512 4e27e9c25ccc10d56a78b8599978485c95ab350baae22d944f99bc8057590dcee2933b70eed2ff4abc71378c3da74890124ab38c87ee9b25b155ab4cd0ac6561
SSDEEP 12288:LeZ1IyvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qZuSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1095512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8e7c8c6963fa2ae56577e861ff7cae3066f9efe74892b2b69d8c5073fec64f4b
MD5 00ee80fc78fc088746f37e3b9c8d8ee1
SHA1 0b4acb693e1c7a2be956eb482bdb768eb49343e3
SHA512 4542d227bb96633b94f397f13155a5d4bd34b7cc89ea260c405a94ecbe5ddce94ecb3f3164d82191fe66bbb3e11c6f7e636ad0d64a6c98cafbf6f45bab943bf2
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3JD527BWG:aQyiKa/X+PN5VQBWG
TLSH
T102667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bf1566d0eb29a8285a4193a15b8f6c378ab4961332ff826776901a2fea4f303e
MD5 ed4b3b7a4a91b9f6f345d7de5f6a9485
SHA1 65229752f94d0cfd91afed0b02da8439257ad311
SHA512 1cb60721c3ffe9b15d636c7a1f4dd89d67eaa7997507ae2eb3ef9868daa8ae46834d3220420febf26d56e9d4e850e0381dbb1669a437bfaab0bf191b5c367589
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3JD527BWG:NQyiKa/X+PN5VQBWG
TLSH
T1DD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ce9d452a3fcaa756a7ed0053bfcdd2a22bb8c8090012385847f83c5c6e6bf5ad
MD5 a0eaa7c860a59f6a886abd0ea249b85e
SHA1 243fd779d27052faacbe433ff2ddad54ce75f575
SHA512 6dce5ad1c8fcf37d9e8d1d7de14ab3f8589ec5e4f3a51bc2c393fcf3e1a8b2f1fb71151ebd2d5d88ac489dfd0e6ea373684acd3a113b4fccb0599e2470bf7e69
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0CsqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3/zDmg27RnWGj
TLSH
T1B1B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7d393dddbb0b3b3f4975ae01f78a1cf0eceeb14391bdac4559d0ddd2dd30fd8
MD5 19bc163365bb65f14aac30cbe44f9521
SHA1 a54045498681628ea51a9914e45f904bd97789a5
SHA512 05eb931086601dc9814c3e0cd2f084cf59f0d82878f457736faa81abd6b83ee6f4bf99e7dc3db8cfd1561c52a6dec0cebf49fdaf6a96e86f00a0a6195ac549cb
SSDEEP 98304:Ey5112gYy5azzVvt69nLKnhZSD527BWG:FLIHEWhwVQBWG
TLSH
T1FB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 efd150f95f5122486732fc12abcae0d33d44484a55d3cca1e8e8a416e87d679a
MD5 dcaa89f139762204416a57c501e1a45c
SHA1 98774579da73ec7a34509c79722ffeca116d2363
SHA512 733d5eb9ef800ca6ee00873b8c6b44969905a89d44656885f5c2ca1480d74311bde03226f454abc5c5364dab5092ab1700d910ae5b792b37b1708184985e83c3
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glBDmg27RnWGj:du6Jmdxd2dBD527BWG
TLSH
T1A8D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7582a8313a6dc8a7e31da5e960ed18b763b93c10ba699f9a3bfeaabadc16b312
MD5 7350790e139bd4be56441b73d8c7cc77
SHA1 2454864a90e19a59503ffedbbd04a54016768d29
SHA512 8262f5d3e10f014fc0e454425b99ebf2c94f69a72bc574af69ede55acffb9fe98a2a3d7d943753dfafd6eaf11a464cc9a705324a5efdf8c20c263caff5afb1e7
SSDEEP 49152:o1hpsNoJpF1A63U44CwH7R4xdDmg27RnWGj:omifPWRID527BWG
TLSH
T148B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9a0b62ec0b335927791c9a193632c9d4e995299f3ebeddb1c89807206394cc19
MD5 cda06e61899d68f162a51f7e34fb5277
SHA1 aed53863831b5c384bfb460837251f056027ba04
SHA512 326289541ffb7b3de160407019027a5cd80b666f8663cf510b34d29d4838b86ccf30ed83fb174d19631a0665dfe0900ada84a9782db034d98335b61073a3bdcc
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqWDmg27RnWGj:B5dKii61WD527BWG
TLSH
T143C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f4fbf032dc9e06f3cb8398d1ba2dafc3e687331d573834ed6b3e9b7a7f8ce2b5
MD5 f03dda32f0bd7cebb7a5b4c9b15bf8f2
SHA1 9745b9b5a12f97fcbd7c14d853f5c7cad59903d6
SHA512 a137c0508081a5da37ea9a217c7eeb9608e5ed0aa7364b03704bbfc7c6140f82e681483ca2c5e8381628268addcb196dbbd4b6642db771d17e7576d7ee452dad
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wRDmg27RnWGj:4X2imphUD527BWG
TLSH
T14595BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c3b19ff786f65f5b07231c8532562edc2303d3ee357baaca140f28b036003763
MD5 5820e5152c8aa30379870fa08774ad17
SHA1 859bd0e52cf91be98ecb4e91fec367b5e0a4829f
SHA512 420fb260c55a5552db225be85da2c48be7f82a7b8da5e2529c5d4488faf5820c0af0ca5cef16780c4b26f5afedc1c234b506152f5d88cd8e86e84a10fb86c2e4
SSDEEP 12288:vGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BE965C41CAE52648B5C3E5F10EAC073E5BE92004937A577CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fc3c2cc32dac4703cac48986b7457b180ca3a0af23fe081b2ccc28f2da935f8c
MD5 634cbabe1bc778635a713551d53dded6
SHA1 95161307cf9604fa440fb5e7ad0d811da75787ab
SHA512 ae45aa714820680e545dc87845b00588553bd86d1bab99dfd3f6c791ee53b98d9ec4d49dba6cfbbd871d51abb77e727aa62db2f4ddaf85415d10d2b0b9189ba6
SSDEEP 12288:hDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BF955C41CAE52648B5C3E5F10DAC073E5BE92004937AAB7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 20bb3f0ae1d39a3ade4505a1ffbd695b422019c56e2460ee922bb73b2a692ba0
MD5 5f3662f8c4f8ae55f4b2a0cd6f607b74
SHA1 6f39c6e141f5f9bfe27acff1d0380488c95c10ee
SHA512 65b8b207f228ef0e14cf42d26ef594b59b735e1020de09c85d4d41b72dd287eeef51ba14d24d7cf75f3f2ca46468f55613f0e6f2a6400d95092a477882e81bcf
SSDEEP 12288:thXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:thsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BE965C41CAE52608B5C3E5F10DAC073E5BE9200493BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e35b96dbd98b1fd53f58b722e6289f54d1a9f60544088ec7548a247e6aa4eae7
MD5 2c789ef7a6f6a36a424c59f3a7ae1f4c
SHA1 4307343a94c1a4d710bbed404dd561c6a98cd904
SHA512 90163fd91f4888df1ac1a5f28b9c5126519cf6efa083c3634b396a665ad459c30700d578fb020ffbdb1c48c5f4766b680da3b34eb777de9e2ea86d1df01632ca
SSDEEP 12288:wVcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F445237B675C00C6D83285B5C2F5E11DE8237D56EA3005DB6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 26ca05d613b7bdfaa08e020a410750b29a8113b58c014d365f3503a364d01edd
MD5 96066a846e9ea6fa3f4794651f2db42b
SHA1 700e5c75d5c42d884796923cf86cbd3b70131716
SHA512 894af931f6c9c2e1b62a61f2ada5ac2c4e4ee07a534de1a386289b45f27773a63ea7aac7cef9c85f74f1f421b1f873bad7a039e53f26fca675d6d72b7f3eda5c
SSDEEP 12288:10Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:10sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BE965C41CAE52608B5C3E6F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c523e2c7ca88daef628eaee9afbef251a698f51277fce62ded5851b124ceec4c
MD5 3ef7b6b172612e6428eb6bfc84755c14
SHA1 0dc0f72a96469929eeb673f2d50935bca42ab19e
SHA512 a7b9a304e8593dcf403f94b31eb1f939f4c9c33a7901a56d9091871b20a863041e237a3520f5deec7044db5e536aa190d6a5b0b5ba84ec68409101cfb37d8451
SSDEEP 12288:UnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ed0bce33d60df53dd1e6ca2a97bf26853c747eec3fafda1d3d4aac8da434e1da
MD5 137ad66c434e4a62726f3b719a9c1241
SHA1 f1331cedbcccd5a8802723d7ed4d47e0d82154da
SHA512 9519a5e30684a3f430e9e281dc4698d508d0258414ff588043c5f55ac3bb4e4085ef9216b20d4540e800f61a95b71ec7751ffbb3716c4acb636ab42d38955cb3
SSDEEP 12288:z7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E04523BE965C41CAE52604B5C3E5F11DAC073E6BE9200493BA6B7CB9F7F14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3cefec35ec47e9d97f250178e157619c1a2d9068fe21891d6d490750a46519cb
MD5 a081a29685670c11baea366ab9cc360e
SHA1 62a6ff8d809044f0af581928ed06548afdf41e69
SHA512 7b60b74a2a66e8aae1d765789a8a9382244252954c8a5a99d1e22aa2e37625980ed6bc6fbdf097af353f9ffc7fe32e53fe385bf3ba3d3a280e44a303e92d68e4
SSDEEP 24576:jZMRzFVSOjsqjnhMgeiCl7G0nehbGZpbD:jZMRzfLDmg27RnWGj
TLSH
T1016501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 59609f4cd3df287698a9a67605aabd7a530100da38f265923a0b4fb1c7de2f42
MD5 b7a75d2d0d4a92cca5656b311f17da49
SHA1 db323cb73e89624db04b3b6c14fb2512819cdd38
SHA512 c635faf44d555ccf23ac81a309d94aa7f1785121096622ebb0f7a62ac75aa0fe4abeb89b1c8b5b4913a72e53cd427b349d6f25cdebe2f3bef94604d4214d09f8
SSDEEP 12288:4iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1614523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BAAB7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 59ae14bfccedc2b8b0f7980594533c26e77c1add1e75c45f9db1180c048bed32
MD5 be08f9f16ae1b4efb89abdbd257d90a8
SHA1 498ff557dc08e17259ab0b4d11ef0d798e789d13
SHA512 1975e0cccb9f5a8b259817d650a9a2e51a13d867f710490bd67a118d1d1d470b2dbf08a53f65e90bf8ade28d29072717d5769f45e586a241f728f99e3f388251
SSDEEP 12288:SOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BF965C41CAE52608B5C3E5F11DAC073E5BE9200493BA6B7CB9FAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 235c1cbc0d724418a5f1d720bce7d611b2b198720771e13d4596c35293137e2c
MD5 84aed38d4532e6236aac817ab52c623f
SHA1 d118cc6a4498dea95543656d2f4698ceb65219fd
SHA512 6d62cef56fdbf19c5ed54dc52b3bab788da634e70fae66af2975ebbe6cac6892125c0803512df071ad7350583004a5abcd8a8885bf272e6793d9f9aadef5ced3
SSDEEP 12288:OyPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E555125B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 074f912479c94b79dd0e853e2d03107626c5c067a91ea21917b5adbafc91cb88
MD5 53d2ff0300ec87c7723db1dca71e996f
SHA1 d581e87f9102ab9752a1a089bc3b77d058a003f5
SHA512 ac9099e46eac89800ebb60ee1b626039bcb74151fd57b82c3e70e0c9f27378fa57a20da71bae94f38c8b0a8e69660813fd9853ebae27a08e1da4e43d112208a0
SSDEEP 12288:OiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B04523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1db97deba1369efc2ad5a567930784508bc1b223484167d8f51d79dc37986d22
MD5 bfca6ee630d3de84cf8348b9be40d380
SHA1 2e50cce0974a86b3295fd237614fb763e2f2e6ba
SHA512 62a3fb0459e5e77b4edfee114002ed9baa8a61f4e3f9daf6258ab1290e3ed6f49553377e662d6bceecc4e7326e63b2cc700a688df5b22e6f28b66349efa2de4b
SSDEEP 12288:8iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ec04d94464b4cf2c5192a0d5c866a0c8d2d98954bb3057fa646cef75f8b24c08
MD5 d884c1927f6fe1b77aaea0d3730d7c58
SHA1 6ee2e68925c8c331cd1dd46daf2acc4408d3c91b
SHA512 105bfeae7109470cd512d55959ab9681141f7d8c9aa20fe8668e6c32619987569236b9cf80a4d850ad23b2c02e289717fd4d101f68a587cfd51a19d17eb8237f
SSDEEP 12288:kyPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C55125B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 aa0aadb9ef64172a010b851c969c8146200b717484bfc359ee746601d76690cb
MD5 2ad276ff25291a095f31d60b632518e2
SHA1 43f2981facc41d78286e972d16bffc2c93ca8d7d
SHA512 9e7abe55c49bdd9023140108c5062e3f617a165f7bc214f5ec06b39e4a00ef20b16823d0a37fc80ed12d2b1b5463f31f592e8846fa6bfd029f3e4c78a909802c
SSDEEP 24576:DTDaLl3z0zDRsqjnhMgeiCl7G0nehbGZpbD:DTuLljcDmg27RnWGj
TLSH
T1B96501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 11f05dab8f274871f8cf3881d938657e0d3f499961540f164e484203f18577d8
MD5 7e0efa5b04e04e47a778f2575c65154e
SHA1 d8f848c96dcbb531d6468df437110342182d2901
SHA512 c102c0a30af2c7d63b93f81bb8f9f61d9c8259b8b3ee4fb26f7c429c475b01cc67f770b2e200b277a7cb959199e071fc4505c755786c1295eb81c4bfd24c385d
SSDEEP 24576:x3vd9CHKy7GZ1sqjnhMgeiCl7G0nehbGZpbD:hvd9CHKyaLDmg27RnWGj
TLSH
T10475CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b7c879d592ecb8f0ea561e294f58bc1d804026133f0d89de8ca1c820d4e13177
MD5 86732baa44aef579d82737984c896b42
SHA1 068796865262391056aa0afc973caf7e4b13d69e
SHA512 10d84084ea06517c7290f4c0872ab5fdb1ce8fc71662fa0d773594711a9d0b30b3b9f5d0b35896eacdacfc033375709faa74bb08a5f0125e428b7bbcd77f56f7
SSDEEP 12288:YBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BE955C41CAE52608B5C3E5F10EAC073E5BE9200493BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9bc74a049f7053896ef8b23a733aea559db735f02b180b734883241bf53ee22b
MD5 e6bcf5fc29c2029394f5aad4dd3297c1
SHA1 ea0fc5b2cf47390f487708dcb99ee71569977082
SHA512 652e5e3927c8e974b131ac16e5bc5730456d177077b9815984c887e058f3bc1fa6b861809a831da84088d831587eee2b87e5d15009fc1ebfb0c741b77cbb521e
SSDEEP 12288:kPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BE965C41CBE52644F5C3E5E10DAC073E5BE92004937AA77CBAEBF18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 646d34a9e76e9dc8d9f235029db568dfe0657cdfd0f7d1c7163861790d8ad1b2
MD5 3d21d4eded0fa9a5368b0c0d6bf730b9
SHA1 3c6c31bc22db061d9ce04fc9a12b039fef8a1f1e
SHA512 ff48abac3d700e32c769d493f637bd6b033c80b76ab98f0c679f10e298d7af5b6620b31ef638edd8d65b151f804746045d4e9ad82d87ecb08528627b3ce600b0
SSDEEP 12288:74Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:74sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4285cbe3203a2ef09cd7c5420328f0649e4b15ff82ec895567a2b07bc96fd072
MD5 0e5cd780a5417016e9efb25c677c7c01
SHA1 2ffe35e8d462bc4884d0958004bbad6b146cf5b1
SHA512 645c8310e06ce2c47ad00d3be4419e17f1876e34a97b954715d2fec16719853b0935d1ccc6248e88a464fb594173f30ffe11c49c77fedc793e0bfee0515c95a8
SSDEEP 12288:5iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ce296aed5b036b71902e5f7cac7350958e6d8ade4f6453070977dc41346a2543
MD5 b7435ae698194c7ec74d12ac818eeaae
SHA1 fa50ced50633239adccff3abb4757585748935ce
SHA512 e835c0954f0eb5dbdf16ff6d8fbd6ba2c83ce0ce913395f73964916d48a1cab3af7f65beab7ed3f5b74ec654a86e6e855121c77a67ff76e51d5cf008b505cf82
SSDEEP 12288:3BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BF955C41CAE52608B5C3E5F14EAC073E5BE9200493BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 25b462ed97ddf59ba031b6ef210f1a0578f93b4ef9a0bd945a5200f5f6bce0fb
MD5 e79f51bbe261f5ae291713c7189b4bab
SHA1 e34a2f51599805a783f637e1b4cd4363ffb2fc4e
SHA512 6cde5befb052ff42818983f5c2d6b23efeac0d638b2876f71db635544a86e11d19c19cece3ad7ff80061a00549b8ae2b7fc0c59d5589805af51112da5511f2a8
SSDEEP 12288:G6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1614523BE965C41CAE52648B5C3E5F11DAC073E5BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e894ed1acd1a4389fc2cdd0bdcf563df1424674e2ac26d9715af743ba3793e4a
MD5 80bd2c5b26088e18b1673fca7bc9376e
SHA1 40b6f05b7728801a8b0114679b3ce9b3f87f4770
SHA512 5f4de49c2476f8a63570788abcc3ce42e4dd4c571e4e187668133262b13a7d961f4707336f5eed809c01c75617931d016ae53d5061f24cdb7a216f2b4487813d
SSDEEP 12288:x0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B4523BF955C41CAE52608B5C3E6F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 efda375e4dcb09ab81c6402f236babd5e47a1fb4248708aa0628d8fa445a3f42
MD5 9691159b7e56126f45e88c66fb8544de
SHA1 fd26cf459d211a9f9b60c6b1cc7999f09102aac7
SHA512 2fa91c2c575d5b144922490bc3c7500b2c1cf5147de0266c8b9e50aad9c1713fbbc8073e25510f97ca3b457182d61014b8243368d2991e5f1dcc9de263d327f9
SSDEEP 24576:CfwvUk9RX6wkyAIesqjnhMgeiCl7G0nehbGZpbD:SMnYIyDmg27RnWGj
TLSH
T1F285D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e8e955e5164ad7de0474739d70eebd3ed6a84402fed2b4b0c25287f729f47563
MD5 21046e059af3a71fb52a375e1ae67dde
SHA1 5ef3cf162838e0b1202c78433cf35da8631ddab2
SHA512 ee3ad981316c4d2467e3e24fd76767a0f00a2e58ab94079af9136c3ed9046fa5a2d37614cc2ef2426b1101ccc364f7f9f919ca6289b37d4825201c4dde753d10
SSDEEP 49152:kYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xDmg27RnWGj:TySzPpD527BWG
TLSH
T164066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c813843b33965f0de810628e6d1d013b754ec66dab5350ae060d6f187223dc20
MD5 4c7e80644e4fd8daf3f44ddee1ab0c6f
SHA1 af0f8f92dfb9000c750f4cdc6724cfc572c8de70
SHA512 97fa618b0b27ecb0432d12fcd8dea54485703b5defe9f241cfa194706224267989b733a89e5933cd26b2a98853b8b1693d47d4eae480c2d4b3818cdf668272e6
SSDEEP 24576:O47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYzsqjnhMgeiCl7G0nehbGZpbD:O47JUQjTirIhCnDHUPfF/BDmg27RnWGj
TLSH
T13D65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 80a14c199fc5695aa0458706b86789fb6bb01e1be35bb789bd9be0ff66f96226
MD5 83904b701b85a38b6b167a822a8cd998
SHA1 825f3c0572c69c6be42a8037e71d91bbd023303a
SHA512 8ae0d0a8d7308c1c3bb880739783e58951cf61257124a33955e2ced371c71ba9ef1cf82caaaa4be31f56e42b36289e9d254e74b61bea7d146573132decc3b59a
SSDEEP 12288:TbsfSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 dd9ee25421b2bd9de2e82c456f9d29ef1db563fbad10052b72f6534c8e84c3cb
MD5 9f14166b1123f10141ec080ec3000f7d
SHA1 4134e63c3d37d0568db42468f86746f1d1cd8c8d
SHA512 a812804ee5f2db20eaf7e6a991530d36d9484f7e94c9c3b0a3ee9a778205137cb2d40f8e4a994bd87e249f893b77b9aefe5dc0d2354e50e744a36af5bc77e094
SSDEEP 12288:/QmGpU3fIGo/SxFvBUB2goaUvtCRqlhZznaRMn0Ft:/QrpUPHP1AJolVAqlTLaRMn07
TLSH
T15B351800B66AC78FC66944361E36D2CDA7707D41EE05AB0373C88B3FD576659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 f99c4dd99e5a25b253271713e519f5e3dec49419f39b65525460d470e05ecc17
MD5 0b342fab02ed2b4273d375ca8dd7a172
SHA1 4bb5806bdcdb582fd3fc154c5bf4b456d21421e8
SHA512 6a8fa046787e9bcec4ecd4e4ec4259ff31c431e1a03d29833acdb3bf6708dd242bc1d639a28a8dab256e97806ddb8e3d41962a510c7f457e74247dae46bdf0b3
SSDEEP 6144:xCk7hr6YEnDYkYuR959z9HvKVJ8BjmxtXp//JixtMxNL4uhdV2lnqZlKEd8Wixtg:h7hr6hbDBHvQISsEd8YLQRS9
TLSH
T19F55DA40D437A38FD5BB5072071A5B8CA7A4EC17BB456F26B3C8443AD86BB15A0BD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4057992584edded58bb4c5abd00af5fc40d58e45558d48f662ff53b90cf8c75f
MD5 9d98d7bb9c33f5355cc724ffe42e7673
SHA1 6dbedf1b620edb3abf3167cb8e9e26322adb2960
SHA512 a6a4b5900ba1287f081e693d7ae6f4ed771a523f2ae616d1174bb3c71fba89c60eb6c175e0f6420ef84add575b85ebb74289e7fbf0f772934cb8ff2c0db08bf7
SSDEEP 12288:s07qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17445237B934C518AF83605B482EAE12D681B7E669F1044C3BA1778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4405f4a094f879ea809aa33d55b9708399061ccca896dbb156cc54ec194f420b
MD5 47e6e78346e8d062f0f45853a4739b12
SHA1 97a168394a4bacc637f33f195cfa4b9c9c6d2cf8
SHA512 aa1a65e7c90c635d679c8930984d3ad1af75446f78eddab5e5c7e18460a208219064f1a1d477eb296838c89e1cb7ea13492312e4348b392b2904017a6338c11d
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYgsqjnhMgeiCl7G0nehbGZpbD:ngb4mBIBhGF3Dmg27RnWGj
TLSH
T18B659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1d607b94fa12919885e41924d1b71da2b59a0f534e00d6df3207682a5e93da9a
MD5 13651608c7a6d707cff0e44e842315d9
SHA1 4d0ec32c405c469a1e7926f86cba8c0ad5d982db
SHA512 b35ae71066c35ec286df1ace878603af55c55c8326918a3696a25d5d42a92a92004ea16f0daa21d2a79dfc120f35050005970f43e585cebc476067f90aa77093
SSDEEP 24576:EG88u8FpJqH1bzria7/mjsqjnhMgeiCl7G0nehbGZpbD:37ZFPqVea7/EDmg27RnWGj
TLSH
T1E585016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b457c73b50137b1e6d6479eadbae7944ecb69f092bf00ce3a794587e94e15f4a
MD5 01993e6ab74270de26131d22f67d8c32
SHA1 697381af7aea4e9c9a0895ecb82100fde7d00097
SHA512 dc28700fd3b0e445c6978e9ed5fe0fea9546d9657fdab2d97d59464b3bd80b39df1830d0decb5717ddf14bca78d6c4d5134089cd59db612afc29d027739ce345
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Dmg27RnWGj:2G05lO43baD527BWG
TLSH
T105D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 412441b92729a7cf6bf17c12dcbdbbc24c870815ff4ad3d933caaa18a2b9906d
MD5 b56a9f28b6da18bba5bbfa10b1abbb9e
SHA1 3a03e9912a3fae2f6a61c3ef018038844b3bba54
SHA512 ed39ee4e92c11c41ae075f6eb520b9fe2eadc33a2cd460bb101651ca241e14933c1d04289902110fbbe4e09b24a065bd7aeb98aa154bbccf3ad2ac5aea89a080
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnNsqjnhMgeiCl7G0nehbGZpbD:Ua5POZ3BJt2pasx2+mzDmg27RnWGj
TLSH
T1F265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5f784408e5a61a1d381a7a6a2015cd937910695ecdb69793167b700365849718
MD5 4ca0257643d45613cb3c7ac8b0e4900b
SHA1 8320d63e14a01a14b443b3843fb06e0839edaaf4
SHA512 19f202c512691177d454a47d168e3c920c968521d2d69c8f9e22ca1b0c487e42975f330b217f7f1c6a5a9e1b9ae744e0dd6f1b380c959527e4ba57ad8f10ed20
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkrsqjnhMgeiCl7G0nehbGZpbD:DNc/zEOVHFkDmg27RnWGj
TLSH
T152857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a39e39472e38dbba878da784fba9e7cfd96ecba24e5bc0b91bfcc44f00d2bf9
MD5 6327dc354bae89a9b0551a649c661596
SHA1 2254357e8e3cac9b0b0eb0499b67f223b53b650a
SHA512 b0f7feb13d92988bd154d7e626f5f6bd4229becafd65c305a342eca0557162ffd7ad32b19d6307d1a0b03d0c1af7c9298cdef89223611a15ed61df7709e9c70c
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmJsqjnhMgeiCl7G0nehbGZpbD:aTMwBtOmNDmg27RnWGj
TLSH
T14055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 07482dc8113cca237e2c2a2b6166022fbc724089f4556b244ee4c515a336b994
MD5 e0efa18d62278007024e5c76d4c0d9fc
SHA1 61e7caae730cf766b2d3928da13f94008d8714cc
SHA512 80dc84a6bfb2abe7b77b34f94dac145dae8f3e56f31d3bfcdc3284aef0ba830290e6e6a5aada2318dd17ceb5d90fe02f3b4d7050b9ac37fba9f639fa756d906c
SSDEEP 12288:YHvUrBFrEjwaQ3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:YPUr+NQ3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15065F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 368cf91fbac97c94407ba780d8310595b9791255b39b8bafc57c1d9375f33ac2
MD5 0e8b3bc51af2499dec8010dd13ad0df6
SHA1 111f4a98202a30ed5f25ea237bb72f35ee1ffe2a
SHA512 33030652502333595886d2e7027474bd6c443169444af412f014f6497ffa0123c716a063173e95c2060220f13e7ce7ee2c686359eb80a7901bcbf0ae57969be8
SSDEEP 24576:mD3FHshBIYQgAmsqjnhMgeiCl7G0nehbGZpbD:mDVHeBIAAqDmg27RnWGj
TLSH
T13575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1096-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1096-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1096-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1096-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1096-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1288-102-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1288-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1288-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1312-103-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2504-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2504-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2504-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2504-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2504-300-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2892-0-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/2892-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2892-8-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2892-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2892-156-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/3492-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3492-131-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3492-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3492-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5100-299-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5100-99-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5100-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5100-50-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5156-124-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5156-122-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5156-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5156-116-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5484-155-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5484-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5484-317-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5484-83-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5484-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5484-77-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5812-257-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5812-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5812-21-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5812-15-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5908-316-0x000001E520280000-0x000001E52050B000-memory.dmp

Download

memory/5944-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5944-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5944-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5944-284-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6044-303-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6044-101-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6044-111-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6044-105-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download