9a7777728582c0a9938cc43d93ba30e23617deb34c1becc5d0c5a186d6b73ca0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 783KB
Sample260712-pcjdasbv2z
SHA256 9a7777728582c0a9938cc43d93ba30e23617deb34c1becc5d0c5a186d6b73ca0
MD5 9cc769917a2405bdc7a341d4ec05345d
SHA1 5830d3f2ab785e531127e4ef422d66de980c4351
SHA512 8d06cc0f7020d45270c49eee973fdd4179494bb2798c9ebe51ff7c99df1e5dffbfa948d3ed75bdbfd5b26189c96231ab93a3a186dbb6cc014ee76e9272608575
SSDEEP 24576:Np3vVW9r598+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:v9YfD5SW6H8DS52tdDpbRZy
TLSH
T14905124773A030EAE12B8775D4A14656E732B8754714DB6F0BA0826B5F336D2CE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3616	elevation_service.exe
3732	elevation_service.exe
4280	maintenanceservice.exe
3684	OSE.EXE
4340	PerceptionSimulationService.exe
2588	perfhost.exe
3196	ReFsDedupSvc.exe
3400	SensorDataService.exe
1256	ssh-agent.exe
5056	AgentService.exe
4116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\94cced1a8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e906008ef711dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005883248cf711dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000338deeccf711dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a40b7f8cf711dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fb6c98bf711dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3616	elevation_service.exe
3616	elevation_service.exe
3616	elevation_service.exe
3616	elevation_service.exe
3616	elevation_service.exe
3616	elevation_service.exe
3616	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3284	2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	3196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3196	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5056	AgentService.exe
Token: 33	4116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeDebugPrivilege	3616	elevation_service.exe
Token: SeDebugPrivilege	3732	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 1348	4116	SearchIndexer.exe	98
PID 4116 wrote to memory of 3000	4116	SearchIndexer.exe	99
PID 4116 wrote to memory of 5484	4116	SearchIndexer.exe	100
PID 4116 wrote to memory of 4716	4116	SearchIndexer.exe	101
PID 4116 wrote to memory of 4216	4116	SearchIndexer.exe	103
PID 4116 wrote to memory of 1508	4116	SearchIndexer.exe	104
PID 4116 wrote to memory of 1116	4116	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_9cc769917a2405bdc7a341d4ec05345d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2588

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2a7a3db491d6c9c42830a6e81b73bd413a6767cc0cf5fd3eaf79b0dc14513a79
MD5 2251cf19efc3cd6699085539c83acf45
SHA1 e0151e1ac1a825e2138a47fb069595a8f499a3d8
SHA512 1c3ef645dc17b3653e997e187d0e3a3bcb5954e94fe549e3db4b96a125d40790bcf352ded4487e10486c54f068bfd73223804dccb8e0f7562e3bec51a08a5404
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZ5SW6H8DS52tdDpbRZy:G3q6HjBM5SSDntdDpbRZy
TLSH
T120D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 dd81652e65b66563fde33e034cb01bc157ca9f19806b3a8ca86256944941d921
MD5 2a037e445ddb6884ea10d1d62a0b0b33
SHA1 549b14ff322b90c04487b0fa02a5c135e26809b7
SHA512 c2de76a77d7df63d9cf919a3448e90ca53b574aceca0d9eef7e98a40e3ef7ecede8eb6d505cc29638bbeb5189a9d4c74edb83420643978f1dd2a4e1349b9a4ba
SSDEEP 24576:/XYfDtczAo5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:KtcX5SW6H8DS52tdDpbRZy
TLSH
T15A05022873D008FAED6B8279C8B28511EA33B8954360E79B03F495664F337D95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 17afbb11834ac39f08b28879df69fc0b49f612d4f488cba0f6821c3e50ac39ea
MD5 65c93edd3c0623486317ac67b34cbcaa
SHA1 8a835ff74c119448958ebf4e2e4f81f9af9be299
SHA512 60b21b63ac1797ec953eda535a6b1690c15082b8f1b2da5bfb5c046d41a85f53acb9c9958d6c3a139fe3c44c8f05adb14b0783d519733b7aceb6049f2e00dc01
SSDEEP 24576:A0Le5ji0hmxirMR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:APji0Aci5SW6H8DS52tdDpbRZy
TLSH
T16B359E15F6748332D073C0BAC5D2A69AED71308657308ACB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2e860c1bc318ad10dc35a0b17fefa6ed5ab522aafecee27bd636fde9ece951b4
MD5 8fb852ad2c9996cfa1b3d6d88d768ceb
SHA1 ef2b6daa083d1f5a20a23de0547d1ba37ce906f8
SHA512 c5c36c0ba00b440e7c316c659625f3c0c128faded2882bebb73990dfc8f407d8504579e97558693b9861635f71aa94bc36213e65cc7434cdb9a23d5ffcf04c15
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:i/ezSC6vUzPvxHjy+5SW6H8DS52tdDpO
TLSH
T198755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2f8ef8b0aca1f5d5b16ffb8fb167e1d3347d15f6c3249fb0d39ae8de7c42c021
MD5 d0ae2e720b0883d45dd7e47af0c2d3cf
SHA1 834331f8255da5cbdba3029386790b4eb4dfc7aa
SHA512 caacb1d7049d03df4099a625420617c401d3b32f81a616a8a107e02f55202cc72f0bc58a86e699480f7aef49d9607b6ff16c33ad0b85950801e371193cf78ab1
SSDEEP 24576:gVbqPb88hv/l+685SSiVw6uAX8DS52tpz9ZRzbPmSZyo:gVO88hXl+95SW6H8DS52tdDpbRZy
TLSH
T18E559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4a31158f4fc739b7dab01609acace96d13c7756d82c9bb14e546083cc5b26a4f
MD5 69025cb54ec480bb2913b757e16cd261
SHA1 321100a92d103195f92249898cbfd80a8dd066a4
SHA512 150206ba45621baa2a0fbf9b1f55720125c46c429f35ea4a95c83f1ba02f96e3baad8d5cc6fb7aa08c81bcd46539738d82567003c50a502bb18f264e22c0b7ed
SSDEEP 12288:LRl5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:LRl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T18CC423C4479020A7E71F0AB3B1FA96E4DA18DDED8408553B4E71B687CA3998FC672426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 377da295c0923e94e7332613beb2b2058ab1e99f8acfb007359d3dd2c6ca4318
MD5 be581a62e1dbb8c3aed0658880916417
SHA1 9421e133183662fdafeadd99847cd5468643836a
SHA512 06dfaefcad0067cc6728ce56afa3572f6b903c1d663e66a1d6b90c381b6a9a163d9ed589d31f5c10bf588f62a90da6a29409e9df6b8bbba987734aac01b53e09
SSDEEP 24576:QJIU05SSiVw6uAX8DS52tpz9ZRzbPmSZyo:QJIU05SW6H8DS52tdDpbRZy
TLSH
T18E05DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820EDE235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b88b5990a4999236c49ae2404afbc6beb4558104b4140293d04dce471be4ce5a
MD5 73cbb0fd7edd0abb159d5ae96b20d06c
SHA1 9e0b2f436eda66618e5915205fc7947557eafccb
SHA512 7803e98d731c270f213cbf808ada4067a85f1256e6014e2c4777ddccc9d82259126606f45583bd7095aa4a6777867f2dcbea1737f03a611c3c283d89ef9cd6af
SSDEEP 98304:RQvGAdlCEL8c/yRNw5C35SSDntdDpbRZy:OvyEYc/y3w8JSintdDFRo
TLSH
T142267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9c90bb5d6d610aae7229c0319236c87860c717d69149fab8f6a2d705c982f54e
MD5 bc674fe8b5a60fe496c794dd94c2f8d9
SHA1 88fba620eb7fc9d71bf0a3a59bc4fe76d91b7e6e
SHA512 2a088b940620c5a00d008cfb10ce8a63821b260d22552eac099b196a716f5002a4c8dc97463d6b4b0ab326dc13db95721b2e3fb41dc5e06ff4017332d04a7e7e
SSDEEP 24576:KdewsAjS5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:6ljS5SW6H8DS52tdDpbRZy
TLSH
T1A415E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5ef1c7b074fed676067647d1e1166596ba210ef3c8effbe5d58a179db06933a1
MD5 9eea217016e1dbf9519baa02d571ddf1
SHA1 2dedbfbcfd691a8f3404ac15297b1e3f0ef422d3
SHA512 1da2eb17e65316dbf9ebdfbfb37e17acbafe4f9c1e4f8c32dbd850ba9c7394fa9acde4708986818612c0bfb8d960fed603662542920a1cb4695c77859dd273d5
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgSintdDFRo:TUEtQevvqc2W1cpV2EI321edDFRo
TLSH
T115474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f5fc9078e7e5f1c5c2f979e0499a19eb4c2f127a3601cac5f4e7c010f946d52
MD5 baeef4b8ee766496d089cbd78f4dca11
SHA1 5e9e127c0d42f2eb81555dd25bcca99229b85280
SHA512 f6535ed9b7dafd7c46b45b827a4c4fa8a8178aa63dfcba60a17185ba538c46a5a52be47d1b09d230be3257aaeefd3fcd60304d98d80f4541e10aecf83f6451d0
SSDEEP 49152:YCbRquA/m2yL5zLfFiV+XenmE3/zy5SW6H8DS52tdDpbRZy:Roq2Vjnmj5SSDntdDpbRZy
TLSH
T1C5D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6aef1e52999b76678e89b95cfa677956afa056075dea86e29b9458c69352f2f1
MD5 905e451d3c76b1f604d16c36f8fb8a54
SHA1 d272cd0be37f2e835c4bf3d36e29215f286c1e4c
SHA512 11a6a4e99b4463d814670b4d30c59142ff3ee08828d10ad085892fcbcc62eefd9bf0b62404c9f38fa60d102392fd7c06437487420856313dfcc98409bbe80fbd
SSDEEP 24576:kAhGLJIFoiwtA5l7S53D5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:kAMyFoiq5T5SW6H8DS52tdDpbRZy
TLSH
T1AB35AE80E7F955D4F5B7AAB899B69170EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 210e3772d37eab804c68db9ada3495cf3a2ec352d467d3bbdbe84119bf9a3573
MD5 fc1bba662f3db30f4be698de548ddaca
SHA1 15d674a3099707c73f6c596fa0fb234817d03b05
SHA512 2fec8e2eb7e0464dd4e74853c0a72189e41063521d9acbd5fed0b8beb827df8944e27a8b1a704536b40f2a2375e5d647e272524e89beb79706a6903b3a68f619
SSDEEP 24576:TwuoOWe5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:TwDOf5SW6H8DS52tdDpbRZy
TLSH
T13A05F14533E41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a2028ba5b2c8893a61a9db29e1d1b9798aaadb255c6a2bef2df4f407ec65b1ef
MD5 16b0cd57287fe7e1a6cad5d2afc64223
SHA1 b2304c5d8c630d5dcde75386e1cf034ec3026457
SHA512 f38a065b5bcbcba6f7ce2bdbdb9520cef5e4eda2bcdb4fb32ab50a7cecf19454b216dd13fafee9379250a4022d80045db45edb165e07acdabe6de334f6b0baab
SSDEEP 12288:SBZ1IyC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:8ZuJ5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T129E4128923E430FBE25B427AD9F54685D731B4AA533443DF0A61429B5F33AC64E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6ca33d50f8cacfaaaf4779a247a52fd35899648a23626a67f9770f8556ebead4
MD5 58c0e5862f26d1d75d6aa5bcfe34afe7
SHA1 898aaef2fbf7f8a4826f3b7aa49adb78444344b3
SHA512 a773dc345940d72387093e1134b213f4a27a0308b3ac2e6458b3da47490b93ee793be243663402e0b7c2f0ddba1be5e710648f9ddf57b96f78c6b970e9b3fe1d
SSDEEP 98304:7QRQyi36YOcPQLvw2gAf+PN3A5SSDntdDpbRZy:KQyiKayX+PNmSintdDFRo
TLSH
T1A4667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 704c8f257397c27346d69205a7cdc3171539b0870a987b47b931c1a3f9980ecd
MD5 43d8c978690ee71697e7eebe4b2478aa
SHA1 047c5c783dda382c69d49bd5bc193992b9a7c0c9
SHA512 048e14b16e3aa9ec676ceb27a1a24b177f9e5e4eb0b6a385f1d478152035694552a6a0aa76006f1eb9406b6d9fd1c8ba9f2ebe970564d5466161f8126a4c4c13
SSDEEP 98304:hQRQyi36YOcPQLvw2gAf+PN3A5SSDntdDpbRZy:4QyiKayX+PNmSintdDFRo
TLSH
T170667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8b66a08a3d304144a680e0928e150b04c71511c5fe32ccd7a3c8b40043db8a0b
MD5 cb0dc351efd688e12509f44ad4e4ce7e
SHA1 61641ba023a65c3ca74921e2074be2857d37a6a5
SHA512 30f955526e311bc8e32fe88791859d7b6c1481ce7c07a0a3ff8f14dc950d6b12893508b35089913fa012a23a09cee592cffc522a171375505cb3041602d0ffba
SSDEEP 49152:k68Qg55nhheWu7PNU3/i5SW6H8DS52tdDpbRZy:OthWRc/i5SSDntdDpbRZy
TLSH
T138B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1a4af528a9dac4da94681350add87e62170be1d2325c7ff786e0a43dedab6ce3
MD5 0091524aabbb7a81ca36dbd83b267edb
SHA1 78c1bd9eeb56cbd4434bed7fdf5d3ca89220bea5
SHA512 88214f795c135b7f29f8f4925cd0ab0082dfa73f96cbd356450fad467daf5a3d27a359c27830fe9ad2bfd3a9cb1e9a53a1b3e068cb20df22544801d62cf073be
SSDEEP 98304:By5112gYy5azzVvL69nLKnhZl5SSDntdDpbRZy:cLIHmWhdSintdDFRo
TLSH
T1E4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1b4c7a8c10bd0c3906120cdf8d13fa1c8d853b63efbe3ae5c7fa2db49e8c2726
MD5 0cef2a57e5180f128cc104f4cc9e9ee8
SHA1 94fa7a157d59ea5661fd082cec188741162f2fb7
SHA512 6af3bf425ff9fc56e20e3117e5e3af7c857da2f67e09bf54dc3370be5aa7af4d0e606946d456194f8953e1c7d2f66213372e047d34569a12e4c77af2620868e3
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl45SW6H8DS52tdDpbRZy:vu6JmVxd2d45SSDntdDpbRZy
TLSH
T1BBD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 97a273b2690b8c4aed31630b3cccd80aabafdce09c9614896baabeea25058ef1
MD5 833f06ce4a62e4eb3831e720f212f3db
SHA1 27b5042ca9d744eb1a389f5114f6343aaaeb6cbd
SHA512 9260edcd232ed6c1e897d78dae67a74009c8bb9a032a33d105d857639a7a09ba5b960991137d983b4512e203c9e03e3edc0d2f848fef639ce788e67222b1c383
SSDEEP 49152:G1hpsNoJpF1A6UU44CwH7R4xU5SW6H8DS52tdDpbRZy:GmifPbRj5SSDntdDpbRZy
TLSH
T1E1B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 716b2b4c8d6c9ac32f0676d9fdddb9260595455daf81caf9da2f7de13273d53c
MD5 f0c64f3c0671f7f2f98d687f76b6f1f5
SHA1 60f000c5ac7e83f6c9b467abfe4d3bab1c03cea6
SHA512 0c85921c484ac2b451c78f2b0cf4b8a4cbece76cd38ef10135ae093639c4a31dae481232fe4b2af7f8923bb9d26ad2f1100e30523d68045ad6d4dcfc649ec90f
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqJ5SW6H8DS52tdDpbRZy:o5dKTi61J5SSDntdDpbRZy
TLSH
T135C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6a8528a363e56876ed54fa82067a4f637da721657846c14c7c501cd0ae747f00
MD5 b0e5ff721c7aaa88e07b109370b3a6f1
SHA1 1f1732fd9244260616210b0f3b8110df8c606785
SHA512 5add9fbcc1070db6d0e1286219be8ab69cb0d05cfddebb405cb60db3040e78571f3a8606168f9538e9887f35c6f65e39f8f35b3e80339b32854a5daea3ca2694
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wo5SW6H8DS52tdDpbRZy:wX2iyph/5SSDntdDpbRZy
TLSH
T1B095BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e9cc2816e4d8ff18adb2e643ba1947f5e7d4b7ec9133a93da2ac263f8655e2aa
MD5 523a8c1acb9086cac86c48ac26613562
SHA1 e1bcab868dce7627d1c62218e5decd31c31fd01e
SHA512 5adefd95669d5f25f434f01d788896dd2dfdd550085b41bcd2169b6c88776be3618ebd6001311130ce90b39a600ba40d9930e8436d82d67703ea774503c8fdf5
SSDEEP 12288:/95OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:/95SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T108C423C457A121EBF30E0AF3E1F686D4DA0CA6EFD408523B5F76A147CB3598B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4f5f6585c6c5e1c6b19b0e92c5141f6e2b040c0c0d0dea86df524ae98fc49de0
MD5 0454aaf68387b05c004d72a80b1e8121
SHA1 5034fd0c80df0be391c93fb98281dd0787d5ba15
SHA512 dc8ab639c39010c90941ce581ecc26a50101612817144df6a656f605ec3a3100ceb9c1b0ab3f3776865ad99e6ea94a3cdbc06c5e4c05dbe1a92698ea9b2957dd
SSDEEP 12288:fm5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:fm5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15CC423C457A121ABE30E0AF3E2F686D4CA0CE6EFD408523B5F729147DB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dfd46cb24cec43fd91fa4e1ac6392d7a8eb4a806cd519e88e741fd2c19a589dd
MD5 e2d546b378a34408bcc4a6ffbdce493d
SHA1 d7de1055b588f8afc1654622440d1be0eccf0503
SHA512 78e5d5f01f8f20cc5b5ffa98123f7b81014d5196c982f814e8fb49a0248d50a6c1032584325bfcfd0073b2795d6da4877064948a141658e77b69638cee85a482
SSDEEP 12288:dM5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:dM5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D4C423C457A121ABE30E0AF3E2F686D4CA0CE5EFD408623B5E729147CB35D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0377fce6ea0b9b5adc36c70b193d3525f8270cd58cddaf332e2baf8677b42171
MD5 cb22d3a25631ee024b628a7148647a3e
SHA1 9d639af376012c9bdf059ba03ae3832a3a5b1b51
SHA512 d39bffc9fd02e18a71cc0047d242d1ebacf6818db2a16045211ed1a386b1e7153b85f095abb3c0710714d90ae8915bf0ecd90dc7a61cf00f70a43b57d1d81838
SSDEEP 12288:kVj5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Q5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T155D4238427A511E7E61F86F3D1F682D4D628F8EED624637F4F21054B4F31ACB8A31A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d88fbfa72b45d47a3da610ea57e090e685493b974e888d09253a6fb2ba12a73a
MD5 37d427fba196f3944a948bc9d7af1998
SHA1 c91564127a604f2b6340f6637ddd0788e5d1a60d
SHA512 7aad02f7cda456993d20297982d4abfca9a9e065278d988b159d0f3c9c69efd7c99ecb6620b69590fbf440744cccded0affbfd53b124d53b5dc92ea1511191d5
SSDEEP 12288:Mr5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Mr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1EAC423C457A121ABE30E0AF3E1F686E4CA0CA5EFD408623F5E769147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e5f8714541da7b9d2e77f30456e744ee2a28bab0a73636fc505abab629396aee
MD5 8c94d9c6374da0b66541c16b56ca2df6
SHA1 66883a2d5bb9656e143d221100bf7b8acebbe60c
SHA512 45a83a4d8c9671026166fb36930ccbf00693acc14a9ef0cab55fd9dab5c89488be6b3655b924d89aa38c9c1cd730a31f2bb08fb1a96126771eefa9898643a2b3
SSDEEP 12288:kK5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:kK5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T18DC423C457A121ABE30E0AF3E2F686D4CA0CE6EFD408523F5F729147DB3598B4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6267eaab60b7ee89d4ca4c6eeaa4e3cd008c7e61abf79013edb9e7e1d0fe4421
MD5 787c940b8cc00f34d0e6cb6d8830459b
SHA1 ed67ae6a96327bfdbe54f997923b6863074397d9
SHA512 b78a2a031db345f239b8f6bfae100e720dddff97de4d39f703b5ad4a8869a05f6e20ebb93bc4a700ac165d7f450c54e988871ec74605ae4ad49a57d4557ced1b
SSDEEP 12288:Xu5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Xu5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E3C423C457A121ABE30E06F3E2F686E4CA0CE6EFD408523B5F729147DB3598F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 257b5d35b1582c376a0ba382ff84e4c1dc772b44d1c5d892416a46afc1ff4c48
MD5 6191c0f1da5948e8b820ea8d71f5cef0
SHA1 4f67ce8ee3cd9d357ff148917d9be5f5d40e1f22
SHA512 714552ba3921d24899abfd104703639d6415bb0e1db5aac1b5fca7fa87622630be36182147ff37c2e9bc1c8943e21ebfd9fd0d68d6a9627abf72b48b567dc16c
SSDEEP 24576:2ZMSzFVSOG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:2ZMSzf65SW6H8DS52tdDpbRZy
TLSH
T1DA050294B39018F9EC67823EC9658945D6B2BC5A0760C62F07F436675F333A20D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 7ae3d832db608e3e87e15c5ead53bc7d2c66b2cdca9b1e996f4aca4d1dafcfa8
MD5 f852d1cce2e942d5a3aa3063219850e8
SHA1 542b6fadf745e16cf2b3ee0e713ef42a73a23809
SHA512 9530b585c7e392691e6eb59d6e57d473dd938e7aa48e7e4311cd26fe68ac0451676fbf70a9d8eb9b44142edad1dc5bf76be34a28f594ddd55974686fc2273361
SSDEEP 12288:555OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:555SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F0C423C457A121ABE30E0AF3E2F686D4CA0CE6EFD408623B5E765147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5bf580558efeec691f7d5f9f2c0e7bc89dba01d9cd3d31466bdee666212a6e9e
MD5 b2da4b04938a89e61c92805303050b2e
SHA1 85365b8780c91e5259868bc1352fd397ce83627b
SHA512 a3efc0034dcdae25f7591eea2c5d6687acada8c90d50bfcbb561bcb2217212023b3d10ad22cb2cac9a7a304158a6af22cf56f42dc9c042655f98b9c69c212831
SSDEEP 12288:sV5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:sV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T100C423C457A121ABE30E06F3E2F686D4CA0CE6EFD408623B5F729147DB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 70d3d4c4c02b9cdcb6873e04d644228a04090ebfbf9737689418fb530e63a487
MD5 5a31a3e8f47f39135556fb5dc418acad
SHA1 70e2763f1d3881bd489cbf554c08a62e2bd523be
SHA512 9cfb620158191c2a41f319043befe6904d108674a759eec4d4f791e2f4a5ea7e331714e48d17b398d077abf6a952417b68e33a461f63845d3b7ee71878224e05
SSDEEP 12288:WyPz5L8C5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:rzyC5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1FEF4024773A130FAD12B8275C8A20A41F775B87647248ABF1BA047775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d248a8d8554348b3227a741bdc9d265d713e8dc649b69200fef9ee74fbbc5469
MD5 8c603f4ef5740a3bb12c002aa1ebafce
SHA1 38f32b8aebe3bb766f2a71a7975b71e973d10525
SHA512 4b003dd3f61e776299ed005e8fa058e024e43a59a20d9a201eec3f226d5774a28c58d05aaf935f235e1d63058456cac9466d244cfc1e61e03f94d520b0989525
SSDEEP 12288:F55OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:F55SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C3C423C457A121ABE30E0AF3E2F687D4CA0CE6EFD408623B5E765147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 571feb944ab01f32ef5fab5da2cd1cfdb87d2b1d646f7af03dabed020b2164c6
MD5 9d448b5a07380b006c345c059e1b1479
SHA1 6c27280e159256c0b986c7271a4f1385f608d7ef
SHA512 88271a68882525d74e197db0e0dc6a437807d6bdfca80da974fbf68764e812c0eea32a3fc54d20d987b123f2e18ce38f3fe67087e18f84cdb7acb3a5fe5beb07
SSDEEP 12288:455OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:455SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B8C423C457A121EBE30E0AF3E2F686D4CA0CE6EFD408623B5E765147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b3c97722e076d8c2dbac49a0eeda0f7006740aa6ecd8974e233a11be78314e22
MD5 9cd7a6f711869e6a5b2792c261e8f3fa
SHA1 6b4b851ba36e13b486842237d28d0cf7867bfebe
SHA512 96b42ddf1058d001547e9f4be64721ef61ff056b10fd351d33e89c184c272b7e846ccf064f2d4ae670fb9f9a25dad1e917fcbe21d63f850db755c9363049c543
SSDEEP 12288:7yPz5L8C5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:2zyC5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T16FF4024773A130FAD12B8275C8A20A41F775B87647248ABF1BA047775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9f3079a40ae3c918b98bbb04a845a12784da5d3a93ef43ce23ae859fd9885996
MD5 43eeae681b7f0288bfaab68e56ef5d06
SHA1 a213ce927e15a339e8eb09e5609c8e1d73d4ff83
SHA512 db4a7533c9290a3f51307f02bc8fb18dfedef1276a803426ac6256d9ba0e4aee4d1b0d9095e52c5a03be698f8211f84a7a0bac9ed88403616faea9d97e841b65
SSDEEP 24576:qTHaLl3z0zDc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:qT6LljH5SW6H8DS52tdDpbRZy
TLSH
T176050294B39018F9EC6B827FC9658946D2B2BC5A0760C62F07B436675F333910D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 13e3622d2698d30cb6362fcc8461fcc947b2d5b1184a2a1b66ded9c43982400d
MD5 cb0464ee893064069c839b93d0cb0240
SHA1 d973b324d59a089ffa32079ad7c7f4b308a4a787
SHA512 064c7746eaca93a45daa0906c763c34b86a6c6ccba1310567ce33366d05f80c72029fc0a8476676e918d327460319ed016b56b87c2ff8fc5622052041597d71d
SSDEEP 24576:T37d9CHKy7GZg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:z7d9CHKya65SW6H8DS52tdDpbRZy
TLSH
T1D825CF90F3E410E9F1B79A35C9768511DA767C9A5B30DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8e79ef034b01ba0059640623d31baa8b568b3122af80e81e0afa8db489b286bc
MD5 a0e5e8f9bb30dc9ca7271b5f75c51e0e
SHA1 2814f6ea288cc371786db38af5b802337ced48d4
SHA512 569d7b5fea499ec964c501facc42b0186562f579992a1fcef3f466e936102f8719656f148da2ccf5cec0a0a3a830dcd024b46b5b7165d3ee4ea061476a8073b4
SSDEEP 12288:Is5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Is5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15FC423C457A121ABE30E0AF3E1F686E4CA0CA5EFD408623B5E769147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 be67bd33195c9dba514d9bc9130cd2f451aca35c9c2b3bcb8799561ac9a8b00c
MD5 e6cdbaf1742df77e872f3729e8c7ebd1
SHA1 c5c75c6000b319bed3b2ad0ee08079df059cb663
SHA512 1723cf6521d38e4b7480c2e66e73223bb32d9ff2108008e70a40ad2900b4afcb4743f93bed0d2735d03923d6f7d6469275b6c1b125d4a97a9471399c38d2e926
SSDEEP 12288:vi5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:vi5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C7C423C457A121EBE30E0AF3E1F686D4DA0CA6EFD418523B5F725147CB3998B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 116390aa18752891099d48b5c9c34ddc6343864aeb038ce32284464c5e72e9e7
MD5 917ab5d20a509efbce554b106b120929
SHA1 9549dc5fb05c33745c4b4a4a87b30320a80e30d1
SHA512 7ededdac0aebb5bb0311093144379899d030c72b1cdd3647ff5839532a67c94c4812729affbaeb57b6835c64dbc42a8e3a6b1125390fec9330ec2af8cc8dfc1a
SSDEEP 12288:rv5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:rv5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T136C423C457A121ABE30E0AF3E2F686E4CA0CE6EFD408523B5E725147DB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 31b524d9859b80bcebd0ac1fd09d110c3faaad9dbf9a9e0dc363559a03aafc7a
MD5 74ec3f05982400ec5518bbbbc2ee23fe
SHA1 4ac5a8eea0b287950e5ab231d35472bc7e24dd48
SHA512 6ea8ecf5dd2dff2341bd8d111a3b9f7e5e68058c0a3db63296d3f458eb375c5ad2af9287250f4a167078a3f5a3d74b71b06467b2475e320a28e196ec9be37ba7
SSDEEP 12288:K55OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:K55SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A1C423C457A121ABE30E0AF3E2F686D4CA0CE6EFD408623B5E765147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 71117c30e33311441668a016729a52ad861ffb0780f861ef6b9b1cd5a19eed35
MD5 5c9445037e2d8fe6b9d20023aa397508
SHA1 8c0f74461eb9b7531339f56f9898e410e01ef47e
SHA512 622b11e7634d10c9bb1be9a2630cc14c81cd749b33c2507585e8674532179bdae77afcf4f5bbf8389e92874f17977982a7a5f2796577fea5176108721f83dd64
SSDEEP 12288:Ps5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Ps5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T131C423C457A121EBE30E0AF3E1F686E4CA0CA5EFD408623B5F769147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e867854e5077ba660529f693bd2adeb2a3f96aaba98f62ef19df80833ebf750d
MD5 4006da652496c166b3d3b22c0a42cc52
SHA1 c46a69668fe05ebef031b3eb2cc7b40de0774e1f
SHA512 142897e1511f2b135f6f9fd7e530670ea6d3f0bfffb655d3e6dea8c8079402b339e16aa0464d69fb815dcc669f8e50a008a85b7db582d985951e2453e8b37a7f
SSDEEP 12288:Xh5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Xh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1ACC423C457A121EBE30E0AF3E2F686E4CA0CE6EFD408523B5E725147DB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d318085d91059802f409aac5c2b7ff713badc1fb9bbece709cc1358d072411d6
MD5 3bb8bbbfa8da8972dfeb893f7ac9c8b5
SHA1 ef84d2c0ffa1698f6e6875eaa37390d8e7b4b41e
SHA512 bdf3ea4093805dbb6f72385a41482ef0e6ceae7ec10eb48d548014ab77056ade6d7be25271e8fe8447c9e7a218821affae7eadfa377dc37d254a6ff0c404cec5
SSDEEP 12288:fr5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:fr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T185C423C457A121ABE30E0AF3E1F687E4CA0CA5EFD408623F5E769147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 fa7e95e237d04c112a5af411a339bd4d51c70553b2eb6d461db4e399eef62597
MD5 f7533fd695049a8a7c00f13a8d176f2d
SHA1 4e4ad874a83557cf5ae0af16b90ce423d7efdf89
SHA512 649b9cad42c02147398c6c525add374c1aaa592e1a49ce0622a639684b140fd9d0e46f08e3c8644d06ec8e0f1c58cc6b9cc1366df5ae063ad6e43904851b80ff
SSDEEP 12288:Hk5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Hk5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T133C423C457A125EBE30E0AF3E2F686E4C90CE6EFD408623B5E725147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 b4103b1c8b82bf97cde20d0857df29797cfe2811c60f0a8aa7b74ed4e714994d
MD5 347776d63a03794018a2e97aeef6e1ff
SHA1 c797cfd122d10b09243d95cbf43eb0c6c12c8d01
SHA512 79f31e821131ba2bb56fd386efb7bbf32b9d236300694b5e3b4b907c8b9570d76fe0638714b0e94e20fe0593c556294bb3acc788b9f92aa1c1592fb2d6cf22aa
SSDEEP 12288:3r5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:3r5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CCC423C457A121ABE30E0AF3E1F686E4CA0CA5EFD408623F5E769147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 35b4a2b3e807a0a48974aed760e7117368a76b4351add34024b97854b92273a6
MD5 b4b0ea7326e349995692f41b8a65f25e
SHA1 2fd39b4f2c57e1afa271ada5dfe32dc8888f4902
SHA512 e75fe7dede12c4e4267e0460a0db28771b71ec12711600471afbd43c620619e28fc5fb5d1d4fefa84d0240d6fb91766a8174751731b125fb8f9ddabb774c74bb
SSDEEP 24576:0fwvok9RX6wkyAIF5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:UMnYIF5SW6H8DS52tdDpbRZy
TLSH
T1BE35D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6f7f5ed9529e10b381aa01a22da534f88323419a97f4a70e42df64a08d5e1bdc
MD5 f4196e239b58f1e33eff664927e90b8a
SHA1 c37ba5bb32f8b2ebf9e76801246236f2bc90308e
SHA512 67633606d3da90663e361d322b303fae3349961463292082ebc13be3f1210631cb84d827083ffe7e147e268606a071031c1810e96d37f09803a21128c47629e9
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0I5SW6H8DS52tK:iySzPg5SSDntdDpbRZy
TLSH
T17A066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aa335676f5af41198370fa1c6c49b82cb8f2512e9dcd83f21f72f4170d2585f4
MD5 37e50e036c3b9da7f9653567900cd831
SHA1 5c9a3b295cb76e42c308ba2dd04a6c1002df146d
SHA512 0bf3c0abb2b43165274dbe8ef381a14e7304dd821959828e892b7b165822fcfaa5d95cd74fb1485d8274f2e84d746550a95fd2ed9be0f2ecfc437041ab4347be
SSDEEP 24576:R47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY25SSiVw6uAX8DS52tpz9ZRzbPmSZyo:R47JUQj1irIhCnDHUPfF/45SW6H8DS5X
TLSH
T12565AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 aee4140af3cb77572d8448a34c132adb6cf32475e5c01ce4e74c0fba3a0c8b76
MD5 7fb27654364732264ff2699be34d2173
SHA1 0ab19b0f6d56dbe6c8e733a299d265daebeca8a4
SHA512 d267e9a6c194bcc63593abe07f565ebdb002aa697c481b773a3c1ddaab5e1b6a7fb634e2a88fe6bfb70e7bc61cbea83be0b164db5018803c3c059835882ac96a
SSDEEP 12288:bNsfJ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:YJ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T107E4F149D39412EAD02E5276C7A64A80F3277C6983E0D3DB5AD0F53E0F366858DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 b94a4cbc4df86453dd629f8d3699545fe38967d42bf8a82cfe4b9d81d1a90a99
MD5 3c6a86f01127dad9d43f91e330660187
SHA1 8619e7ab4cefd056ddb94a491973f610269a3733
SHA512 ef85604899bcc780c29702642f52b624ca1b7b6cbe959051a1a692414bed90385b209d2e87e40cda1c44b3a48ab074864219c1478e43ae0041fcd6d2d6e75423
SSDEEP 12288:MU0jU3fCx5gIjDGBIbhrByi0OPqB6ccv4dSrphKhd:MU6UPAG6th0OyB6bv4dgid
TLSH
T1762528017626D74FC66D40325E32C2CCA7B07D41EE45AB0773C88B2FD576A58BAF2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 00040550c5c6786995c61558ad01e3524c33880fd12735378298354d39152ba0
MD5 125a74ae66779d72a1b1728bdd95f0ac
SHA1 44255e61cc7598447a8396ae3a3ce835a68f7f34
SHA512 753a077c9f9801f64f790626ababf4e4aa733ec33833ba04f5d5f48a44e2ab640de541e32e6c79d649f9dbe2be4c49a4bf75a77da6ebaa782978934ca9f19a23
SSDEEP 6144:bROmC9P66uh+KHROXdxZw/H3Zoc9FT/SqtMxdfrAYZrB/ZQPxCo+MSqtMxf1KwqP:UNfuUxcXZoc+tKh5H
TLSH
T1FD65D7405537A28FD1B76032472A9B8CABA4EC0777056F27B3C8457AD86BB15A0F93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0def2f7c1ea6a986d5001569b2dbc158152c730c3cd26343f3c9621c8d639c02
MD5 28c95c93e6d72a5ea30aa7d93c8b0ef2
SHA1 bb0066d781e82783ab0832423197e0bc45f05c57
SHA512 0d60252b1eaf6ee612dbdb39ec8fe96a6da53c4289afa8a6d9d49a7cd75c26cb42915b2039b3a5dee25f17ec73a06e3ccdef33d9035162a7d7e377387da2eb38
SSDEEP 12288:wF7x5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Ux5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19DD4238043952597F22E06F3A1FA82B4D60CF5FD8B0491FBAD215287D735DCB8E7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f5ff7046864e8833d8ee4dbac1475303bf7c49bb104c192a65a42a6965e58f14
MD5 cf5bf242b914b5cc02c17f1fa39fcc04
SHA1 2626151dd410d90d8864d2205789f9effa87e26f
SHA512 d9bd0ae97bcee43076addef1a0b76f2d945448c8dd7356a2652a0797d06e145cefac8fc2dd24cb61ca43e1060215fbd1dd7e3694bcfb6202f16fbfbe1f0aeb0e
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Cgb4mBIBhGF25SW6H8DS52tdDpbRZy
TLSH
T1A465AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bc760810e4785a9d7d643252a6b5b120f95a9980a40f89dd8435479b7277ee7c
MD5 fbd9f6f9034bd90341231b18be6e115a
SHA1 2ee5664ce5852130a384cd2504ae27dccc7e8c77
SHA512 6d78034fa3f43e503cdf68c9d34ad1da3450a6cf26aa98f5deb0584dbf675aec1fab621ea2ab8b961c21257a4b480282e7f1b48a1ae42a75e9ac8d56b9bf29db
SSDEEP 24576:2G88u8FpJqH1bzria7/mG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:d7ZFPqVea7/P5SW6H8DS52tdDpbRZy
TLSH
T18735016577E101F1D47BD138899646A3F6B1B4250324EBEF0BA88B521F23AD54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 1e74fbc60fdebea981c63cccd068151ed0bbbf55381e9ddb62539c12a4098af6
MD5 3e92a5f6b51886d9c70eb90bb089b80c
SHA1 65515cfc73ac38a24569a9433a90bb998e89e94f
SHA512 2c311d237dfce32c3adee45eb87c6bac2c48fbd9f0df83120f64974050deee24266c63dcda9251483e70049b2853af6ca8453aa42da85a73669bf2fc1b7b5dc6
SSDEEP 24576:QPUr+NQ65SSiVw6uAX8DS52tpz9ZRzbPmSZyo:QJQ65SW6H8DS52tdDpbRZy
TLSH
T17C05F15E23E818E6E67AA17DC5828719E771B4660311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0d983f394a81cfeabb2feebc058bda9420983c32d044e3b7019f8443885de940
MD5 15c99895c83040261a56ece40ccc34dc
SHA1 406df6da6804b4620351abc0be981aba5a92ae08
SHA512 9d21c23176196ac755f72d0f4f93e4834cee143a21d6f82717414dcafcc25175fe149db12e13681a52bd60adfe1a92b337b55af43cadbc339b740d77500ad060
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjK5SW6H8DS52tdDpbK:jG05lO43bt5SSDntdDpbRZy
TLSH
T1B1D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1f9646b8302490d55d6d216b593ca2c475d4b38d7ee48d096fa2233a49bc7517
MD5 d9c25fb22480dfcb8e6f7a7a648ad81a
SHA1 6f7dd2efa87a9089d4b94d7e49777640fb2c16c4
SHA512 312c70a116dd093750b39199344ed42e472573e2b2ab6cb7303e361c4034464e467321a421a081a4b4d64915b8ad4c73d8a5de75904e6c4e8d5ae3524d471931
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnI5SSiVw6uAX8DS52tpz9ZRzbPmS1:Aa5POZ3+Jt2pasx2+mi5SW6H8DS52td
TLSH
T1BA65AF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 288569d733f1bcf8cee1193984fd371f2c4c65976f41d3f6563016acaed8a553
MD5 00bad5a437d3567e3e24f0f749a3c53e
SHA1 c7e07162e55d4d30742edaa33ee13f45bdc7aba1
SHA512 54d2d218f4b4969706cf39a56c916a58c18eceeaf8e9b0376da4c2250f3c0ac07a6538c263064aa0cd04221f8078a8eb86e856f4f94e6e15f3ce79ac15085251
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:LNc/zEOVHFv5SW6H8DS52tdDpbRZy
TLSH
T1E2857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 45f2f634f98ab706b1b5fc6fa198eedecd59e53b6b4ed0e76589c996a2f5b12f
MD5 2e995d881425ed4b45145a3ade9dc190
SHA1 0506f49f24740be5052ba1b789d6a1193cd71a36
SHA512 1fc9a4e6a4088f92128c64ccdc438c4ce0eb7ba4f8aa0560f7d7fcd95b0287d6af774a2e277b611ad017984c7673de505c11537c749e8de62ede1689ce948058
SSDEEP 24576:08kNvNnaFeYhJNtmZBmk5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:08MwBtOmk5SW6H8DS52tdDpbRZy
TLSH
T17755AF6EB6B806E4D1FEC6B5CD238512E6727461073293CB5290C13F4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a812fdbb513231776b2e634ae16f9fb1bb9b939aff4bfdd221007e62def7e0ce
MD5 bf4d2d57b3a9dc135ff6e3df017dd2f4
SHA1 ca3791c17935cb185511ae4e44153124c983c923
SHA512 cb3b4eae513d7fddfc00b545e9865eb2bbb9e5a41f427d2036677340e18543ac0f158c4b1da605cafbefc80fec01c2132f5fbc8b55dc1c54b21a4c805d053f6f
SSDEEP 24576:nD3FHshBIYQgAd5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:nDVHeBIAAd5SW6H8DS52tdDpbRZy
TLSH
T16D25E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-116-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1256-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1256-122-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1256-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2588-80-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/2588-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2588-85-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/2588-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3196-97-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3196-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3196-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3196-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3196-382-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3196-91-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3284-310-0x0000000004120000-0x0000000004180000-memory.dmp

Download

memory/3284-78-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3284-0-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3284-9-0x0000000004120000-0x0000000004180000-memory.dmp

Download

memory/3284-1-0x0000000004120000-0x0000000004180000-memory.dmp

Download

memory/3284-315-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3400-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3400-103-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3400-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3400-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3400-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3400-366-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3616-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3616-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3616-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3616-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3684-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3684-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3684-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3684-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3732-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3732-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3732-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3732-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3732-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4116-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4116-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4116-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4116-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4280-40-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/4280-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4280-48-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/4280-51-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/4280-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4340-68-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4340-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4340-74-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4340-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5056-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5056-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5056-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5056-139-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5056-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download