4b3d843c107631908471e4b1e0a0a0821a683cbdca2ae3ed83f75436c52a4547

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
Size 1.8MB
Sample260723-jlylpayvfv
SHA256 4b3d843c107631908471e4b1e0a0a0821a683cbdca2ae3ed83f75436c52a4547
MD5 af2c8fbeb83919b72a3cc2174e0b6342
SHA1 7e5b379be8eab3f4be64d62ea82b19cf34b45d6b
SHA512 c49d9f29a45b98c21109c39186058fec393b295f591484fcb5f5ad6abab65964e4fcb99b2a1e4234deb1c6aca8c6f7eeb9578d0fd1118cbf6cc3c3601bd19030
SSDEEP 24576:zdy4mcrQDfwsqjnhMgeiCl7G0nehbGZpbD:oh4Dmg27RnWGj
TLSH
T18385E05BB26850FAE86B913CC883D509E632B8124B21D7AF17A1466E3F337D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5460	elevation_service.exe
1852	elevation_service.exe
5880	maintenanceservice.exe
1812	OSE.EXE
252	PerceptionSimulationService.exe
3944	perfhost.exe
3808	ReFsDedupSvc.exe
4720	SensorDataService.exe
1500	ssh-agent.exe
476	AgentService.exe
5860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5223d3b624febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2ed565c771add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfa4095e771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7b7b3a1771add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcee4d5d771add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7b9e85d771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fec65a1771add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db75a6a1771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f66695e771add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007c49745e771add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
Token: SeBackupPrivilege	3808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3808	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	476	AgentService.exe
Token: 33	5860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeDebugPrivilege	4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4872	2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	5460	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 3252	5860	SearchIndexer.exe	100
PID 5860 wrote to memory of 2188	5860	SearchIndexer.exe	101
PID 5860 wrote to memory of 3884	5860	SearchIndexer.exe	102
PID 5860 wrote to memory of 5240	5860	SearchIndexer.exe	103
PID 5860 wrote to memory of 3340	5860	SearchIndexer.exe	105
PID 5860 wrote to memory of 1156	5860	SearchIndexer.exe	106
PID 5860 wrote to memory of 5820	5860	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_af2c8fbeb83919b72a3cc2174e0b6342_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1852

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3944

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5327105c574394dfaec0117189922de43efa1a6229b47c971b17ca451a41619f
MD5 572cfa741f93e4ba999766e2ed155b9a
SHA1 c6739bcb8c1f9ee5d46cf206f1e52c7e3b339243
SHA512 135d9c62d30f0d64052a854a69d220acb684e213036ba701fccb25206b0d3bfe522abbe4c4c55cb564759db6d0229a1dd231d91e2c98905a134d74bfa74f7f22
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDDmg27RnWGj:p3q6HjB8D527BWG
TLSH
T1F1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 71650dbce069cf3d56e2d073be5244393c21985d2b5b06288b1d919a72cbac9a
MD5 8735f5e7755019dc30e5e5a94c14d06d
SHA1 a1093c4cd5ee2fa67779f9cff9449847b5729062
SHA512 6a2024c3b8d555887eb2aa5e7ba5882350a0028f4724f61adb1f7987813f3cee6de6043ff2171a42301d1d61e300fe1c5c2e72b9cf886b9f717b05809d3eea08
SSDEEP 24576:LXYfDtczAUsqjnhMgeiCl7G0nehbGZpbD:OtcdDmg27RnWGj
TLSH
T161850129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2696c007429b54f60e59eeb19780742f0ea246b371afb7abe68240918c6888b8
MD5 d2c0e616904c8340f791a2a1bb82583d
SHA1 772f9d55e57e0b8c99aa441666db82bbbb16499d
SHA512 5a4906b424617c3118ac0c46f70625501a981938d03d9929d2159642411fce5fac92b133e9b627df99daff8a37515262fd3b91d64445d8c11792e9462ec32030
SSDEEP 24576:40Le5ji0hmx3rM3sqjnhMgeiCl7G0nehbGZpbD:4Pji0AZ2Dmg27RnWGj
TLSH
T143A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d2c0b2f05f68e9504acf2ff05852b9dd4ad777163f22f6189e42d367748e9124
MD5 cb5ea2208a6ffda6f95ac3d935c08ade
SHA1 f2fd6b4c4135052ccf652fa36089ad157ba1c8c1
SHA512 6f33a96385e654db988d33642a34eb3e766ecd036916ebde06f88d919924143d673584a19061a30638c81e80d27cf272a8f81c05062af098f5a81fb8a9f90b3d
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuJsqjnhMgeiCl7G0nehbGZpbD:H/ezSC6vUzPvxHjyKDmg27RnWGj
TLSH
T1A1755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2503ad59d6df402f758802a0df5ac3e804adb9abff0904cd9107710f2aad4838
MD5 cc1a80c3b0ad9fa0e09ac5788585f5c4
SHA1 ff8c5c57c5829993389a563fff55af62ec7b8354
SHA512 2104304ee1637454ebd1441c4f04cc55018d9dff684f4c8dd05dfa74e54947b5eb4ebab02f8f4ca8890d229ddd33eb72faf183891b37910b5a435175a23f702b
SSDEEP 24576:CVbqPb88hv/l+6wsqjnhMgeiCl7G0nehbGZpbD:CVO88hXl+/Dmg27RnWGj
TLSH
T19E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 885b3074e3972112d9ec830f16d0218cf338173ffa3538b4d5dc237cb4cb4931
MD5 fd33845a3ad1b2cbb1503efeaa32507b
SHA1 d613a0eb7562bac68c6712f09ff5e9ed435dbb61
SHA512 9bfd8c60ee46c790266a3e8f9698e88caab939d6bb520538dfc17b43963d003d9766b2a10e4c55e1906e8c8280c5b6f5abaa7a0b7c5e68a2b553f2df8589b4b6
SSDEEP 12288:LXzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LXzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1246523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 cd017db9c62e28bfe591fda784f37f0a03dc532739fdce60cb09f230a8c84c69
MD5 cf5ab4eb86bbc228b270b53f3c710bae
SHA1 1d18aae37b3e82d3c0f62adf96f87ae777334aba
SHA512 8c3cf34b3ee09d78f21ecc20ce8935b6ba53a3481a4883f44aff0f5d17dd510aeb31f6fb5144c535a985a3014ddfd1d0a442acbdf975bb03ffd2965bd65b9442
SSDEEP 12288:6eBNUbTVO86UoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:6JIUosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB85CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 343bc663c7a6b399a485e4862dbdcf2b2cb60e6bedba8832bf3f3f6c1e3898ea
MD5 378dad738e09710e945fbeac79e0a082
SHA1 207c47b3eded83f4ad9647d549382e815a217d66
SHA512 499c60c806c740fabbe98a4ec4eab01fab22c34e8c0f3c1f49f30b39269721a0d89916c28099d44766a936288c09d973c6d09975b9326886334cc058780368a0
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:kQvGAdlCEL8c/yRNw5C9D527BWG
TLSH
T18A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 83c6e7c7a0a68c56857f280fccf561a765dada35cf91e692d8b8df3c6e9e11c4
MD5 adfd1579c3ac954b0f980c0bc9d7d97d
SHA1 477d43d0c9c9ebedc9a0255b2854652b5931057a
SHA512 bd8e34e0c873db999dc5e6fdc4ae0c905a794849eb366c3c7d7a9d63b03f7b90f7e4282a38cdf40dac79bfda0a3341fffb91c3fd4336501f1bfeb5dd4348a8ac
SSDEEP 12288:IAwSfxL/2Dc3RDLLmt0LDQewsAjiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:tUewsAjisqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D95E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5f391de2a4f97ac3fcf91cda7208d151daa2c46735b2467688679ca9cef52a97
MD5 270ba657f0cae15ad55dfcc8b0790d1a
SHA1 aa7ccc870838ea4bc4a2472aab308ffe291aab54
SHA512 9ada3957ce710c3537091909a57f9415ec06a6c207b7bf2384a9f3026ca2ab68ac2e443a1338adc31f6cc9fd0cac311fd4c29a8fd376b6bdd0f15cae8c87c771
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH+VQBWG:LUEtQevvqc2W1cpV2EI32xB
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 32f8ccc543fa120bdb616a3dc10529e45962106ea76386e8e6d9b1a9cea1bc41
MD5 b8aeecc460e7aebd05bd5d0f9905f911
SHA1 0a444ddf02ac84fbc69c32f9261ccd00592f8ae3
SHA512 bb1f1ae573d61b0af385974bede9c9c697616b983e55dd645d090f87855c9e22bc58de3a94bc31161057d990d30fbedc77adb977717666ec0d34bcd1f2f63c5d
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zGDmg27RnWGj:DoqtVjnmRD527BWG
TLSH
T1D6D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7ba7029d3deeae21e01f4ddbf89554d06c23ac0b68e876a0b7533222b9730203
MD5 278daddb4c2eebc3081d890636a31fd4
SHA1 83136f342abcbb5297e0f8f0f6daf328f74fde89
SHA512 242ef7fa9380304e429fcddf355f69d4cda85d1a821294b51cd706a70d5a0a7256f0d61dfd4da0fc30b9f7852ba32b8f75b4fc318429a877407089c8727e0954
SSDEEP 24576:fAhGLJIFoiwtA5l7S53NsqjnhMgeiCl7G0nehbGZpbD:fAMyFoiq5BDmg27RnWGj
TLSH
T1B8359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 46c86eac60223961d16b1b4b6e4384fc448a283548c26663fd2c71b2a69a7fbf
MD5 47b16eba01dd4bf9326686375448db1b
SHA1 215321b6944d96235ac141bcf450b7a7c04d4a47
SHA512 719da41f4a7d858cb08aa188a41f1c19a163d0997f0304c96ba3995ae9babe69403af56713a3253c7a6e19326853eded395b7789afb75221bff50602e14789dc
SSDEEP 12288:Bmw5HEjsChNzBFgl0WDm+CpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:cwuSOWmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12385F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 64843a297a4f62e52cb391832eaab411efa18890a3cb335a0cb56e73e6b1731b
MD5 64c1256f189f3e24b784f7a66d796428
SHA1 674fccdefce1458e87aa57b109a4e38aa6ee8ff9
SHA512 e6f521be963d9d4f4de314d9234520530ef010ea330437dd0a8edbfcde239fe6c74ddc47a7f39a3e14c8cd4baeb21b3d1939fb7f0271dbc16b7c891d870209dc
SSDEEP 12288:3zZ1IySXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DZuPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1417512AE239820FAE563417CC5E5D609E7337C62673003CF16625AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ff1b9ff1078af30c5bcf4a6beb8253cb5346cdd0fa455914ffcc7b59f34359b2
MD5 6dacbcfa539a71ae569ef6decb73c8c1
SHA1 976c271470d090b67a9b96c2fbedde147d3e759e
SHA512 1d52c392428ebddc1062731972916d56d8632cec928b03c4fa3c0b943cc09ccd45a8a5c49d2629f2f7dd6ecc956766746f68266135f5bb11135f348295c89614
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN34D527BWG:rQyiKayX+PNIVQBWG
TLSH
T1C2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fe8e9b9b3137d59b00fbb43a4c6cef2d8d52609adfe5f71fa4937ab8e5f65d82
MD5 65778d4ab471dbcd1161372384d8bf7e
SHA1 1c4365972d969da4cae57f8304fb80efffb58f51
SHA512 25393fd1a2f0a181ec3ac27cc080c10bc90b7aab09b5d2e38bd87d65b072301ed805ba4fe68fffa327c8b412558d33e4aa3006703e370f60663bb060464e213e
SSDEEP 98304:hQRQyi36YOcPQLvw2gAf+PN34D527BWG:4QyiKayX+PNIVQBWG
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e249e8323e58616cc5fe991d98e102eaac2e57e63ef49a11d099222ca52c5e0c
MD5 10d5a2986aa715b73959808bb6970c90
SHA1 80530369da080a35bfcf8b27fdc7dcf091bb195b
SHA512 b616485976b77c1e8202961c213d0bfb427da2ce77a61ff28f70e451cd2062461a675d6bcce4f7b7cca2a452637b1c2daf837de5bbaa279f4684931d4b57f92b
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fsqjnhMgeiCl7Ge:568Qg55nhheWu7PNU3/2Dmg27RnWGj
TLSH
T16FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3f08322954d67695a9343580ae712887782fb996f8214d8e33817712c1102a09
MD5 b5c1be233b80cf0371fc67dbb312ae6c
SHA1 40a3bb99e07f5165472592bf8ff3d2417f1a8385
SHA512 8e6c517d2483ebfa34d156f8645d03c1d9c3de3e2b308d8ed27cce0dcb162ed9b2e31aa4bea9196f894a4ae3ab3c56a2da91e447e53b19f55ed2ccf7700b4849
SSDEEP 98304:Wy5112gYy5azzVvL69nLKnhZ3D527BWG:HLIHmWhJVQBWG
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 861953260fbe495a77bd188a2763371533717420fda1a3efa6505e762ef3f003
MD5 88aaddd25e752e404e49d784415aaaa7
SHA1 e48acda68dd502c9d8d36a04c4c8eab303c6219e
SHA512 dcb550ca55c90d1008a0470fc3ff56773e1adbd156a31e5860c92c3dbd8efb541ea3659beefbcdb8fd95ab0201dc271833ecf3149e3777f0ab1680810d32379d
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glADmg27RnWGj:8u6JmVxd2dAD527BWG
TLSH
T175D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d65b2dfead0d7d9b1d555e13de0d12f18bfc0dfb896b70a84ddc89c4f0811e2e
MD5 bec8a362cbef8a706cdd610bb1a21de2
SHA1 1ad6d5ef353638c7512bc9eaba083528e24ede89
SHA512 5081ced653bb932f9a1acc60c614dcb3eb8c2a54b69c499f6e47f7c730c2be0aabeed579b44df2a64e3cbd046086d424c7ec5695fe037fb7ab06ddc881cc0100
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4x0Dmg27RnWGj:hmifPbRRD527BWG
TLSH
T16AB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 24b938496160233bf52009bb9d524061feadaf6fec666a5c5721f806d38178c0
MD5 7309153a7e90660d17d1d38d0a34dc8c
SHA1 a05bbd5146a001436abed660410698dc9253ae2c
SHA512 db7cd9228b63aa887f44db7181e8e61c6419e501ba58b79bc24b34f2d428e37e7681f440c7aaa06fb746c8301a865f27a4f277e1c36204f3dc7eee6cce9025e6
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqzDmg27RnWGj:n5dKTi61zD527BWG
TLSH
T1E7C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4924c9ed370b96760514b9c8bbc962533f904819444e2629742c463553b75441
MD5 9f32c7f8419767d7ce9d4472586f6655
SHA1 2afca5f6937667326d769d1f27ffb50702daf808
SHA512 422f25be474452d066798c8cf2433c22623b66946ccdd1be7731e3db9c5086f4c3ae8d1a02f5dcbfb0844ee1f693710d5ce6089ee109fbf75524416f8fcd60d3
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wwDmg27RnWGj:YX2iyph1D527BWG
TLSH
T16195BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 c716afd50e29926e6e6c80814ee28a0b31325dc2993c8340b51d5938408f49b5
MD5 cfc4b757a595ce41ec3663ff5e956bb0
SHA1 074f0b110638199213749b08971e8a7819b04209
SHA512 599ccaf4be33d10a1490a0d29ab17aa9f02e6f6fd7b5170ae9965fa86be0588d643007fdf72484a3875e555827ed59d9586a66a6b9443ec392f13f2110fb158d
SSDEEP 12288:KLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC6523BE955C41CAE52648F5C3E5F10DAC073E5BE92004937A977CBAFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 ddd76c26f93c9219146c50c519b8584ea097a985199bd3f571b0b56a6341375f
MD5 48bcf853a20f8aa42cf40e9844306bb0
SHA1 c41fa353f3e40c6901502c9b7c258b958929ec05
SHA512 af19978f8ffc4a568582b523f62b50d48db5377fe30f8780ff292ccfdb622c3b8060f419965e9c04a4ad15bdea68fcea1c1ad6a13c8f6f4f8850add1e395ae5f
SSDEEP 12288:NuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1986523BE965C41CBE52644B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 f2a637cbbec0897b21e2afd094d746531fc9f8b474cd78eb3b28727c235bf77c
MD5 186f2c3697ee8e0e546261f6b276d433
SHA1 e7ac5ec384700e4a8de02f37c248fcd753ef1031
SHA512 cf4182a9338a7da84eb32f99a66d68f08f9bfeab155c19ec3b51abb55c5e2841a964e90816b5f6564a402ce0200a08af1ca708e895048c2187be5991b7b674fd
SSDEEP 12288:qAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F26523BE965C41CBE52608B5C3E5F14DAC173E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d30852cd0b231f2a953c8cb6ccb06782556d0a6b9cf915d6b68319d6670b556e
MD5 701a96a8644a30350f357a9d2971f79f
SHA1 5df721b1a959b143eba7774d32a6deb5d7fd60be
SHA512 2f4cc9e0b80188336b5f53c326473d24836ab64d11cc8c918eca83a0d94da355ad362896ea2a54b226321c24042d2cbb1fc8ebd8af34945b04888d8d1711dbdc
SSDEEP 12288:qVtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A75237F675C01CAD83285B4C2F5E11DE8237D56EA3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1747cec0f0341b3aae5a259492894ce272c924dea541d877cc1b60a4c7c342fe
MD5 cf04ea9720a47ed1d6d8397d5e8b0b03
SHA1 80ce0208add81948e3eee5c13fe5f0b80a889ce6
SHA512 c7bcdcacf73d1a44177c79b635d705ceda7862abacef6e42fb34d700b616104db1451c245d61b581af8b10ddc5a6e99f868432311d9d005ba1f330a0ece50f2a
SSDEEP 12288:g1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F46523BE955C41CBE52608B5C3E6F14DAC173E5BE92004837A977CBDFAB14984B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 2dcb1672c04ad8bbc91e1432f0f2bbf6a452ff8b00c0c66f6e6170eb9052efe1
MD5 4f88bdb828d499bf8c1fb8acab1cb976
SHA1 c7a20ae5b09d8b814ee52737479ed9710f5ac1a2
SHA512 656a902068cbb8fb41fe793488e143c128c10acc9d50dbf3ba623cd6d4b6142d1d8e3f896a44d04880c8736d7b6418169c9618f5a4ad7a2ffd4c426a6646df98
SSDEEP 12288:waXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1106523BE965C41CBE62648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 d8522b42bdbaadf5b9b1c6ef50e4e4faca88bbf8e7943e64e5a5a1172f06dc01
MD5 68f7024ce4b23804047fe45fab44c08a
SHA1 d7c232efff403187bc7260d0aa955b8e8d8506f8
SHA512 d162738d1ad7ee723c364aa798b2be041d261d37b03ca95698662974b675df9cc0112d6fc5b457b9ce3e7ac6357d8f63b45a625ecd2ace1dc934c7f3b58ee34f
SSDEEP 12288:f2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE6523BE965C41CBE62604B5C3E5F11DAC073E5BE92004937A67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a085dd5c9a9cefcae210f8c55d5a28fe3759f095ac27267f2b66ded584ecc614
MD5 4a11e704dffa7912c1d5e227cb439d0e
SHA1 0e17521c9b689be44513cbb973770e424a35bf78
SHA512 ce3de9058aaa7f3b54fb45d18d32e34eb530a236fd01e6ba4823d579d6db779a4cda3e461e9f30d40e461e742d47e9b85c02b2a5cedd635cfb197f69d956d036
SSDEEP 24576:LZMjzFVSOOsqjnhMgeiCl7G0nehbGZpbD:LZMjzfeDmg27RnWGj
TLSH
T14D8501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 e4d010f466c9c6561043cf113629390c7ad45785551c2172a4410dae31f8cfac
MD5 a095c83aee6a1d9997a021d9439b58da
SHA1 7759b1467f03454d26fdf84beb5a14efc19d6655
SHA512 0e7638929e12a3226603ea5fc86b4ab707d4a78b39dae3a37b6b812c60e04393255c79b28af7b6987e1824ca0f456a600436a2c4f23667ee292d861c5d9e304c
SSDEEP 12288:a/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1796523BF955C41CAEA2604B5C3E5F14DAC173E5BE9200483BA577CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 c9499a5e6596d0c23c4e51777d133073bf419ce67bb68263f81b04b7ff74179a
MD5 d9f92ece04d314f42fcfae61ce653a60
SHA1 9b8401ee8295126273c169f814a99f0b6751c430
SHA512 cd3a0a33e040b49ff3024b920d58212fb0806db6b3e7c90641e84553958842886100ce3264c18640e5c24891dd758d84a7e3c5a72f8ed440aaad2e1054979118
SSDEEP 12288:7jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D6523BF955C41CAEA2604B5C3E5F14DAC173E5BE92004837A677CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 26bc48613a750342323d3bea7c1722b831cf01d56c55b40a6d81c52870f10cca
MD5 da31fc8527dfcc09ec7754baf0e31e6b
SHA1 769d8ad65e6d3f8a21599d25f8f2a19ef2ba0a69
SHA512 6eeef32628a9324587136d0cba20e46e703d137b8a44429256e664c7bca90a0969471178447119eb2fd4e5cd846f41e5767355e917137f1941e41564ceb769cd
SSDEEP 12288:pyPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IzySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10375125B73A530F9D1368178C5A29A06F7327C3647204A9F17A016BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 8faa54b178ca0ebd9f25ed14eaa8f59ad46c88fa7611626301d896b67223ad76
MD5 6f4101311e077bfdf9a3b8f001847609
SHA1 63437df488d50381c91d148c459a63d78da2c0ce
SHA512 633e2ef9ed69a6fc615380dfa51843366256f22227731fc95522d3216816a9ac74df44fa17f3b9dfc925ebdd4aa19e948465f2c2a5d17926ea309c0c26f70b90
SSDEEP 12288:i/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1206523BF955C51CAEA2608B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 e7cd366d1904bab5e04a5c19ec1f355f8e95c005857ca49e65864401995af374
MD5 46dc969eea851cd4d9afcc9b0d94be13
SHA1 65ef6f9d3102f298c81c6614bf9f213e218ebce3
SHA512 5d42bcf0ea8833b18c30628ad8b079ae828c393cf6041f43bcaaf6e82954a5436fb1f80aa9a6bd64d133e0f0fa3f1738430b54ab4777de2e359d9b4a5917f76d
SSDEEP 12288://Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE://sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E66523BFA55C41CAE62608B5C3E5F14DAC173E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 ccae5d5fef908acdee1c5874d082183cfa7bd21dbcc2089589fbeb8f4e6e20d3
MD5 c394a7c666c08e31acddacdbd2d6c587
SHA1 bcf06cab8ff1be52d8e7c3ddebbaf0c239681533
SHA512 a42d3490592a33b80554f8afbc51cdf0a5694c236ce65521a65b07121a90abf3eaf6ab196f509081d0759db6e7ecc4c5f8746536163aabb1479f0af4c2b8d36f
SSDEEP 12288:ryPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12175125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 5e5be0c462e367f6dde8ab927a38bb18077c323cd7609dd8f41778a9d72b14a2
MD5 e8e8171b4d828fce4d0436a1aed9353f
SHA1 5045e060be778388beba4e4515e7017522c168c9
SHA512 131d8c84c5c11e2bedc61f6c5891301777d051b39d7d6d916d339ca3012ab3c151fb0d6b22ef5945be79e632c51f30af7cfe5e1438ea6d4909c5b21ccaf809c0
SSDEEP 24576:JTYaLl3z0zDQsqjnhMgeiCl7G0nehbGZpbD:JTvLljNDmg27RnWGj
TLSH
T15C8501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 fad165f623d3d2737e46e0f188919732c8c42b9fbafb53040d945bc4639562f7
MD5 779715910b3c092712dbd7ca48b44dbf
SHA1 09a88e2d39e99d2e1f03e2e255f50b2690457c0d
SHA512 fe6a06382cfbea19b19b03e81b124cf86dc5b18d8aad2a0adbe5b7a9015224c5bd8ceba8d94d08fd2f01a540f9408a7854e209ec94d666f8aa7fe09972913e8c
SSDEEP 24576:e35d9CHKy7GZssqjnhMgeiCl7G0nehbGZpbD:g5d9CHKyaeDmg27RnWGj
TLSH
T1D095CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 bcc747b7e35d92842b27675c3bb09aa40d151bbdf762fbc0bd7510a56f797870
MD5 9513b09fc585e66538e27b4116015756
SHA1 717ea811f81846f227d0b17db869b47ba44172d6
SHA512 8fda9dc94218adc1c8a5ab454e79a60ee2a431112cec7b7235f958315dbdb1ae7c6d3ce056048ff5ad3bcfc9a397bd8368189b66960aa30769d3768b220b2485
SSDEEP 12288:tgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F26523BE955C41CBE52608B5C3E9F14DAC073E5BE92004937A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 1b406a8bb2af59ad06d1dfbc63893062e9ca356fbb8e9c7ce7541128381e3417
MD5 3959b0ba5d726ba500418be71f36c1b7
SHA1 fcf3545814988391ee84afd89fdb5816ba9dd376
SHA512 81499caff9e34c0f7858c9afb4e8886e98defe67a2730fb1f74399a3c3bab5fefced327a6376f734b4f1c0b71f1973cbf58a63c9fb063194b487ba668d4e0351
SSDEEP 12288:gyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1636523BE965C41DBE52604F5C3E9E10DAC073E5BE92004937BA77CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 ba9629bf8c550a41e88adc4077eb69208167c488480b11cd2e2f4dd5068073f0
MD5 3f487cdc8f54b03ec059453eb736352d
SHA1 2167cbae8232cccf036f4c7bac1ea0d47431b629
SHA512 f578d92daaf5baad610c18e1c6fbab8c4737cfbfdd8e81c2bc9e93e1c95e1ef242b6d705edf8580c47a009f189a471aead812f76cac54c5bbd5e54ffca81bb03
SSDEEP 12288:4RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F96523BF955C41CAE92608B5C3E9F15DAC073E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 b5b29efbfe3d36c16319784980d28b27cb2a842134994988a83559e8d285a75b
MD5 a1b7d2c7f536c74ce8f96f7012bd48fd
SHA1 ccb846210181054d187955bfed934835ca2b4064
SHA512 9ea01d153ba5d74ddd1ca63f5551e0caaabb865ef282bac7a94ae60036ee06cf9f4bb6cffaa3efbe137aee0f21116b3308f8bd68be95c9617a892e26bd03144f
SSDEEP 12288:E/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1096523BF955C51CAEA2608B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 80ba4fb2210bdf51280e4d1687fb5d18fe16da42381002be133adc0227d7d04e
MD5 84741470ed3b70aa8be20d77b51b2fc1
SHA1 79134e4642f0189170508d1d1b1863c4495ffe28
SHA512 73930559c90d32dd52541f0fee570ae7b4b8078eca26dc237e15b1f8bc47fb1e55ab054f1f938548c0ae2534bb9bd2944883c3e1ebc523146e86a8336b7bd795
SSDEEP 12288:XgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C06523BF965C41CBE92608B5C3E5F14DAC173E5BE92004837A977CBEFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 d30a1fd2f952b5eb14f695eb7fc07a846554b9ae997384d5504d109da56ecdcb
MD5 04fc869093566708c708d36bd691a8e8
SHA1 00c31baf6c880edb5f2a7f3b1aed9e4b739bf622
SHA512 673b57a534a93936fe07941fb16ba78fd406bb782e98c1fd169fbe87ea1d94fc91cdd087581ef0877f4791d2805ce5a2b25fe334fc7e75b362ffb0d877ce0aca
SSDEEP 12288:CHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF6523BE955C41CAEA2648F5C3E5F11DAC073E5BE92004837A677CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 f73dab09491c266f0265beec3e44f3a6dffaba006288ad187f2b61e7d3652de8
MD5 75053eeb0bb559971cf543c2a7c8b678
SHA1 7c66a60a0bf8c44ece23b466aaafa634e9e8db32
SHA512 0a9d15eeb73b20fb24a6c487784d92d94c0d6879b5784f50a1a1d759e9a6efaeb5b36d6eec28e4225a7e37dbb8229785b28de64bf071a8a68248ee428bdf8744
SSDEEP 12288:G1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E66523BE955C41CBE62608B5C3E5F14EAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 84c54640a2e237ad3ac06e3e1759f0aff3855adc49ab0a2bbcab617c5f37db07
MD5 c2f1245813a56cf460aa926d9900ff6c
SHA1 1cf974204cf6dd7102f701bb6300fa53a22bf00c
SHA512 f4c9d2596d86ff54ce8a144649a429a335a688ac93ff4e73ad7637eacfd94dac44fc42b735018e916f0840a0e554d3d62323409923591f02d892b49e404c0ba5
SSDEEP 24576:IfwvTk9RX6wkyAITsqjnhMgeiCl7G0nehbGZpbD:bMnYIXDmg27RnWGj
TLSH
T19895D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f6d9d53a5d93732854545278eef8d4ce754fab9d66f20948c42c17b24164f64e
MD5 58103f0043175d91bbad3b573f219484
SHA1 5ebd69d781a65d0020224e6258559c0cf6ffadcc
SHA512 5383e927241f368f5e808da3b64f19c5352e271cb404764e69018ce45ee604fbecb71c21948d57663c6ca62acb057b46d93078d351057288ed028e0855e41326
SSDEEP 49152:vYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QDmg27RnWGj:rySzPYD527BWG
TLSH
T142066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d3b6bfa15b2ea1e0111b03f4ca8ec195f8fd35e3e99d0e0ffe4836cd3678f724
MD5 2f05ba6c2d705876c29b1af0cddc6995
SHA1 cc8cabd009da532bbb3b79388fab9fce3b47fc28
SHA512 9ca6eea5a45ebd5d30ef3fad0b8418852f1d0647f7a88a154a29fc58f8396a71048da7a4431bb03c5e13f23b80b75a36473c611ed2d1204eb991ca017903b7ed
SSDEEP 24576:047Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+sqjnhMgeiCl7G0nehbGZpbD:047JUQj1irIhCnDHUPfF/ADmg27RnWGj
TLSH
T1E965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 1f6fd068c0d0e973a409af89d9690a84b816f9a6bdf10dd47b11ba4351f4bb0f
MD5 527edcfa94065d0566918915684dc115
SHA1 43686df6635428b4e84dd128fd407fbec5a022f3
SHA512 4e92266c02ab4821daa596d73eeb82c2a21419d78624459ea2cf8b5e55748e47e5a652910ada617ac5ef1c89c69657f2e45dca3192a6103454600f080d204466
SSDEEP 12288:CjsfPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19675015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 640221f8b48d3c53806035a6186b9c5fff7c3ef576b5c65300a93ab642174b84
MD5 49b7f248f699782300338249ddb76def
SHA1 a4587c4e1fef58426a03a7d4bff140f489a28b44
SHA512 2843edd163ecdc702c85d8b9576c2960bf30a862858b8bf712f8fa7e399cadc26909dac72b3a8fa35d3210c04b531fa1a96d709cb8e13b5812021ae4f98926b1
SSDEEP 12288:A+BLDvPU3fo31glerly37MpLl5ZhlHTF8Oo5YXpTYSFBjGfNn2j8:A+5DHUP+gFELlBl6VadY+BjG12j8
TLSH
T15D451741762BC64FC6A950321E36D6CCA770BC41FE049F0372C9873FD576668BAB6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 aebeb2386f497cbcf6ab888341022ec5e729c12595922dc8be93d67164cddec0
MD5 6d2d51647a71dc765e9842c155836524
SHA1 892796804c1f8b02fa57bed3b705e10666ff05fc
SHA512 ec0e5438a995f72e447c908871ed3512cd46d717893f37d35345dffb714e8a592b5906b0b8acff0a9325e5b488119ea980767feb3fdc86e60da503b8e59d0b09
SSDEEP 12288:o5bu+47LmZLcLJ7jqOah9Ci36XSMBUjiF6zlzVIe9Stv53qGRcnrySScy6xGIsL:YbPwdfTgwBBUjYcGRzTRYKL
TLSH
T1B6551A41A5B7E31FC9FA50374731C68DAB74AC06B7452B0573848E3C886667EF5F22A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 8295eb578020424875ad1230b37fdeec09a392bbde6bf5a9238cc6e3f02d7709
MD5 87ac75a36459deda3add970ff111700f
SHA1 5b93843c994b8af2a0b0dc5eb2b8a1a18b9e8707
SHA512 69cceaa0b3451dcedefb68ca93477b00a6f32d1acc826190f0fb4d2cf17447749d3403714275d2c755be30e51f1d26f75f2dac359a47d09b479fa76b234c78c5
SSDEEP 12288:TO7XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11565237A935C518AF93605B482EAE12D681B7E669F1004C3BA1378FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 96d18146d1a45415c3eb74446d83199a4a9c3e52a865d8edf301693f676b3856
MD5 2464ae5dc901a6584216da7006858dcf
SHA1 483ba793e4b17f1e5ba0db344a9830a0f8c1fcf2
SHA512 00b74f1e85df32c53beda83baa5f3a6d6e31fda3a19aa0e152a6c13d3341466af57feeb424168ab78e2e46436c320d6d9f77da877ecf953227716c0c7a46709a
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYJsqjnhMgeiCl7G0nehbGZpbD:4gb4mBIBhGFSDmg27RnWGj
TLSH
T1BD659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e6d5f9e699f14d8fbca899cccd82540afdf327036a431e17d82948608b5d4acd
MD5 15da6ffe6f51dd4684273cd500e1bd0b
SHA1 ed43824d2a874779df56bc9830b92f3a979b7a89
SHA512 94d8fb1eda63dc675da5c021320d082fc573579470841fa4fa488896eeed40e2e5878167ecb2f1b67c7234d81adbae802104d6d4163ec1136bc6fa523a7155a3
SSDEEP 24576:NG88u8FpJqH1kzria7/mOsqjnhMgeiCl7G0nehbGZpbD:A7ZFPqVza7/FDmg27RnWGj
TLSH
T1D2A5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f8a7225a3a1c850a9fa8e887f392a584f90821882ddd8137dec4de0c4249d968
MD5 e443de2f743d010e248d91c466620a5c
SHA1 60e32104cdddd7ad9510c03c95ae0b299500d4d8
SHA512 8d5cb54cbe979521c9738e6c6c167ce6dc7233351d3710aefc0fcad253594e4de7a7b2935c443b16ae5dd44fba159d850cbc6aa9f0b1f1d9d4a65b9c17bda951
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuDmg27RnWGj:AG05lO43bvD527BWG
TLSH
T146D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e894d92ea2bd27e566d608ec45f1eaf06ba010401826073dd1a8cfefbecfd5cb
MD5 97670c589aba8022e06ee2d777b03db3
SHA1 7a71e3fd59c7fbd9e6325acf7a514d4d50e89253
SHA512 1235792154c17fd3fbe91864e493c39224edfdffb775e5f9ee59990286890c59eb77db6d5910ea72ed3de52c78bdf53cae6846574f136928205ad7485eeecaeb
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0sqjnhMgeiCl7G0nehbGZpbD:5a5POZ3+Jt2pasx2+m2Dmg27RnWGj
TLSH
T10E65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aec7f2c3b566d442956964fef550ab4ed19c2f5402bc770f3267ec8bd54c837e
MD5 4383525017cf562390a23cbfeb7ccc49
SHA1 21235d342ee5f5a0c344eaa59e04889f36b94b0d
SHA512 db3780232a8fa270ed478eb473d3f3155b07a60de320a7e5d33d4f407768712a92fe690da855e6bb691782becf6885e3364519c2bd9420ec3a25be7d5562d868
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkGsqjnhMgeiCl7G0nehbGZpbD:WNc/zEOVHFlDmg27RnWGj
TLSH
T19A857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c5edf6c4c0a549605f083ecc726289cabd0f59c6bbe290471597897b92edf3ff
MD5 3e67d15a7ade63f4cdcc718964c014c1
SHA1 d2e4c0f2e7bf61bd5f12d088ed6327855dfa5a2e
SHA512 b36bffa2bec37f4ba786faf571ebaae6a57e6a5cbc49c468fdcc1e8b354fb593aa737aaf58721f3991c06af73982d51d3fcb44505444cc581e43e1c76457e02d
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmYsqjnhMgeiCl7G0nehbGZpbD:D8MwBtOmEDmg27RnWGj
TLSH
T19855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 db8dcf2d5fcb2957775c5a29c61dbaa1c35d29651083079bc88f94273af2a425
MD5 6665d10ae6e70dca3b7671950172d844
SHA1 92e3673ad43f6972d966cc1b4757676aa2dbdba2
SHA512 5d221b7523ec89eb6487031acd1a73d68b475ac8a74640dcde256129741a4867aca132aec5fc8a1adfd6d769a851191b4b668d389dc4c33fe8c623a66362215a
SSDEEP 12288:fHvUrBFrEjwaQKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:fPUr+NQKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17585F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 ac32ab7c3fbecc6dfd49520daa2fb397f6893fc1f130bab4846a9be5d5e40f07
MD5 e10d1aac4de66d87a6954b2f7dee5095
SHA1 8ee0710108dad9d0ac660834f070eba4ce91af2b
SHA512 9b39cd16740964dc1bb3933ad721741395b6977b4d6114b38ab5e6663bc1d14422c53dbee3dfc81e2ab4bfb9bfbd38c604453c493acc9f4e835346b97faf6c56
SSDEEP 24576:7D3FHshBIYQgArsqjnhMgeiCl7G0nehbGZpbD:7DVHeBIAAfDmg27RnWGj
TLSH
T1AD95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-74-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/252-66-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/252-237-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/252-68-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/476-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/476-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/476-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/476-129-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/476-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1500-317-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1500-123-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1500-117-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1500-121-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1812-185-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1812-55-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1812-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1812-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1852-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1852-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1852-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1852-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1852-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3808-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3808-331-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3808-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3808-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3808-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3808-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3944-80-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/3944-85-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/3944-282-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/3944-79-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4720-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4720-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4720-103-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4720-109-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4720-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4720-314-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4872-0-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4872-2-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4872-78-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4872-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4872-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5240-321-0x000001D435BA0000-0x000001D435E2B000-memory.dmp

Download

memory/5460-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-23-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5460-14-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5860-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5860-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5860-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5860-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5880-39-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/5880-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5880-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5880-53-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/5880-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5880-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download