9f68716b878ecb0cb4a4217a2b5234845e4be3b30c8cbf0413189ce240880079

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 1.5MB
Sample260723-ndeaascc79
SHA256 9f68716b878ecb0cb4a4217a2b5234845e4be3b30c8cbf0413189ce240880079
MD5 081c58be6bbd5065415f952fca85d5f3
SHA1 c76ba0e35cd63ef75d97ee15c9d773279cee3a2d
SHA512 f237ad8c7c0613fda6eb970f84cecb18f5788528334ba767383d70b60626dfe2114fbcd6131899d650b5db2a2a3b5d0b3c250c78073bd4f6c2bc7537b8b9577b
SSDEEP 24576:Wuqj3f0uerbtBiv8BsqjnhMgeiCl7G0nehbGZpbD:WnD0t/tUkVDmg27RnWGj
TLSH
T1B775E05AB2A850FAE86B913C8892D149F672B8114B70D7AF13B1066E3F337D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3360	elevation_service.exe
3088	elevation_service.exe
5708	maintenanceservice.exe
4200	OSE.EXE
2088	PerceptionSimulationService.exe
2468	perfhost.exe
2884	ReFsDedupSvc.exe
3756	SensorDataService.exe
6112	ssh-agent.exe
1064	AgentService.exe
5408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1c54259ee05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d93fd9c4941add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0fb26c6941add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a13d73c5941add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f60c52c5941add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032ddd7c5941add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000288037c5941add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d9cfc05951add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2884	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1064	AgentService.exe
Token: SeBackupPrivilege	2884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2884	ReFsDedupSvc.exe
Token: 33	5408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5408	SearchIndexer.exe
Token: SeDebugPrivilege	4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4920	2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3360	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 1048	5408	SearchIndexer.exe	100
PID 5408 wrote to memory of 2976	5408	SearchIndexer.exe	101
PID 5408 wrote to memory of 564	5408	SearchIndexer.exe	102
PID 5408 wrote to memory of 5724	5408	SearchIndexer.exe	103
PID 5408 wrote to memory of 2720	5408	SearchIndexer.exe	105
PID 5408 wrote to memory of 2568	5408	SearchIndexer.exe	106
PID 5408 wrote to memory of 4152	5408	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_081c58be6bbd5065415f952fca85d5f3_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5708

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4200

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3756

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d95bdca671f14f315e502b4885c1e99b76617c1a7b1ea48b8370d7d939db2b7b
MD5 e9b32b8bdc1f4f32ec65cb8d5f89ac7c
SHA1 869a1649bb181981ecd333e01686fefbbd9e7282
SHA512 3bba4df4e63fc559056217ec2bfebdfb981eb835a64eebb982e06a833b86fc3ac6c4e0b2fad9e1e0cadf826de22a748176daf48e3e76bead5429605a83529450
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2Dmg27RnWGj:o3q6sjBVD527BWG
TLSH
T10BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bd4c858049b726f9e2ae4f8869749069327f7f62aba4e8fe5365d9b5c65a6e75
MD5 ddf9ba50e8971287b920ccbc43a43dfc
SHA1 bd2832cb22af6ebb4b7e88d08a4192d483ee9429
SHA512 142b1d71fcd5d5fb81f02874c0c50f8ae1e7169acc4545f45163df53fe338b43e25f32842ce60dbb522dcbc8c490cb8795990158227b3c08af06931e23a3bfbb
SSDEEP 24576:kXYfDtczA9sqjnhMgeiCl7G0nehbGZpbD:DtcsDmg27RnWGj
TLSH
T16165F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 11f3eb7779626e800c0c0210fdbab5478a2350b7e7702be534c15bdda274f9f7
MD5 bfb47e7f646f1a44dcfd783348e9247d
SHA1 d4aaab87ae3f215a52d6b3f6c9e8ab230650d63d
SHA512 436ed3049a3858cf1ef296274988c899efb9c30b76303a8226e9d6351161422c584cb793b6463aaff29a8a47d7ad1c588c953dbb86ec0233df2f491bbac0ac9e
SSDEEP 24576:E0Le5ji0hmxxrMKsqjnhMgeiCl7G0nehbGZpbD:EPji0AjLDmg27RnWGj
TLSH
T1BC859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5998125aa088b6bef63347392f3cf60cd95a2a7ef7dff261f57405b6f8ee87e4
MD5 9f4172b615ed45316ca324eb98a255ff
SHA1 e7733f04d8cc24962571c9379567d1fe13fa552f
SHA512 69aea56b21dde5c381bf79c62384466e32ba21c202aaf4652c13a00838076bba1a5a02d507878ec66e6b8ee993c2d02470870d308464f3184aad53907e9bb450
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuAsqjnhMgeiCl7G0nehbGZpbD:+/ezSC6vUzPveHjyXDmg27RnWGj
TLSH
T14B755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d01f833a67a893e722f75e995626a43c330b36d24d96d71affa983017fbb7759
MD5 9109c4b692dded6d2fb6332c07ff6a78
SHA1 4350ceb943267c837cb9c62958b316e614baf184
SHA512 da91832b1d031dfa75ee50fea3c61f324f6aab0b029426f5160dfae55b13c86ed018c8fc37407f7efacfbdf4b17095ba49307448b2483f75355c15c4c74ad195
SSDEEP 24576:aVbqPb88hv/l+YRsqjnhMgeiCl7G0nehbGZpbD:aVO88hXl+0Dmg27RnWGj
TLSH
T145559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a367091f529312c32458209420d99880403cee70085ac6855e419ed454b854a0
MD5 bcb339358b4b1547b50115fea697fcc7
SHA1 23a80936217ec9c41fe8ab9715c09ea11a1d1ec2
SHA512 2bf8711b3d5f7f16053fc238aacac581daffe0d5b3bc68bac40f16a9937e546c1f9fbea417d2a030126eae8f128042f25588aeeff3e061fb9eb83b08ca9c51d6
SSDEEP 12288:ALOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ALOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BF864C50CAEB7608B5C3E9F51EAC177E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 bed646e64e0d2a3338f07b82d0c800fe9678af0d7adf8e76efcf36c79275846d
MD5 ed5402df35ff645fad7fd62168eca7b3
SHA1 197b820e093aa1cba33bf99f73cab76ddcdb76b7
SHA512 a00bcc698d3b92ba41f50e88cf5ac15db98b7ff889d85fb2b60671bc7f76fca32f138dd28768c94150b2e8529ce31ca32fe83642787632d272343ed6c207538c
SSDEEP 12288:PeBNUbTVO86UJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:PJIUJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2afe3aada5d2d8256917b6571553b3024b24df206af2f501f94470028fa8032f
MD5 8758a1f359ae5a0cc9f7872615026dd3
SHA1 5e7eb470324aaab4e6b0c8623049939ea0cfae8a
SHA512 9e7362cdc88b4d46805cf1b211846b45853ff7b9b50ce5c7917cbcc37a9c748ef08645e9713e10cc51db6537bda54f62a38bf969f030ef3aaddecbd877c6fc59
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:xQvGAdlCEL8c/DRNw5CMD527BWG
TLSH
T148266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8e4eb127530bf0e5b067d84441bf54ab31233c3dcfedb9c6ce420dfb645f0a5b
MD5 bdc3be0e9aa7ebf19006c9ef7f54163f
SHA1 562a1fadd19c8539cbfa49b54fe5309663d0426a
SHA512 c37536499d5123dd5985a0614ca8ffc04fa4ada387bdd2df350310bdba909553bfc7043b27c830bc6bc79ec57ce1f74754ccc5e999fa774aab200b3c6f9f1d79
SSDEEP 12288:1AwSfxL/2Dc3RDLLmt0LDQewsAjHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:W0ewsAjHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE75E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e5b8ed4c2e584f2b23ac3db1fba20864e4a223eda02e47f0aad98a40fa5d3a99
MD5 6663a52d5bca81e6bb23efed0f4e94d1
SHA1 9f6ee71b740c3014b85327cf1f1b31b6fcff6876
SHA512 6bf387c67edc4c027a87fbf95e81d98b39f1ccc7ef4a07e1be342da7b6fea1f709bf3121160e69a4a10bea6beff182521b12e0dea56bc760b21b7ac4da3c5ca4
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHzVQBWG:5UEtQevvqc2W1cpV2tI32qB
TLSH
T160474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 57b436f211813965e18a9ae67d4b61eb622bc2a46581d58d4f63378a24f83f0a
MD5 1c3c53890ef07f44337f13844c92ed46
SHA1 9d0e231dfb052976ef0086258c8319f7feb23a4c
SHA512 68102a85ade22eebc74d61bd3d5cc6475d2179d80eb0b131078bc6f0c2aaad2bc4d5d87621ee4040b7f9eec4886bfd0dde7fd3448e92e656652ea6535932af36
SSDEEP 49152:mCbRquA/m2yL5zTfFiV+XenmE3/z7Dmg27RnWGj:LoquVjnmID527BWG
TLSH
T159D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a22fbcc232926fb1a15f95566b646d8d42a8526c446f761f565554b02018eb0f
MD5 391ef1113aeedf4882fcd83c69d3ea6a
SHA1 3138f01eda943a16b0513b59851b85e688bf078e
SHA512 a59601712383cc4a3453151e5f9b6e3e9ffddc09a3360f67b27963097e02b3f05db5a2ddd18845f4985111eac046a7bd06b6e6f748c185c9f311625554ce9aa6
SSDEEP 24576:4AhGL3IFoiwtA5l7S538sqjnhMgeiCl7G0nehbGZpbD:4AMUFoiq5YDmg27RnWGj
TLSH
T1F0359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e1d1b1956c413dd0af6ca689190d14c63d16e4291b2cfcdfa62f8d7c51ec0aa1
MD5 54daea5608752a4bf1f18d8bf86e6442
SHA1 8f32015962f03a849916d7308656f3f64ebb05d5
SHA512 1bdbc3407019e36e7a918639d1bf197853e07236bce48d88a55312584c47d035aa76d9b0481802f673e1664edeaec03b016b4e6ac5dbcbac4a581656a6c1a7bc
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Kwu4OWzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11965F14A76A81CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ccc3ef437b76fb8ef34b95525ec74720faa41d8bbbdc917d8c977d0b573f7be8
MD5 6463a4a23bb07e9938f4daeacdcffad9
SHA1 6a9396be33187683d22afd9185d0887421ce852e
SHA512 2f5a2b3fb25c4694c905f6ce2a59ab492abc3edd885d9d67a27b623adddae1dd1d479a7591994d09ddec3ba6d412d270ff135dac1a8cfe7bffd026474602ec8b
SSDEEP 12288:meZ1IyXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ZuCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B5512AA239820FAE5A3417CC5E5D609E7333C63673043CF166655AA6F73AC44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 680493a9b5a0abea8a8242369b27d6aac82b733e440dd031542ba80a9412b9ca
MD5 0c2379332a3ce2df9e56036b1056c8c3
SHA1 65b201cafbd0b017e908bc1db18b0d9a2c29b58b
SHA512 040b38e7b0e00ca4127c80ad84a07ea714adafe32fc3bf488c9595494160a0a2ee1756a2f10dcc29bc0301b248fd364b005f3d93c78a3473e4b93a0526a59912
SSDEEP 98304:7QRQyi36YOcPbLvw2gAf+PN3pD527BWG:KQyiKa/X+PNZVQBWG
TLSH
T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6d89b53456aefd6d874ee53185e61a0114f2fcdb27f0b7a6dad03214f4e96222
MD5 73aa5373d148fae3bed642e8703213e1
SHA1 9f389414fabd23d894d1bcbaefd1c055f137f17e
SHA512 445b23a4f58b5e29fc4d84b735e3e1ffd10847a0a0378ca9a2c903a7e5e572d31042727e42d2f6922e686c76d0f18106fce0d649f29bfd0d068e9ec73412eb23
SSDEEP 98304:RQRQyi36YOcPbLvw2gAf+PN3pD527BWG:IQyiKa/X+PNZVQBWG
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6a09150b2d6c3ac1e985f2d0214cb9d2b39b54e8a48093856561fcb2d7a917ee
MD5 a8a3d70930b0324e413f09e2224043d4
SHA1 54bfd4da19a9e46a19e540ff57b1441a86aa9b0d
SHA512 136d83b9430cb7f92ed667c7d88c6c24739bc7cafce77dd24e75c9b202cb4bd6715d3f902b3fbe430b975ffdad8f5a7df384281e737daa28fac53f63fc83b649
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ysqjnhMgeiCl7Ge:u68Qg55nhceWu7PNU3/LDmg27RnWGj
TLSH
T170B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f5b451a52e4ba01cd2f90e64209ce6faa50b7aa2285596dda1eff789598c03bb
MD5 80d518bad2ddd28b47ef800311f89219
SHA1 8ee98f01bf7775b8a25153b4586bd88f0e8c5933
SHA512 efc253820fcbabe1c47759aedca8bca5c418a569a14d965766aedbf0f9f966cbaa8b6adcbd997bc8c32e1d13f4faae68274f0e978a6d539a4490a8cddddcf50a
SSDEEP 98304:qy5112gYy5azzVvt69nLKnhZiD527BWG:TLIHEWhgVQBWG
TLSH
T1FE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 33f84ba5b5ae2f7ea4a968f528809761b1295ca20a4358db9a994b60b4bd6f0e
MD5 dd4738a1795325dd1fdd69723ce20449
SHA1 bdf7fbb73b3c3d2285c75674ca175dc9b639ad08
SHA512 90d76933d94383f09cb60ab26b1d289c42947ca8d68a1b5eeb0319015348974a7e7fa7ad585b55ef9f6353c1a788827460b2ec8eb373f9894a6abe6c0710f075
SSDEEP 49152:ZB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRDmg27RnWGj:Pu6Jmdxd2dRD527BWG
TLSH
T193D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2ba02c45cad4d49853a8f1e4369cc74fc14c5cf82eb9492bd02fc20af8446acb
MD5 0ff0bb2528a6f2b28bda429b04efcbeb
SHA1 437dd343b84f557471172326da7d88fb5a7d94e3
SHA512 bf72c0f2d7216edd47950f08216a1f8dce6cd1ec64a629f3e7ec5a454790c2aa4ad70ff4d8eda61265c84aa65111d5c91f6d768beb4a2f09af0cd5b35e015b06
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xtDmg27RnWGj:6mifPWRID527BWG
TLSH
T1EBB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a0807ebf653611fda74cd017e4a5ac661dcc61075f45bdfaf7e4d102075e343e
MD5 e9adb5f9859a9728d0f64dc368595332
SHA1 10f0073a8be4a6c0c08a1ca748b04223bceeb2aa
SHA512 e8909ccec190587f7ccaf7cd3243bcc2f18e3a30e69f723f8465882362e6a2caf7211ecb06bdd73180c7148f02dcce80d98444b3f40249dea18324aaf89682c1
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqGDmg27RnWGj:D5dKii61GD527BWG
TLSH
T149C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5429a5b78b26261961d4c4aa16e393377aaba870caeb0d3f88724f52b458e6ea
MD5 be76d8076f6f8ad08c88b7dcd72b73d1
SHA1 e2a62ef370f75b30297013dbb7c71a9a13be7ba7
SHA512 73b25750be6a56c00aad1de05a83b641c4fcd21f980ed7e39f217c7b80fa8521df92368d8451286341971b40946e2a6908977f50061e38be1cc3db60c8475c8c
SSDEEP 49152:xhtSn8EApI0fig3giDn0AP5whDmg27RnWGj:gX2imphED527BWG
TLSH
T13295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7f7a24ea853d4f141b0223c96b1c74421cfa398155c4d70cbfdb173e95e90b6a
MD5 b5cf3e3981b2d6595525303f6b3278f0
SHA1 02fbf955f3d0ce1bd656c62c271d80e041cf4c74
SHA512 d39a83ebbc9c8b6fdd2fd5abb18365bcfe9beac22241165949f43f4f9aaecd5b4bb719cc21bf6d0aaea76e6628eb407629e67f7cb184eeda5e3086d5823f5ede
SSDEEP 12288:UGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB4523BE965C41CAE92244F5C3E5F14EA8073E57E92004837A5B78BEEBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8d36f73fa8328d9a1d3963387ec2a28fe7e5bed26fec972cb712827854aebabd
MD5 f769c63a9d38f7fb1fc21dac9457bcc4
SHA1 33a49bc2bcada324ccb594110ed1b930aa78925a
SHA512 e333c189e0121186ffa191bfb838f6d186e5723178f9b044612e56ee5bd3b2d0b16a41e164a00605b6a4fa8ebcc11cd53ea2f47d34e14dce642a6c5a5256daf1
SSDEEP 12288:KbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE965C41CAE92644B5C3E5F14EAC073E57E92004837A9B7CBEFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cea8a2e1a2f9b77a43d90dd201dc5e623e75fe7700712a21420ebcf707deabbc
MD5 08f5ef7239b302fd5c5ef66472e70b46
SHA1 6d5a17b582deaf53c6587c04bbe4a28584601cdc
SHA512 1725cf2143e5d92e4732628a64461917471e636fb3904f3808abe7e1298b94f7badb5dc06d8cffd92ea26ff71ff4632b2d7f3903d851b097ac5ff80e5ec24102
SSDEEP 12288:0BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BE965C41CAE92644B5C3E5F14DAC073E57E9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2f96ba4a7d4a40854ea24c4eca9f06c026ec830ef73a4d03cd6c8a2da374e90a
MD5 629da12a26f38c22ff2700c4e3a5d433
SHA1 afb360681bf85b7fabacb2b8746104bf2f694289
SHA512 318276f2edd229fd878d88a8d16b8c112b4e327fd217bbaceaa562e7d963bcfad9545475a794e1d7ab6710336d820e00e53156125f02f60c49a7dc1729edb452
SSDEEP 12288:HVcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F445236F675C00C6E87285B4C2F5E11DE8237D56EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 37bb675d477d34de50bdf0d31a2b2bcae263e34dc72c936f6b1fdf57c6195b36
MD5 bc29cb69178093e10763f0d835f8859e
SHA1 72a9ed88055897d23bd6b9b88e5d7a03a9d9b518
SHA512 e7d7fbfc38481aa03d1caa73d117ada4995f6eeb6f46252162049e7ea4dfbc2e91d781d95b9972075cc5a4a61169f5fabb54821cea2029744a574898e131d64b
SSDEEP 12288:qkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qksqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BE965C41CAE92644F5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2a840b6c3c56fe55d18fedb8a711660fd061fd8722911a7792aced85f73366ca
MD5 f6b0e91c09d25333543e45ee252571de
SHA1 19ac7b801802040bf3c141903e04f67f5003ca11
SHA512 7c3cf2b1b976961b00ef4616ded2059acf6045ddf4864f1025692aecf937ac61d42ab58743c2c11dc2191b370ca69123c722bb55a187f12cd0c108610912de81
SSDEEP 12288:sfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB4523BE965C41CAE92644B5C3E5F14DAC073E5BE92004837A5B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6ebf9799937d0d1bbdc889c08b0eecd7cfd7160301488fd3a5d6b2d882e342ee
MD5 ee65c6559908f5efd4e18ff7df55ebcd
SHA1 7ff611de682d9046cdcbc0ab999dbfb0794699b2
SHA512 d2b240283958ed4eeb83b342247ee1a1ce262e0da76bb4d6ec47915b19d4f30dda00dd253eb90d82ac36d1be397f1b29cea2964752c4307bad6d98b8ea1c774d
SSDEEP 12288:sjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BE964C41CAE92644B5C3E5F11DAC073E5BE9200483BA5B7CBEF7F14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 95daf8a5d9cf84ed42cf7cc69eeefb2e189122d63c5b5ad207f3d0642456d167
MD5 5ffdf8afd714ebb5230e7ab891042a5a
SHA1 b4998bf1f8f373eda9d243963294294fbaa96fa3
SHA512 6c9b27069edc6823bfeb231cb2983267ec79443a47a48e004b54969937450a6312235e076d94a0b41c58efb6092fcf4ad1aadd1e0b0d795cf4fd4b1c9dd85ebf
SSDEEP 24576:5ZMRzFVSO7sqjnhMgeiCl7G0nehbGZpbD:5ZMRzfTDmg27RnWGj
TLSH
T1116501A9B39418F8EC63813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5fe3da35422f40f3f529533b24018f4c540c3852d10d7edcea5b05e575f48efd
MD5 e350e33fdafa4ab702c13845c39454ad
SHA1 11d4650a376dec845c74d3c57e303cfc3e5096b1
SHA512 0702330e47172e8bc07cb9ee89e934b98d0c0ba452f80f2426b518dd85347b75ffb909d7d3a71ee1f886c61a76bc153c7cd20dc14b013aa1b721472ddcce1e98
SSDEEP 12288:NSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BF965C41CAE92644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7926aea5d47bfe8b318c252aa2ee6cc5812f059f6c897a449b3cedf002fd4285
MD5 a4168fa563952998cfc8ba5fd35133b6
SHA1 95476583d40dd82d1f2630ce930a90d7c053200f
SHA512 63dc30e8693663dc5121bcca40882c0eaa9de5b819104a66fbbb8f20fceb4522bc9ed40442cbb35eac379ab7b469943af56a14f7a641034d755ab6a020c24108
SSDEEP 12288:heXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BF965C41CAE92644B5C3E5E14DAC073E5BE9200483BA5B7CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d537a9f54e83a20da52c29caba47bfb5f63c6de4c5e4f463a6b453072e598abb
MD5 a4ebe5e8fd86f95e3ee92557fe29ffa3
SHA1 89ccc724dfae8428c706dadfa8c402df6ed3e984
SHA512 d3c4564b1e6b89c3eb1e5431723e0e098bb8793e56658d6f19235382dc0757ec0dcb7832a42b8d1007d37fc8deab6946caa8bb03fa75ec426299f081d8b0e906
SSDEEP 12288:oyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pzyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D255125B73A530F9D1378178C5A29A06F7327C3247204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2dd0a357f3a7de38f6f99a5e2f844d7005951de52d325b10fe9e3483896d245d
MD5 4641d391a27dec9b952e8fc8735e4413
SHA1 4e2ac4516d56026f4f2c55f47e1d8b9136a7f667
SHA512 150977b90dda0f12033b03f35885ef0cc8700d71728b1659fcf521b3011b047c83bddec98d99857026f1a959bd249818d9d84ad5522fd79c59ad876e1f7c01e4
SSDEEP 12288:GSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BF965C41CAE92644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e34067547b5210ee4760d9c3f41effaa733bce01b561a23ffc5f9a105603ae1b
MD5 4ab613cafe9cd09d6813f4060985004e
SHA1 0afbf736b28802ef24f0296cd733ba338bbe7d5e
SHA512 8622da9bcf3f8e5bbe62a565ce6d3db2eebaed11932903d261dd882306131ccdf9b612dafb709bdb5889bcaf4e508b283cad0262672f81b65846033053400054
SSDEEP 12288:nSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BF965C41CAE92604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 057c7cf7b71ea597494fedb6fe78e1990b395ac9ce3a423282673ee9ea65c50a
MD5 a981a4d4a10311affd4c877de4fe4bda
SHA1 5fb5b8bb2902e3c6e79893f0543e807bfd4de4f9
SHA512 bd67e9a572658faf121178e30fcafe74a530db3d4ab4d086b7d904b3622dfed7f15e861edb24f7be24e523864af7de860a4713060eae88dc58b749b9ccb67c27
SSDEEP 12288:3yPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6zyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E755125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 559c21ba3d1db2902daa2216f28ee2b8f6f510f0b30a222ab956b66c6b4c4415
MD5 748c516390746215ba53dcfb4f9b9fb3
SHA1 aa2d45b95d3ff19450c8b6a7cb58e9a6370d63f6
SHA512 d9c825381cd90edc992098ca4861e2307fa228917b450b0daf4b59e85fed4a4a5aa776314ad9367fa1a7a17114537e6624f3d8e7bb9fc869928b4a91a77d6c19
SSDEEP 24576:JTDaLl3z0zDxsqjnhMgeiCl7G0nehbGZpbD:JTuLlj8Dmg27RnWGj
TLSH
T1436501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7d41b00d587530ca25670cea1cd58606744eab9046db754e1cbcbcddfba7fa87
MD5 93e64709d054d927d609e2734b24b8ab
SHA1 3aa3ddeeaf37f0a1c39a0224886bce64177c42c4
SHA512 e8c0f6ca0202ad1c733a79eae7aa1c826b0c1865ccdb0878e1cf25a9d7696f36c1c2696406921b8edeff67499e0d3ee9603636aad3f106d8f78f3d52e69f782e
SSDEEP 24576:/3vd9CHKy7GZVsqjnhMgeiCl7G0nehbGZpbD:Pvd9CHKyaTDmg27RnWGj
TLSH
T1B375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 46d2305d1d7762087f66d057ddee96da3259b0fd12a50390a094c1aa7128bade
MD5 298e295bdc392c29034dd8110d88a6b3
SHA1 b1eb8fe41cfecb8da0f0d12a56bcdceee914c72a
SHA512 62a5c8e3ee60d7579e0f019879583464c364a799f7d6d66eb39f2dc15d32843792531428e8fcf7f38647b201f6941ced38f7b670ea42f96f55e1ec2b6ffeaaf5
SSDEEP 12288:mhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BE965C41CAE92644B5C3E5F14DAC073E57E9200483BA9B7CBDFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8414fa34e87ab473b41d55d02e7de48ece20f58e63d167f89b0b77b88caac609
MD5 f08bb2d9c7706edb98991eb1cb3be906
SHA1 294509cb71ac8301a3483a2cef518ede1f668c8c
SHA512 27e10a57198aa6165b03b1ef0adb71dbd5d350dbad9b1520b5cfdc7594ced9515bc2b84728f7f1b8d74184422d4d6ad08baa2a7dd713aa06cc0751a54ec5f853
SSDEEP 12288:y3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE965C41DAE92644F5C3E9E10DAC073E57E92004837B9B7CBAEBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 48b4c1f36ad1d462a49b8ce12bddf0f35d486cdd3bbd3631dc205daf9dc15842
MD5 be0a021ced11fd87cbef675457fe34af
SHA1 8d8c18545b93cb4c2903a142ccc130f90f3f2c3c
SHA512 8bb70a8aa7b74e0ff73f91526d6e911b9404abbf1da33c9ce4e9b4efa6612375f12addbbabbf8bbefc3cf69b16b625c05f89c10debbf0c58d9faa713bf8fe307
SSDEEP 12288:toXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1994523BF965C41CAE92644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fa6aa72fa2c9211d7337d1d705b31a777d4b6b580cc936083b5a64d683acd146
MD5 271225f8e08c3d0c26f58dccf1341ffa
SHA1 8973842b299bd96e6d08ce3287cea9970524efc8
SHA512 e6dd64aa8c4e9ba9084a4f64bdd5b372ac08973cfd2ef1b8ff89d9eb36bbf139bbaa20a701c7cdd095d900449e6d677e6f8db8147fcbce24e9213a1fef86fc9f
SSDEEP 12288:lSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C4523BF965C41CAE92644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7a5e5a0972fcfc29a8d75a55e9d3364dd95645277c8c5c1b59a4c66890a1b565
MD5 8353f51153d2e1f40bb4cf6a5042e108
SHA1 8ea1725e0e50344f7c68e51cc4308005ad808916
SHA512 cc943ea63fc0df3741eba96a59071b7664b3b0edb8263c11eba930dbe09245282c62d160a667cfad60140f7bbbddfc0d54b72aac427c3afe3ce5ad661b16b014
SSDEEP 12288:qhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE965C41CAE92644B5C3E5F14EAC073E57E9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bb524a9335021ec8653e69eb154ce9c9e03958767a88f07127a6e40a3a348409
MD5 abdadd3f09a5889b3695b18263415f5d
SHA1 ae3190b73495c3724423c7e1db842a25875571bc
SHA512 5be6ba8a7eb4c2d35a04fbfead67e908cd44054892337d5eb72f14d72ab1b406d31464e54a701e4a18635538bbb720270eafaa023b19baf5f000d9b05f85d9f8
SSDEEP 12288:e6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BE965C41CAE92644F5C3E5E11EAC073E5BE9200483BA577CBEFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6a1aef2d5e33ba37c7d34d4e10b3260c387ef2fbce37b238320d3fddca972f9f
MD5 676b114445b8cd1bd8f3fc20c2af1b24
SHA1 fc39b95d97486981d86e58d76f0437a54ebec233
SHA512 7fb4e98e5ce6bd8fc081f15befb471f1fc2aac5d205490f05bf9f2638523d9b3eb3dd935efda3161762a001a6b5f83b7467908c1d8a348485bbab135150f3ee0
SSDEEP 12288:OkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OksqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BE955C41CAE92644B5C3E5F14EAC073E5BE92004837A9B7CBDFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5f0616882d58e7b0b5f121249fdd2d108f5445f203aa9cab4bd88aa9f26cdba2
MD5 756170751c5b33c25429d4116b5cecea
SHA1 1fbf63fd796d453bb5c82f0ba9e9b3e17ab114ee
SHA512 14131ca66c1c8b3c5831b8e8abe38eebfdb66a9934ed7d9e84e8cb2067b8013d0e57306a7a6eba131cafb19d659594feed6a57c348083b7f46dbfa62af578d12
SSDEEP 24576:ufwvUk9RX6wkyAIusqjnhMgeiCl7G0nehbGZpbD:2MnYICDmg27RnWGj
TLSH
T1D685D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 32ce37b6811e6dc8413253e1590809d55f58d9036374959c5043bcd9ffd7ae57
MD5 a25e61b7b5e59a0bd0d4d8f6db1361c7
SHA1 c7080a8ecbffb46af728bdf83e335f91809255ca
SHA512 a7675ad6ba1e09d0f2a635bcc0bc312805dcff1a2bbbb9a733c4373d5e3646c968faee148f2f3793487e90ddf5be795da12e179d3f30c144e301e349a85c2e5e
SSDEEP 49152:QYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BDmg27RnWGj:3ySzPJD527BWG
TLSH
T132066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 47c19507af4c4a3331c6baeb77de551df3bb66d34c385bdfd45e34bfd3ba6cd9
MD5 87404d1988f149931f2153fb723b93c1
SHA1 13761e83fd2d1dd1a56461ee04eb5141ed2385af
SHA512 0cc68dbbf04be38e480518bebdf845865ed7712f4eed8aa7a0aaef012fd224bb207807a1dd90ab2ee13847cb8782cc60983926888a71687e4b63d08fcfc35c48
SSDEEP 24576:i47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYLsqjnhMgeiCl7G0nehbGZpbD:i47JUQjTirIhCnDHUPfF/RDmg27RnWGj
TLSH
T1B365AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d794d77dc36cec33a68eb6dc60200dc510173864357547fc31bd974017191af9
MD5 71097f9b7edc97a74281577f07b48c47
SHA1 795aebd1cc0b177bab33093161f5801e8219e84d
SHA512 3c55ac60e6a8fb3c439dc8a36dd37d90bc4d572e551e6d697f0d0f0bfc45af5cb2cf74f1c2cd292c31c043c407c4d74fcb6e7fc7a25e7d9e27abe0d7d6721d20
SSDEEP 12288:7bsfCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17155015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 972KB
SHA256 f19a5221b91799cc6861e15e1922622a88a72639d92dab86130a619ca815a294
MD5 cfd09e6888540489250fab5dbacad4ff
SHA1 1873a985179c2fa44be42cde4f9d1840e263d177
SHA512 08aaba168ddab8d5f85652973e6579da5141d96c6a4faf069cd95242ffcc2605099e00c8d17efbb8a88a3340eb4b9ae10c829ceb36e6aab436a1325f598407c7
SSDEEP 12288:AU/l+DU3f0T1aeS0YDpv7Uj9YG1U3FgWu:AUdYUPwa3pgj9YCUVju
TLSH
T1ED250610766BD75FC6A940321E72C1CCAB707D41FE459B0372C88B2FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 cf278a17f16dd05ea7c878e811469a664624e3b840894246c4138fed8f2dbb01
MD5 2b19e56794de493bdb18384fb767ed14
SHA1 b497bd5f466f731190252804f67e1db8ec034e5a
SHA512 2002dfac9af5bc73fbb129fb7d8271ed8ca46262c5ab15f53d023454f8064c1759f68f18cac4ac7cec82e80dfe2e9c559ab6b753571034ef2adf84c8000fc0c8
SSDEEP 12288:3gzXenR/vBgk924Kyw8uoE/o0T41wOgoDzTmfVb8qOYR:QzXeR/1YHyw8uoE/o08UJ8qtR
TLSH
T14A55B5815537A3CBD1F76031072A5B4CA764EC43B7496F26B3C8493AD82BB25B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e82ae63355a5d975480165fff3d637532c778a1ccb8ebe3dd311be22d9111760
MD5 e76f31661be68a0d66c631ec546ea0de
SHA1 d47139597d56246ea62ca46e67778fb54465bbb5
SHA512 c8f080f6934c366a189579154d3e65ee488b641678fef2f1cbb62323a8922bdb89831ac6361f455660d1d7689986f0fb2a005152b1a4ac04a3283bae80b4a1f1
SSDEEP 12288:n07qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B45237B934C518AF93605B482EAE12DA80B7E669F1044C3BA4778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e364ded889f51559db9e93dc0698fa6dd8a3316b52377ab8e447d04a85fdb93f
MD5 b3629e62a6217c295ba137d07374698e
SHA1 781f1790b6a06ef4d82f43192a1b65ccf198783c
SHA512 ee5c0ff8a217b66a785c29fc32eec4f8f8d42797f1928c14d1fce72c277710b9af25474249757417f5d86b31db8ce6489544e749309b1fd4d9ace96b6f4f74ff
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYAsqjnhMgeiCl7G0nehbGZpbD:2gb4mBIBhGF/Dmg27RnWGj
TLSH
T176659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0dc852b736997233ad1b2ddcfc8d21b18c6bf3c3ec3212d65a33075251cec6ce
MD5 b276ed83b427814b6c0ecc8047ea5b7b
SHA1 b4eac92e79d49af2b7a34d7f3c6f586d017bc71a
SHA512 99a030c57077cb2ce85368c21ce84344199819153ab6ebaaf28b2b55ace4282c9abca21d6380ef39d682e958bdd02c456ec69ae2d6b59334249c94fd3b2b0e4b
SSDEEP 24576:MG88u8FpJqH1bzria7/m7sqjnhMgeiCl7G0nehbGZpbD:v7ZFPqVea7/0Dmg27RnWGj
TLSH
T1A185016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 77cb41f870bb36c0b92b26163cf0a99af8b6bdc235e6febf28420af11217ffff
MD5 0759c881a222010cd40030b8f3b0ef93
SHA1 d006778ea06abe7689b2c94e8cae91edd9e19ca2
SHA512 b7728758f3fdfee530506d83a48f64394c3ab014fea486d70e69be55e7105292fc1f632fb77f27db2108507222dcaf33120c47e48e64ef0d3a1948ebf89f2381
SSDEEP 12288:xHvUrBFrEjwaQvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:xPUr+NQvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C65F12F22AC18E5E676A17DC582C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f3dedfa829315c9ce97fd45f396413490c67b251ac2e873d181f28b393a94c5b
MD5 6133d5fbdda0d6a027bfe077027203ed
SHA1 a3a8d951278ea9b11f860260c225b56fd9271bd7
SHA512 dd90eb588adb5e68aa3a2dcf5ec4e1f3bf17032eb523ac72c2fe8a43b3b32bdff64832c17a0149677f676ea30ef8cd2a36d1b6f66ba7dbfebb7172a0b82929bf
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDDmg27RnWGj:QG05lO43baD527BWG
TLSH
T182D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 409771ca8e1b626124b34bbf8637ae872fbc8ab9aa303e633de46d6a5c954aad
MD5 a07b8ceed153d213beaa679d5099d6fe
SHA1 14521872338ba46a9597b147d44ae57b93cf09cb
SHA512 be7716f21b034e68eae54dd8031bf5bb09fb515eb0b6eb842ccd9ba47ff28ef59b36226736d810e4aaa3d800a5d29d3667f8fd6d1046335a474b35b3e5d865dd
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidndsqjnhMgeiCl7G0nehbGZpbD:aa5POZ3BJt2pasx2+mLDmg27RnWGj
TLSH
T13165BF5EA7FC01D5D579D17DC583861AF5B2342253319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bcdcbe5bd2825a9e2e35e9ce9820e62415789e725aec7ab312c2bcedb2aa1633
MD5 41e84c14c24a83ab2fe3751bc383792d
SHA1 e9cbd3a3ee9d9762335ea2ae45217e51308eb409
SHA512 d9a6a1fda6f0db956dec10632d3d7e8fad128177b0c9dacbc20a93e73fcf584d7b3135067cb9df1f788bab3b36a260543ec51ed49c8f7d4d4368c90b8cb1df46
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkTsqjnhMgeiCl7G0nehbGZpbD:SNc/zEOVHFUDmg27RnWGj
TLSH
T1E6857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0e58aa457c9cf64941963a437df295f44aa9ce91bbd2bd6e1a17d421bb2c5f2b
MD5 466e223f8acf7ba89fcccf17963dd615
SHA1 06ef9712f19066d69a1ed3950e08e07336b721d4
SHA512 039a254abc3832fe618f6b4be628e31fa42b048a7ee2dcfa3eeb53dd45f529f008db1c5216abce60fe5bcc9df2b927d669e96c131c498ea7452344f150b99292
SSDEEP 24576:ETkNvNnaFeYhJNtmZBmZsqjnhMgeiCl7G0nehbGZpbD:ETMwBtOmdDmg27RnWGj
TLSH
T13A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 453effa0f85a8d8df5e76f6ce5aefc72cf72ac9dcb269f66809ff2284adb247f
MD5 e0bdbc96e0b1ea58513b902e4c090cc2
SHA1 a73eedecb5571d6b2d7afe6e6f997091bf3d4ec3
SHA512 fdcceee6d7fc256300f4e3333a2599bd81894edcee203bfc14e66d0a3380c037286700826997dc62d6628ee724473185ad24046b3763cacc884e42c70784d63e
SSDEEP 24576:UD3FHshBIYQgAmsqjnhMgeiCl7G0nehbGZpbD:UDVHeBIAAqDmg27RnWGj
TLSH
T1EE75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1064-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1064-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1064-120-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1064-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2088-297-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2088-72-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2088-67-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2088-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2468-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2468-301-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2884-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2884-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2884-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2884-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2884-81-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2884-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3088-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3088-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3088-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3088-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3360-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3360-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3360-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3360-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3756-100-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3756-305-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3756-94-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3756-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3756-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3756-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4200-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4200-277-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4200-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4200-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4920-0-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4920-76-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4920-7-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/4920-8-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/4920-1-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5408-308-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/5408-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5408-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5408-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5408-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5708-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5708-38-0x00000000022C0000-0x0000000002320000-memory.dmp

Download

memory/5708-44-0x00000000022C0000-0x0000000002320000-memory.dmp

Download

memory/5708-46-0x00000000022C0000-0x0000000002320000-memory.dmp

Download

memory/5708-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5708-49-0x00000000022C0000-0x0000000002320000-memory.dmp

Download

memory/6112-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6112-107-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/6112-113-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/6112-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download