1e96ec20d3dbb537a804d8a5ed56112355adb0524fc17d64afb191e06805f46e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 1.5MB
Sample260728-p5k3laxbme
SHA256 1e96ec20d3dbb537a804d8a5ed56112355adb0524fc17d64afb191e06805f46e
MD5 7cd03fe6bc854d3fdcd18507837c9ba8
SHA1 5d46d50f06a1b183c39043f551d9f2ce5eb2f8a9
SHA512 6a94d51e9f9c1c6c2fd7ca91cff9b1ca205a2759bff8d54c5627542cb5e04433816384529bade2cfd5c6539b792c83fe7c706b75466b6bb61bf0154401980d1d
SSDEEP 24576:ruqj3f0uerbtBivK1sqjnhMgeiCl7G0nehbGZpbD:rnD0t/tUCpDmg27RnWGj
TLSH
T11675E05AB2A850FAE96B913C8892D149E672B8110B70D7EF13B1066E3F337D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4264	elevation_service.exe
5816	elevation_service.exe
5748	maintenanceservice.exe
3240	OSE.EXE
800	PerceptionSimulationService.exe
4456	perfhost.exe
5076	ReFsDedupSvc.exe
676	SensorDataService.exe
3764	ssh-agent.exe
5216	AgentService.exe
2444	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c3500171238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b16b551901edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f0b3f91901edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9f80c52901edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe
4264	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5216	AgentService.exe
Token: 33	2444	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2444	SearchIndexer.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5996	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4264	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 5548	2444	SearchIndexer.exe	100
PID 2444 wrote to memory of 2688	2444	SearchIndexer.exe	101
PID 2444 wrote to memory of 4296	2444	SearchIndexer.exe	102
PID 2444 wrote to memory of 3900	2444	SearchIndexer.exe	103
PID 2444 wrote to memory of 3464	2444	SearchIndexer.exe	105
PID 2444 wrote to memory of 4672	2444	SearchIndexer.exe	106
PID 2444 wrote to memory of 4828	2444	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4ca424407ac062aa77b6b5e0cfecb35fd08f4734e4b9022de1798109f9f98155
MD5 12ea6cb8874d148f7af4622b68151235
SHA1 ba8afcf3cde8f98ce47dd4aa633fc3fc8a782ca3
SHA512 13e1b2bde6996cb1e13f5c6a613a687c13e223fec6e3e1f15efa2b4e1c80364077ceaeb4d77b7f2344d731a3f1ecdd08482a7475f31a05e7a34d7fa669c037fa
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyDmg27RnWGj:H3q6sjB1D527BWG
TLSH
T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3544ac6aea4aa462994a3f33d03d986e9f67e27414e26affd0640ade3e6e8e43
MD5 f84da11cc3571a8820e52c687d8b460f
SHA1 179f7430f70572d960ee0b1102306bed2f824aaf
SHA512 b5d65467a4cf1526cf5d108fca3daefa48a35d2183c94d56cd948f8f7edcc4db45f93c3c8b7b99b36e8a3c63fe686c134ed4b45b063957432a05f3c4638e687d
SSDEEP 24576:CXYfDtczANsqjnhMgeiCl7G0nehbGZpbD:Jtc0Dmg27RnWGj
TLSH
T1EF65F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 cf741ef8ace88c092fbda6c3ee2b8e1d0cf7d8bd7ad7ea441aed0dc9549a801f
MD5 7a6ae182a8db8f3de1ef2506000dc6ba
SHA1 d8840a1dd1822ad76232269996a40c84c9aca265
SHA512 0922805f1d93865272f55a1765459de4d3b2661043f57d742e2a3fc165b4888ac95967174f8af15c6edf2ac03b2ab3f4874e792d0606b108459edfebf6a2c332
SSDEEP 24576:r0Le5ji0hmxxrM2sqjnhMgeiCl7G0nehbGZpbD:rPji0Aj3Dmg27RnWGj
TLSH
T186859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f10bca2f391163628a0bc3273b2729e27c8b3faf3559f2b71a9ab2d7a3aa5a39
MD5 08475bab262c971e6d645a7c4d7a6646
SHA1 afafecffc62e8e4173823c233dd60cfb03b595d7
SHA512 9df9f24d5fb02c11e26af5dedc22b84d929c6d1c00ec03f4aa556dda105f0f65358056c0894a1851b77886d8b65ddef60f7fc3e9de609267f155e04e13d6072c
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyuYsqjnhMgeiCl7G0nehbGZpbD:E/ezSC6vUzPveHjyTDmg27RnWGj
TLSH
T1A2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1612c373cc2b0e443085d28ff55d9f73f68eb5dd70bd22e28d03a83a4e4288b7
MD5 b80bfb7d90694c1e09fcd16306a6eb99
SHA1 3b3f6e5ff091de15a7969f8a79eaf72dade9cf28
SHA512 c594521542ab294a8be78c8e7238456f37770f11c25a45036c52874d3ba964b63af1cf5d860db08a39a5c12e7e41332fcc6deb8f16f1742a5c45bad0692ae839
SSDEEP 24576:hVbqPb88hv/l+YxsqjnhMgeiCl7G0nehbGZpbD:hVO88hXl+cDmg27RnWGj
TLSH
T1C1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 208dff12844abcf3d0e58188edd76742de5e17b4549d5f4ef6dfad9334e6d400
MD5 5647d73567cb58f322bb1d7d9a1ad174
SHA1 fbd2c1d200ff7a1334631020230f4fd799f928c9
SHA512 2c0c3f42c93d09c6ab4a602606c4b16348bbd95e81527ae666b53906aa3d8ad13e7e9c0ce84e80582b72a17620ec919fc33229b7f8215627cdd8903b07635d0d
SSDEEP 12288:uL6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uL6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BF864C50DAEB7608B5C3E9F11EAC137E56981008536A637CFEE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c39b161e4d753a7afc8431da533a24fdc873a42ad4152ebbba7743b60ce6d912
MD5 eca8cd3de5f3b791c67c979994a72109
SHA1 2ea76a07f3fbb77c8696da8c555cc910ede7435b
SHA512 49f2fabc9fec12558f396e32781c5972d780c642cfc9b315d9bd8fcb08f9c741376826e812d6dbb378a0f7d3ecf0144703e115120bc721679663aa4584accfb0
SSDEEP 12288:neBNUbTVO86UJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:nJIUJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12365CF7BEE28FCD2C27A8DB95791C600E76278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f0e6eaea3e221458ecd5aaf69ae5481c1b436ecd4b947445a9c88483a886f448
MD5 1211ba7eb8fa1f761acfd65905c82d88
SHA1 4f80852e2034019d3e7b14b300850322ebde31b8
SHA512 d8f688568264f5378f3d06f0a28f135487f502d005ac84d3fafe73a303e0bfdbcc69c90b8bb5014123ef114c43252a04e5512e5fac1f651f1eff59091294ec0c
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THY:FQvGAdlCEL8c/DRNw5CUD527BWG
TLSH
T106266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0ffd29b4b44ff7d467eb25d5919e6191033f4e18520b6c5e8a836f9ac3bbfe11
MD5 ee679d0d6a51736b75179da46b7a46e0
SHA1 8d87fe41d1acb0fb0991ba69a5c10f907cc13589
SHA512 3fc6da47c9b4ca6837c149b4f77c9a7e1759edae8db109fb59f2e35f380996176bd7fde55444f697db827bd19e3a2a8f9e83884a07e284120d698ad6306fc0f0
SSDEEP 12288:UAwSfxL/2Dc3RDLLmt0LDQewsAjDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:p0ewsAjDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16975E031FA74E036C37B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b7407cd4d2d9c332c00e1ea5aa43d4b98cf90d86fecb67ed9cb80453229ea35b
MD5 311467ebec8e6f3207fa6682cdba674a
SHA1 003e8843a63a714524f336b0a93b30ac841f3ee3
SHA512 0676c4ec0a22ec6492ca6f280e73d908a8de2ed9e7d5225165683e25a77f2e3a99760d6baa66a3492446ef3f7b93982f31f6a9b43479cf02b1da0eee0c35f8ca
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH/VQBWG:iUEtQevvqc2W1cpV2tI322B
TLSH
T156474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e55b1b0400191b66fc8e8efc1a963526941ec79fb47388c037e0e191d1bfceb9
MD5 afc0e53ea1f1d6b403ff8da3549375e2
SHA1 dbbee4841a445d83f3140a5cc8877f60396b0f91
SHA512 5596bdf061793357a073401649895799c68957b6d795c9e988c1f97021705d2c815226bc1342061a223c4ba593313736935279a131a7e49787ded790cae26dd4
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/znDmg27RnWGj:woquVjnmwD527BWG
TLSH
T180D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fd0fa3dca57740e16250badc8759eb2530cc8e263be0ae66f62f47f851f7f9bf
MD5 d41edb92c568848f7c1cdf0c2c9146bc
SHA1 705de6337b8034edb25dd770e2be310415096de8
SHA512 094beeed25953e7d9eeeb235e03fd33e47b08b49e99f67c791f7ced8dc1365385305f28467287906723d13388a58d00fec9a52a567834fb4d50c4fffbeb8215d
SSDEEP 24576:sAhGL3IFoiwtA5l7S530sqjnhMgeiCl7G0nehbGZpbD:sAMUFoiq5ADmg27RnWGj
TLSH
T16F359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e07afb9cd848e446177cb0a5d2ecfc1703ad7072fda65eaf2c267a87078fe113
MD5 df442360902491562825cc5d02fe90b2
SHA1 b55e6892d6734fd1b92e5adff425adc193ae2b7d
SHA512 109cf36e41c66a2cbbb6dbb76dd2490dc71b5297d223a6c4718354949465eb69af98d8028a53af924388a89851a7e1580e0bbaa769b6c9a9ed2b5a23fe79e1fe
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+C4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Twu4OWPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0dde23a08ee7e61c83866d6c7da000432609fe421d659752982684e9b25b0cf9
MD5 a95c647751348bab8aed207e8a6a0680
SHA1 89d4629f1938ca6efe8fa38684c7e6440b321e83
SHA512 944d07a4668208d23250a0b2baddd60faf09ba114e875ef760f5577b547811675038064134a3966cb72b9ad0decabb6e948b7241cd8d346dc5def13200f7c2ed
SSDEEP 12288:0eZ1IyTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NZuusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1745512AE239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6749b1d484f9113c5f773fb9090caff12297dc5b11416193ebddd996d1e41924
MD5 32c234c2713d3bba5dd8421bf6da859d
SHA1 9442644f848d32a4b05a69bd9b63f8dae235b7ee
SHA512 784937ba8fe9c7015310a286836bdc2bdada904c5e1a67c37577e2b2bab7dd03fb8b125c0c2cf956cc3a0e2eef725c5d98c333a7ed4d206064c34e1e9c0f7ec3
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:1QyiKa/X+PNJVQBWG
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f125728b4370601ecfc5734aee6f696546040d3e31e17928254b7d985387e27b
MD5 192e7955b4086d02aacd8a1f8a6f442c
SHA1 93216c742ac21e8beb392c24f9f096842e424c2f
SHA512 00866c885e4b2a53f8aae0d6c31d5a531c477e94d79b94957a223ac14cb8dcd74c9db96eb13d7666a4ddfbd44bf2a330721d49fbdf136badc73c4fd6f7c85d1c
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:CQyiKa/X+PNJVQBWG
TLSH
T195667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 37828eafb988469df07be85f5774971f883432aed7de6cf18d422195e80a288b
MD5 eddf9c97315870c16555c7a61ec76b96
SHA1 91f6128b43704de932f28f51c9c3a25fc291bc8f
SHA512 56eb2c58ae1da99af5d18e09584d8ef7ebbc4d47fc520ba503bdb80d0be0a77e3a5408447ffc2c35afa83e368512c3f02b3817062e12d1c0f4180c512d943223
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0esqjnhMgeiCl7Ge:f68Qg55nhceWu7PNU3/3Dmg27RnWGj
TLSH
T12DB55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 82e9ed1fee24b31677b3e120b936609838b0facee2ee1517ec3c0d63386983e8
MD5 2044e25f74df69b000f255a94a98d868
SHA1 faaa3e1097e86445eee8a205afdb71a1c46ef2f9
SHA512 5eaeec7f6c13b67a2fb1174c2d7b18c92271ea0b3618f5dda1e4bc7529c3589822ed07cf0b6d9242b33e59bc616b1df4700806d1ad369c891870e36cc4a73a5e
SSDEEP 98304:wy5112gYy5azzVvt69nLKnhZOD527BWG:JLIHEWhIVQBWG
TLSH
T14B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d757590367498cac6e8556ec1587ddcb14ea0822288c32407deba73274fb770
MD5 3c2a4894767699e222df0aabad1b1dac
SHA1 d516ffc09f45c69f88e57542cad2bb933134f059
SHA512 eb25dbfb412651e7a6e2564f70592da9c5d269e93c2a5795c03ce6a26d59dc2d04eaab17c7dc16af3aaaa0d27f6a142c0a832354d68f3b95d92aed6a916619c6
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glhDmg27RnWGj:Du6Jmdxd2dhD527BWG
TLSH
T159D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4027794850facab5fce59051fd66b84c0fc187ffccea789c8cc42bed51814cd7
MD5 6086733821b526d591dbb97d9069cc5b
SHA1 8ceab8d50c65c2057f529e6fd3b7f717a1d2657e
SHA512 a7e6f680540d8ecb08b67bdb5f7531ca4a55500a67b9e9be42f5e7a80329e6b1eba20df803d3df104e15d1ab74cc6b5332fa0cf72ebb55fff294c9c4a0ff84cb
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xtDmg27RnWGj:9mifPWRwD527BWG
TLSH
T18DB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f95c0c32988c2349f8c9c4d57e321ce38368b6c57b38947f3453cbf95b3c4eda
MD5 167f210ed9a298073b693f9ac87398b3
SHA1 18c9fd7a118f88bd4ef81eecc0c6debc57f90aa9
SHA512 9b9bd0423ef8c48128d3179df7a3445e60011a5d7ad8794b668c657e4332ab96f627448d8290ae62f6f772e50ae02f69f417712b96158a688bcb151ba41077ec
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqCDmg27RnWGj:D5dKii61CD527BWG
TLSH
T198C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 73e4201993a342edad9033a6c27d91dba9135b118f31f7fd238cfdbbccceced8
MD5 cc0746cead674bcaebfdadcf91db8726
SHA1 a487f7d30d9d796afdf57909a80e640cc2125815
SHA512 b8509d53bde63cb0675e4e91d16bc4df52671b3d1540dfa835e1a621e317de4a651d02d9ac91477c7b028bdc3151fb06dc77297dc97f783b4b84cecfab9bf91f
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wxDmg27RnWGj:TX2imphsD527BWG
TLSH
T10095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 66b7cf61704d6c488cd3a1f4f5edf74a9f85c6396dec02124a2521c73c1e527f
MD5 8028204e105556bd208f35a1209ddf39
SHA1 7be587ba5ebea60bf2b5573d512c0c2ec4682cbb
SHA512 29e6f4c57e9754467f3410e484dccbcb0432202534e4e7666283d37f07d550ce137bfd937426b5e997aeb81ca60020c1f87dec1aa8f91849c14de02be4eef158
SSDEEP 12288:QSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A5B7CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f49186186289b3c336219ad7e06edd725006fadf2c568cc1031de74bd8a5d13d
MD5 0a4cd9811fa42a5a68055f7f4980852d
SHA1 581457e4ae06bb9af1484c081b0f65dae14e4f5f
SHA512 9d776217ba4c5b3da9e3207bac3e9a1021e005b63cd306f903caaf4c95655b3ec5ac89ca5804f3017b87fb4fa1038e2f673d4f8f5fca2d5debbfe3d824de07e2
SSDEEP 12288:xXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9001513c27f79e47c1aaf4f57112ad26d61e5fc58272947aa421382dc00e5039
MD5 1cf5bf773e3fd02bd6213cc1942b29ac
SHA1 f0e4fcefc235c92581784436a580e275aa3c3677
SHA512 9faf534daab61896785cd44782c646f30003fbc1dc5962cbc0a23ae97b248342a4fbd5405bdc612ab540c2f0ebf9c573452509593a6c3efe763f64fa99babda5
SSDEEP 12288:ghXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ghsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4751496e84b57621d576d5fc0d056be97c2129a309de7da78d37091c6a987ece
MD5 7b010ae86d7374cbc9d04fd39415a5e7
SHA1 2a380d45ffab7d282b162835c35ef5a3f31f88d8
SHA512 ebf80e22d79368b760c72c6a7371a1abe642afb5ac57e8b278043b0dcc71693205c376742d4274363be2192fe414cbce5628cf0bb4e9543728b188e8fa57763c
SSDEEP 12288:8VUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C345236F635C01C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5076b0275cd850d796ad91d17f55e21528828e0c83ec58b1b0a93389adc5104c
MD5 b7ac887aeaf2679640e35754faf070a1
SHA1 44ce2ed197cac063116389941e93dd7034dfdc12
SHA512 a383c8bb772c6fe7100a0baab5c7a77159da2863ffefab5eb5e812cfc418cf306ca92e92f0ce25b1e601750456992d239d31448358445c7db389fa41f7170eb2
SSDEEP 12288:y8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b4ce78207cb56d6fcbab6858d0b713f0d9e2e3a240d9a4ff74827d64245ef389
MD5 77dd1f7840d6578a35ed6cff9e9e8387
SHA1 ef6ef706e626410240f2c698227cf78378442ed8
SHA512 5368ccb6d1c5fe51a23cf70c70df923c7ff80d9762e24f5d517058ce3213736b7012d2dd86424e272cf96e686644484d9a1d51fa622888bc708478fa46cd3701
SSDEEP 12288:HbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1cd1e6c43cdea46ddead8aef2182bb4ea680ad7d8791d09e11828707f0756b29
MD5 303ca3133806da183553e3ba5d8a6a83
SHA1 15778d2ec74c495949054cc9f4947842d95e51cc
SHA512 6f1cae18de5289047e9d8eac8fec75eca9fb09376f8a1dfe5e373020fca5260e0a57cb4f93cab5b51cc0dab64d84bacb9e082894658ceb8e0b52e62043512826
SSDEEP 12288:N/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BE965C41CAE52644B5C3E5F11DAC073E5BE92004837A5BBCBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3e226c82a38f4a7f261bce5a7eceb799c29a9f8efede5abc3264fd2d55dfc4da
MD5 2554fc789838474695ec9e6205422eb6
SHA1 f2dafbd383ee993cbb804d38730f1ab1179597aa
SHA512 36159149d8f960baddd053196c5f908f3c3c53a2d310d094eb329788ad126f22a0505daec71a7b4c8d8d6f346120f9228648add1bfabb390a2739620eaa4da92
SSDEEP 24576:mZMRzFVSO3sqjnhMgeiCl7G0nehbGZpbD:mZMRzffDmg27RnWGj
TLSH
T1AD6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 657616a2ddda1470bb65b1a8856298da71b16e0cd097d3ad01658ee43e89f9e7
MD5 a7ca06e4000a1946314127033f7de692
SHA1 78988f951f5859d76558b5073b5013b2199e93e5
SHA512 66462b6fdbeb430881deea8753ac7ff34dbf4517baba07c0283e308c6971566cd3f2bfa7773abf783b69faadae0561f6c531afbbb1c9f879a1d7dbe239f5674a
SSDEEP 12288:m+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 49bd1197456b741196acf32930149218c19416d1fce9732b932bfab6d2a6b5dd
MD5 9b814b91711ece317d9862886dc8b7dd
SHA1 563f0266305ae7d1cea83431c73a83d5c566dd1d
SHA512 3f3fc5f76e8988ca7d92bba3009daa9d5d274d69435002d54c4bb69d1c520ffeace81cc73df4c4dd9fd1130175f4013215e8d7ea2c7cb8e5692c80f876d51c1e
SSDEEP 12288:+KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BFA65C41CAE52644B5C3E5F14DAC073E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c38e6340073434ca9b4ad395412075e776b79abe18ad5f99f3ac238deaa41015
MD5 3142de3fc34931c0b3c6aeddca112c93
SHA1 f6bd263a32c90ec1a95c57fa80859ab79fc61b5c
SHA512 45b30e4a72525f717a4f1777803b6db9cfd2277dcbf4886fe2f85f5daa4197bcee0bfaa6125cf2b630c95186d1e78093c40679586614d5af4d86861904cc00c9
SSDEEP 12288:MyPz5L8TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VzyTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13355125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 eb5f2e8a568e5b723007f1abb6d3da67632a93cee5e52c8391beb660b4dd8372
MD5 4d7eb537a68e94d5d1cccf427493c562
SHA1 5cd4a1584005b1c4dce789759342d59a6e688a33
SHA512 76ab862523602445997572d51acdfad50ed45932919cce3aa2aa9b30007d10b8bfb3f77d8a68d1f70fa5be1f16fa1a42c8f21a86f2bea8a552acbd9e0dfe0530
SSDEEP 12288:4+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E04523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3868d72483e2f14cd92661a837a428446a1da671f7108a2b79fa2b771200e3dc
MD5 f9a4dd7e55df4ea7e567f58dc9259365
SHA1 fbf89aaab3dd1301f19b0432c0463612e0f3d8db
SHA512 768af980c2c824e0ceb8899afcac8778fbc96382ccad6adb5fb895f7e507deef88aad37a8dc2d753aebc824e5a06f43838b49957d6217f49112709561035db5f
SSDEEP 12288:y+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BF965C51CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 82036f0b6aef94fc8894350c9c60681403723d0de2043f77e99f4c687622f579
MD5 6d524e54650d0bf873fafb29bca3249e
SHA1 a0099921223e39a9464289226b5533de13a75b9c
SHA512 fcc48580a67132005922a0c7eedf6341bf95a816957a8aa27d1f8e4a15824d64d77f86dcbd383bea96cca2beeafc61f674e3fea600739ee18f3c6ac0ff8ef135
SSDEEP 12288:GyPz5L8TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7zyTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19655125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cf0d7bfaa6efb1ec98c2671f6c26647c4645d83eae00af662899e2b2b7d2fee2
MD5 ec86d036529e10c9574f18db7dfdb56d
SHA1 f12591f5a90c87fd27296732b806e1264009742f
SHA512 9cf7218818da3d16ad605294c859e5f25ed14acdac237a8b5317a6cce90e9800c4b3e6c67d3e11dc966793c7676fa5e7f8030024d3488eb6c0439d91729f08cd
SSDEEP 24576:dTDaLl3z0zDRsqjnhMgeiCl7G0nehbGZpbD:dTuLljEDmg27RnWGj
TLSH
T1706501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1ffd855467b48df74904a03ec3a2bdddc8a290c7d4c8a3ccf2d089953b92e469
MD5 f9b04be61d7cf5cee61ab1dbe9e88621
SHA1 bbf906fc32acec2e660e1be5040579ba4078229b
SHA512 baf95d74431fedb2205d6822c89653e3ad38e502fba2a38a1121956261d7bdfe021cd0f93cb32606064906f9aa6026336b4cbb132ea562c35dd993a620afa70c
SSDEEP 24576:a3vd9CHKy7GZFsqjnhMgeiCl7G0nehbGZpbD:8vd9CHKyafDmg27RnWGj
TLSH
T1EF75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 960d0536312b331f31e5704bb3e6d85de7e60afd82e7cdae6b34da78202dffb2
MD5 a61e2095d3179909352accb214c4e3d8
SHA1 3a653bb484affd9fa9a0735764fd5b9cb955ddfd
SHA512 d6cb9464277c4e990acea67db9719da3b87373bc8e4b6d330e6123b02c839dabf1632dede9c0a9cfb3ccdecf1ea0af60f8ba367b797b7ffb60eb97141147a648
SSDEEP 12288:oBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1514523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 952c553352060c0c867fa79bfe81bad61adef90f3fde82a4f481134667d9a9b6
MD5 309595e8a55b339ed584d6076a1cd0ee
SHA1 a879e8d21b974e23698787b903a8dcdfc5d00694
SHA512 dc715876af4bfff2f1713fb0a4eb25bf545eb41dfa6361e493c873569c1d5cb62b6ed8390363fb32c87775194f8e5a9fa4fb52a938ac5709196f1a4156c49c75
SSDEEP 12288:czXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:czsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837B977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2e3b9fccc51ad5109ce18518b73b75a191294ec9bc2fc4e1fb1ef13df0bfdc53
MD5 dda032742c786a4220fd2a40a6298bbe
SHA1 51279e1c30e8211ebbcda2b3e7608b26aff4f231
SHA512 38f2a01eb08e1c99f0875021d3a7dd315ba9e6d491d04ff2b0446abf4f8fc54a96e68f586abdb70162823221c0b5288dfce43b460a34a96df7f450ae08a6dda8
SSDEEP 12288:UAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A54523BFA65C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7c49ea971270329b04e9ecdbb2d8f31383208f6f192e3f56749285a6a9b86e3c
MD5 49cf830e2e8772f6e7d77136b617694b
SHA1 33dfd09bda1f6a45ca1b6f5258beda5eb80e18dc
SHA512 a7da341394ec409015585f1e4b7b20500bceee65a46cb0446660fbc1afd0d98ec099246a7ca9a2f4109ea20dceb8e1130a46ce93e6104aefa6e2e4bf2b48e0ba
SSDEEP 12288:f+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BFA65C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9c569ca1e93568424fbb6b64fdea07ea353a9920440b59b3f5e33d40406cb26a
MD5 479df7eb27ce4d6606d2ce741e05c496
SHA1 76a485dac576d18a1776b39868fb094a3df18329
SHA512 36fe40bd0f8beb581b810d4aa9c47dc8e1eb3cdb7d08b4006ee1555d1409e6ac810baf204135277fb938c26d5363566692d64fd94ef4e98b76a11a18c66a834f
SSDEEP 12288:ZBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 60ac8115d79d3369a7e6aebc2a449ccb2d64f0268295325dde7c5619ceb78e8b
MD5 4c0ebb1c01ea529f7ddf97947b7885db
SHA1 6aa349831e8b576cf1087ada60ba9368d4c37d97
SHA512 4c341fe071d28b24883175258ab51a1ffa7345c56b294a613ff2bdea008e3741c0452dac93d23547686fdaf09d1be2d755f4b44c83e8aaa68e8be7d953213d17
SSDEEP 12288:JmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE965C41CAE52648F5C3E5F11DAC073EABE92004837A577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e7743c45de024b37b2cb9826b5d9b9d6ae5597ff3f620647869a0fc88cc4c057
MD5 ea087b8696ae947654f47e1eda9109a0
SHA1 f5ee4cd500ae6e7190c9808754916b9dc5cd9282
SHA512 8faf67e7d87abd415bac2986dbed23dbae57755e86df5f0756539561299eaf4d85685bc5a31732d11e746a0deab4f0242cd9fe6e5c1cb5db95802517064fc9d0
SSDEEP 12288:r8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 023030d11efb53f7885a72bf240bf02434a24fff8171e39de7ad39c5f129b76a
MD5 a12a3b506699b8ff591a8062b01e97be
SHA1 2fd48b6bd7208f3bd5eb1d4d348eecd5746987d7
SHA512 07e5c15dd21f3ece978fc3a565b26465fb5966c150a9dffaf26aa2056df6fcadf3b342ed535a3a3bee012114ff35bdabc18865fccc18ec1febf04e9ef145f037
SSDEEP 24576:1fwvUk9RX6wkyAIasqjnhMgeiCl7G0nehbGZpbD:HMnYIuDmg27RnWGj
TLSH
T14F85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7a1a24fb0c753dd20be87f2282d4b659838b5c11adab6f41d35b9b9ed0ee1cf
MD5 8229098d5d5183b93da76d4534a2bb45
SHA1 bf51a403cf9d882dee7dd7b05ef9e123deaee490
SHA512 0ba62447c8c77c6ff690881953eac08a48bf06b015fac6eb1f5408fe07ac7ee7809cf1c5a779652a30f6410b75d903b3960e892d38d86967948979c3e92bb41b
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0RDmg27RnWGj:lySzP5D527BWG
TLSH
T123066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bcdb93e41542b4f0d3dd3510dee63eb7df82788919376deacdd3654d251c1ee2
MD5 e16b52aaa425f503b1de68cb5d2be2b2
SHA1 417110851fd074d81bed108df13cbb8fe975dd20
SHA512 327cea1d4f6a14f667655c069150db7f1d76d9daf75ed77edc2bc3f9e31ecdcb22bc1f06179d9ec148b4d21377bdf7e4bd7312f83852c4a9d8dcb6fb4b3763c5
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYHsqjnhMgeiCl7G0nehbGZpbD:D47JUQjTirIhCnDHUPfF/hDmg27RnWGj
TLSH
T10865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1cef2a5743294e9b954e47a4d6e0a289783af2c518af778704ab5ba21b69aefb
MD5 e1b94d2c00c8557b6fbae8e18d1390ca
SHA1 5b48536a7a7df6e4202c8b422f071e8633d198c5
SHA512 ce6334fd58616065881d5df0b916badf5ab0d723ed4e6ea0912429cbc05ad24d3180f96f152980241f1cb47c509e04c0a9719df1aa422b280415e874894234a6
SSDEEP 12288:qbsfuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BusqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A55015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 eab1324ab8ce3eb026ad637fbfb4df1e1add89e5484ad75d7f78e8be95533810
MD5 9372de1cff5b4fe951a2299674a5e030
SHA1 f4f4ee6d366b5b20a1ab5ac8306befac259dce21
SHA512 11d56b1833b8604b7c3114bc62389c9a63f1ce296d3f5cf103c58c6d849541a3787e563dc15d729c377f5b9e95cbc49e9c3dfde3508ad412ccc597f4cd549e32
SSDEEP 6144:6sBC2na2UDRWrERGfKDexHk4Ky5v11DBMZHc0iHEbIHYGBiwy1/at6re+N21:/joVJy5vTmBIHEaYGBi+t6re+N2
TLSH
T1BA351851762AC75FC6A940325E73D1CCAB707D01EE05AB0772C8873FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9228e7f5ac7e6868f119755767faca33529036ad4bd24581f4325c6a1df149b2
MD5 691d2f220f01b521ba65f30d1a859db7
SHA1 d08e58879bef051c34251425e85f0812898978db
SHA512 b046de6b05f75054a2e0254b52781e34c6d970c59598b14753cb2c646930c97aae429532f62148fe2f17566588cfc6848eef1c9ec11b1d8fdb61b8394cf578cc
SSDEEP 6144:2DOPVAdwIMdwImdwIYKFSSLNDKDexHsdKFsUbEFcnvaDKDexHBLc6G2lxVQJlH+Q:3PVoyElZedKFsUbEFcnCLL1XtKaLUz
TLSH
T10865E8415537E38FD1F76032433AAB4DAB64EC0277056F2663C8453AD86AB66B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 18ed2520cc01ca6f1c19ddc1a9b7c81ac1dd7b9d322a1ea31788ce673b19c712
MD5 06451b75f448852c0c5ef5c6aeb8e865
SHA1 506b6654c88ce4476ed592ea11aadf795a6e595d
SHA512 91046457d2ff8a95026adb6a6084ad71ed4aa0e737034d549f13eab11952b33faa706bada7a7a1734ebbda07159020bdfe64b5f146367fe40559e7d5c7f99bc8
SSDEEP 12288:107WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10845237B935C518AF93605B482EAE12D681B7E669F1044C3B90778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 edf35632dc28623a2028f8c01f0cce2ad559a9df2c28ab1ac29a8c27b541f2df
MD5 101432530b3e27d6cb2941ae4da67871
SHA1 27eea256010d715dd3ed10c2c0b6d5fcdfda5dd8
SHA512 271231ef966ca4de0597c24ba44a717ccbeacdfb7f28c0ddc1370ac5c06794706302a9d20bc25a7b5c41bd513c0fd3db782bcc4514a34bcc9ebbdeec990b2b5b
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYYsqjnhMgeiCl7G0nehbGZpbD:jgb4mBIBhGFbDmg27RnWGj
TLSH
T119659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bd554f7c22e9202ec9378090f79d0e0d986bc8e9ff14b16d6cd71a02b2dda19e
MD5 fd4aa3cc010c7a2f2f050328dd79920b
SHA1 6ad389bda6eacb4ed44b4b0cb0421caf03ebc6a8
SHA512 4019606f252a1bd67791a6df66c755549cd41d027c62b849b03316b8bf18b63a2d0aea0b62766caaa6677d2b88ef129f6fb9723a4631ac2212a07e698cb6b5ca
SSDEEP 24576:tG88u8FpJqH1bzria7/m3sqjnhMgeiCl7G0nehbGZpbD1:g7ZFPqVea7/cDmg27RnWGjd
TLSH
T15585016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6786035a315665051313cf0c2e426753087f76ff568a4b674eefb204ae6469af
MD5 718d3937afb0c8782bbe29e773ebeb18
SHA1 1e92eaba6c4f7e999134676d21ab9f0dc2b96254
SHA512 4c0b213efe4b3dd7ad45b694575bc37882c701d340e9364eb9e17ee1735d35d9466b2aab2ca972a4b32bca210d22116a1eb7fb6906a064e0c4039be8aaac5bb6
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPDmg27RnWGj:8G05lO43bmD527BWG
TLSH
T116D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b2d51e5110b7d2a82c313527ae248e73ac2cb3680a6c7ebc5fa0b43dad210768
MD5 9ed8893604835c2becc2f310280d3ae9
SHA1 e289c97efc056b918e3b57eaa2a34fc6b66a5387
SHA512 f6992c2bfe22d9aec0986a08019ed4db97c567457cee78b0884f8ec6eba767207dd2d16b6b852df58fbd099e75611fc5f44ede1ab5d4fb47ff8a1400a720ac22
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidntsqjnhMgeiCl7G0nehbGZpbD:ba5POZ3BJt2pasx2+m3Dmg27RnWGj
TLSH
T10265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6a4f9320abb298d97d477ffb84029064e9f1f2e4aabad60d0260c0d6021b74aa
MD5 9d765954a388e62afe93d97c2246e9c4
SHA1 9e27ef320ffd03b8797df13377058d0d6c03f4b6
SHA512 050807c5d037ea26e880773935b88ebe6a9f33f7c731f963110ed72d5ef6d7cb5ba859ded890670675105159c4697e9048aa98ad2dedc9e7c5f2a55692571147
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkvsqjnhMgeiCl7G0nehbGZpbD:JNc/zEOVHF8Dmg27RnWGj
TLSH
T15D857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0af222e637d8f49438f6f770646c5c124524d0fba574c801c0f1808beb9a40ed
MD5 ad8b413b25a79373517d0f70f382660f
SHA1 d9985327eeabc6af48c6258d6f63979e604e7999
SHA512 5f22843184b5b781c65d6631d6a53af15c6c78765af6503d6feedfd3cf74a2cc5804a5b089b8a15ae25eb1d9b450ce287b4791d7d6ff298c011992e1a0fbfa0a
SSDEEP 24576:oTkNvNnaFeYhJNtmZBmZsqjnhMgeiCl7G0nehbGZpbD:oTMwBtOmdDmg27RnWGj
TLSH
T1FC55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1c2c590631e06763054eb5a3ce7c87feb2a9bb96bd1a27ba03348229a20dc16f
MD5 f81be47cd4c11020a9968a8feb313a28
SHA1 bfdeaabb0fdab4ff6fa2db97c87afaf77b9f1fde
SHA512 15e19cdf44cdbaa7966952b7e945ea7deaff4d5baba4a309e091df9ea151b9a77f9c775854b440e9ec1af4775e549bf84d80f86c234936799c943d50ef8b0114
SSDEEP 12288:YHvUrBFrEjwaQrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:YPUr+NQrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B265F12F62AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3b2f5fe970454d738d4491d4eccba229c3b01eed71e4d5dcc42c634b687e2612
MD5 dfda60458a4462e2217b4a4a09f58fae
SHA1 fefdc08e0f13f64056f24b39c4b528216ac26e65
SHA512 63924d2fe900fcf7776095725e48aab3527754053c940b16b6e8730697d6ebe9189ffa9d21fb34a33d2fbfb69a20b0064ee407f8c6d7ee8d0c8806fdaa49a10a
SSDEEP 24576:cD3FHshBIYQgAysqjnhMgeiCl7G0nehbGZpbD:cDVHeBIAA2Dmg27RnWGj
TLSH
T1A575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/676-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/676-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/676-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/676-307-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/676-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/676-96-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/800-69-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/800-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/800-75-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/800-289-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2444-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2444-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2444-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2444-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3240-273-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3240-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3240-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3240-61-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3764-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3764-108-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3764-114-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4264-21-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4264-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4264-15-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4264-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4264-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4296-321-0x00000235B5070000-0x00000235B523A000-memory.dmp

Download

memory/4456-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4456-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5076-83-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5076-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5076-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-323-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5216-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5216-130-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5216-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5216-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5216-122-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5748-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5748-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5748-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5748-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5748-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5748-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5816-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5816-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5816-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5816-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5816-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5996-66-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5996-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/5996-6-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5996-8-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/5996-7-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download