2a7bc2c52492a317f123c91ecae5079702f1fe8de8925482881f336b60f0331d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.5MB
Sample260811-la7fkade94
SHA256 2a7bc2c52492a317f123c91ecae5079702f1fe8de8925482881f336b60f0331d
MD5 efef19dfd03fdce08a585e1e051343ac
SHA1 4e0a97c0f3d142fea6ffcb85cc0fad13ac58cee6
SHA512 7df25c8cc7c117d21484123c8ab8a99bb8bf6ce1c0e2d3d8c26bde39610536c7cfa7ee8557ed6cebc0a6a0887db6d342ae499d3f2bd196482c1ba83fc840238c
SSDEEP 12288:7AjB/8jHBE6XzdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:caHBLXzCNyBo4kx929bL3Hnx
TLSH
T1F575F116B3A814F4EDBB927C8E528946EA7578060721D7DF07A081673F33AE09E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5572	elevation_service.exe
2696	elevation_service.exe
8	maintenanceservice.exe
2660	OSE.EXE
548	PerceptionSimulationService.exe
1892	perfhost.exe
2372	ReFsDedupSvc.exe
4264	SensorDataService.exe
2316	ssh-agent.exe
1972	AgentService.exe
4492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4b4d8b6be05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c21004c17229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003db32a027329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000be9c57c17229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084bea2c17229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b06aa5017329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000667f51c17229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
5572	elevation_service.exe
5572	elevation_service.exe
5572	elevation_service.exe
5572	elevation_service.exe
5572	elevation_service.exe
5572	elevation_service.exe
5572	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1972	AgentService.exe
Token: 33	4492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4492	SearchIndexer.exe
Token: SeDebugPrivilege	3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3276	2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5572	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1984	4492	SearchIndexer.exe	101
PID 4492 wrote to memory of 4296	4492	SearchIndexer.exe	102
PID 4492 wrote to memory of 2720	4492	SearchIndexer.exe	103
PID 4492 wrote to memory of 6060	4492	SearchIndexer.exe	104
PID 4492 wrote to memory of 5688	4492	SearchIndexer.exe	106
PID 4492 wrote to memory of 1852	4492	SearchIndexer.exe	107
PID 4492 wrote to memory of 5600	4492	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_efef19dfd03fdce08a585e1e051343ac_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:8

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2316

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bec7a9a6268a6b39954b68575cde4ebf335734c0111d2d83a3015357ad6b5f34
MD5 c688a6bc250b1cae7e2459e2fdef242e
SHA1 eefb09efd4d8cbcfb126766ae9fbc6cf0f6f4070
SHA512 bcb39678433dd1ae91279ec37a0104042592915e076472ecb96191f91f35a688016d1a02f4f0257200f82ca1e252b727417c20f56171a207c2dc03d9452ec167
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyB+kn3Hnx:Q3q6sjBt+k
TLSH
T122D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e42a97d7069fb1e58696f9c6c5f1924c092dd41af47b83b29e1035bb57058836
MD5 2cbb6c98449c3aaa794cb9cf46b792d4
SHA1 ac4e266699c36797a1723d39b2c6d813e710451d
SHA512 c5b6bee976286b098c8b0f1e8641fce87b15f8434c839deaa737c8734cfa77ec21d6cc17286d8003fe5d8be6b20f9ba1f4e174d44f2217b67fbd3f1d3e282b9a
SSDEEP 12288:C1XLsswWkxy2lRq2czAvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:IXYfDtczAUNyBo4kx929bL3Hnx
TLSH
T1C065012867D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A499761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c236f5eeac908a0236bfe93ee86237fe89c5cc0221b9670602234c0b037536a4
MD5 c3e854be09bf6900fdceaa42f7c7cf60
SHA1 2ac0cc3110076078c4fdd98ce599b2a8142c318f
SHA512 c1d09498b5804347862573af5070d70627b959bac250e55d6452aa8bddee34d594ac687d0946d4f05444bbb86c908cd03f01909dfbcf11fa3df2571994d3e907
SSDEEP 12288:kXZNYVLeyUji0h90ZD0wxpGZIVuArHs+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:k0Le5ji0hmxfrMNNyBo4kx929bL3Hnx
TLSH
T186859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9cc67eefbbea4bf54e8490331293c943b0ee627d4c8b7bd91bea46a99397b72a
MD5 53e7c1081aafb1d19fe383b5a368aeb5
SHA1 e2017c7c7e371912c0bf03e8dd3c5c0290324a28
SHA512 ecf727e4a0db77ac28210f1b4194a924b23ebb3aaab88666b469e326a28cb1a541e289d384c913fb7d2a6f9dc1c0e89bc1469cd8bed1162f2b431221315fe9a9
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyu7NyBo4kx929bL3Hnx:r/ezSC6vUzPveHjyJB+kn3Hnx
TLSH
T12E755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 abcde8acb7a01cc35dabfe44009edd0241e0d91260f5769ca9ab007953295a2d
MD5 10417167a17820b098228de422ca3686
SHA1 0ef6f6255eb3f46d3ef630bf4941e3edeb921b44
SHA512 1a05f79149c3411c05b7270fda2380e311b065157f413ac61804b6667095119ce10e18f93f6d1e871db1b4d0e6d969603703e1b70ec0712a53d9f83e8facde79
SSDEEP 12288:NVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98rLDAptNyvUgXZ32dT4ePc7N29CD:NVbqPb88hv/l+YoNyBo4kx929bL3Hnx
TLSH
T1E6559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 62dd5a2afcf70e9295dc049795be7e780f793c5113f278a5be0471dea603f215
MD5 2b5d3eec327163dd47c7fd7df14f7b97
SHA1 432319b453150236e6f7bf93efc6efe7f2f35e60
SHA512 0450e5008955fe39383593202f4625ccf7dea8d24cb4b1a021726f7f861e41158dd93b97f6158824cd2379febaca1fe85bc287ad49989b87f263bb1a3bb52c8b
SSDEEP 12288:ImKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ImBNyBo4kx929bL3Hnx
TLSH
T15E4523128B0C627AFB7D3E70745E8454CC35BC8D0D95DB94DE62ACBB58BCDA2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b049ba3b694410ec296a850d9b3356386615e80b482c0bdbb522778f24035cd0
MD5 c1bf0409383fbb100be76cd984c127fc
SHA1 3ce648e9e0af96300190f5a40edbd64622564480
SHA512 a15244a5b37e551a01f779541383a90e768d9acf75fa089068e9a3eadc55ec7ca9aac41e5d1d1a01da683ab04a6e5d4f2622de8de529a83f98be2c99e7fea61b
SSDEEP 12288:neBNUbTVO86UDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nJIUQNyBo4kx929bL3Hnx
TLSH
T1A065CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03ea68b847e811dd786449a6c0885398803a6cbe63d621ac61b33ef27f2c95a5
MD5 ddd9c4ea9cfc0f1f9512533f50458d05
SHA1 d1e61a9e780031e87552545796e6a07c856c911a
SHA512 3cc54aa16da204693d48e0f3f3666499497b024e34898612e33ec75ec8f19c31c5c6f570c0d7a2e2dece52553041563ace01a1cb5b717c92f87498204e312cab
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THR:2QvGAdlCEL8c/DRNw5C4+k
TLSH
T160266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3de031971f23b4d5e2a01b81b56245d7a161e1914ae535abfb6e824b50f2ae62
MD5 e1d6a07c129fe0ded0da7150e9996632
SHA1 dc6d458fe0598347c69a05a9422c6abe192e5b63
SHA512 51e607b1a9072ac910dc34691397aa1ae8d10f4a4bddc61a7d988f645a5da1f2266cea79d8e0fba22fadd617e59c8a80bcaf5fd6691b8acf1e6b8bc452e9e01d
SSDEEP 12288:FAwSfxL/2Dc3XDLLmt0LDQewsAjxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:mOewsAjONyBo4kx929bL3Hnx
TLSH
T12C75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 648277dcb9fed40c6c80e31319e34bd2f7506da9c1370f8020bcee53936ea445
MD5 c2920a680c19683a3d48564c4e876a2a
SHA1 3768e4915998a1ff0b831f4882dbbd3554d898cc
SHA512 59867ac9fde44c76f4c2a3ae9be92badfb47d1a3899bbbd24e9e162f34d5051147293319361db17b6d4dc17b207613bf7467e3af2c775d39b0188d3f16f52965
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHL+k:sUEtQevvqc2W1cpV2tI32L
TLSH
T104474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2a78672639afb07f7895db758c2240de1f80e6b55169c38637647543d384e8ed
MD5 d661b37933304e362a3c6bc4c83ce884
SHA1 e59abb98cb2ea9241e06abcefc54242b5560e9f6
SHA512 5a5c084bb90246c12d0f44e5f9983840fed8c2591502ff019f12242decdfba6eb7b43b3471030991db2da0fc3076af4f26e2b704f04a30acee313d1599ad217f
SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/zFB+kn3Hnx:/oquVjnm0+k
TLSH
T1DDD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 47da478ac965200b9382e45b7a58578f439fa5cff3db9cd06cfb1c973ff2945b
MD5 c06d275eecf166d025884586bfed46ce
SHA1 5b32cd464b81a770cbb83c3e4cfecfc47f7e3a44
SHA512 7d4cf779892f3a77133f846a526c2171a35be4f88910a62a395a487bd6bdc99fb6e25228a874c109dc28f199c4eabd14bb88e293009c45378ada1c252a8a1bb2
SSDEEP 24576:gAhGL3IFoiwtA5l7S53nNyBo4kx929bL3Hnx:gAMUFoiq5YB+kn3Hnx
TLSH
T153359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9760733a0d298b6390570fa519b3ca6c67fee9f99f38f5015682074621812264
MD5 e80a330ec095e67a8e4af08f247dd7db
SHA1 891c128d62728ae5262173943156d55e1fa6baa1
SHA512 7ad9030599452bd6d9d5b606126c4ecc71b91bf8b72597949ac90fa0aa11a52863a43e855224b8a57c0cda6a83a3bba2c6158d31137755a83c9fc6f5f98948bf
SSDEEP 12288:Fmw5HEjsChNzBFgl0WDm+CELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:gwu6OW6NyBo4kx929bL3Hnx
TLSH
T10A65010677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 38bda13aa85aaa6d4fa1b3c5057831a22a5752c76d45664d497929973743b7e0
MD5 cdd2e423677af9da63e6b827f9548f08
SHA1 7a2f422a35703ba71400c40770761410260c6029
SHA512 5e2a7b08c439d8456dfdcbd94efb0c4a495c1f34e60ea7dee266b0f87bb42a5c56cf6ee10467f50f307baec551a7a5d1d1bae585fa6f830c5bb316985340c4a1
SSDEEP 12288:cgZ1IyhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TZu1NyBo4kx929bL3Hnx
TLSH
T1D1551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2185BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dee72af1d76b0ade609f9cc2756ef550a9a78a398ec8f82d45ad3c7dd69eac81
MD5 e3dc6985e16b7671051ac47a15854b82
SHA1 61692b78b6c9545cd178640444d710e626a26fce
SHA512 6519f0749de07948c7dde817a914d7f5fa7d6db686b25edc6dcdaedde1af51bf03ecaa90d235a9e30ba12345abc2558205f336c68b1d9190fe30c7185d3fb90a
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:LQRQyi36YOcPbLvw2gAf+PN3h+k
TLSH
T143666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d6f67e409d22b9ab131766572acb62de63bdcb8e75222c7fdddfd39361050641
MD5 271c8c6957b8ad10f0d48aeea4561008
SHA1 dec7c4573e96098e18856ee3f0a7be1c41ed56cc
SHA512 b0590853452ab502d27ee1277551e8ec721cc51b33eee9c7db4c18d5486f9b61a503715f0f7bacae6f3f49dc1a008b12eedb3066b43b8cc2121ef7e20aa8d45e
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:8QRQyi36YOcPbLvw2gAf+PN3h+k
TLSH
T163666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 162134281cf701da3fc5699044d7792a3dd6de97150313213f08b8d4c3700f1f
MD5 ae0739ecebff7656e05c6814ce51961c
SHA1 06786764134c9942abde555c429f9fbeae4e4382
SHA512 c18b3524eb6cb2eac64caa5e893c8450ea454295655705d80676e3a30b58ceb9358df237adbfd1ee49d6bef6d3319a2d3d09d46c97ffc02c700b314efb2a595c
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lNyBo4kx929bL3R:O68Qg55nhceWu7PNU3/1B+kn3Hnx
TLSH
T1A3B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e2d05630b5ee211a656632f8187d89930d7857f5ae7593e34168a8d1c43d3c7f
MD5 e1311bbf34b02e0560d18512ab30d281
SHA1 036203281214d33602f5696a29699928b8136e7d
SHA512 b06255e90454ef449e3d081133008b783a3d77888ee952d4fbba004953957ec6e7be2c4bb756c8e8ea535d8104f43acba2df604d5e16451b215438a9704f50fe
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99r:gy5112gYy5azzVvt69nLKnhZm+k
TLSH
T1E5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 307afbad1f4a3b1f1d3e8a8fda3756a14c888d195d4c5072c91d0cb4543c3a9f
MD5 2264a9a8d9c83d3a6427680f44434ecf
SHA1 9e4dc8c162c963512b1c828e9115c989c64c1526
SHA512 d91edd16bd19b8a8cedfe207f81f757c322a0816467d21a2281a6be59bfc85cfbc466928ae658ce62b1ef0852d89f1f913ba96ad672b4388f39c533d53bdd414
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl/B+kn3Hnx:fu6Jmdxd2dp+k
TLSH
T178D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c79e93e505c7eba95c9664c11f298a3f9167b73e1a16ea63da78aebf11c2f8e9
MD5 ec455933a66149c8a3cf6a413e46f92a
SHA1 e6f1bd1cdfbbe77071a9c64000a606944b4235f7
SHA512 56f69dfafe1cc9a754b4fb8e24c7f4fbbc94bbdf2be40ef5a4aeda93750f7b60f18858082bb1d37a818f69339e56885e0dea29af1ca807c1d3edb7b2c6604333
SSDEEP 49152:S1hpsNoJpF1A63U44CwH7R4xDB+kn3Hnx:SmifPWR0+k
TLSH
T1EBB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5e45eea23fa336aa4825d6e1527e5a0c7178920df620fe5b18321761e7f2d4ba
MD5 0a93aedb27f98a2e2c96d08b1eb5f32b
SHA1 ceaa6651d63339a60316666162895f0761d8efe5
SHA512 1f0a1dd311cbb3bc70d7db8458f6bee2a21410b8047d3b582cf8df26000c34e5c26985c7fa8472b8f9e0da11b273b8fd05f514ce4a35451ee33030f78d4c728a
SSDEEP 49152:PSuZQIY0Be2KcRVtOnks6NMHqiB+kn3Hnx:15dKii61q+k
TLSH
T1D9C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4f03ee5a2618c39657d9d0ce93c9169e9ce7e1397368e9f9134454f425d3e78e
MD5 c275f76a6527c8d81fe776fb154b912d
SHA1 bf456e1defa82cc33f68823468a110451c745f49
SHA512 bd84cf13d4aac79c70c4a87fc7c81d101726e18ff55174aea262ab70db0ef4fc571c4d555187226434db8628688276adc431799281ffee7d55a0acdef0dbcbb0
SSDEEP 49152:+htSn8EApI0fig3giDn0AP5wvB+kn3Hnx:fX2imphQ+k
TLSH
T1D695BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5aa8f80b267e25193461c3ee91abed8c32097a7b10ae8302d482fd3c891ebe0a
MD5 597d98e964f3c682592f31defd761d60
SHA1 647d4fefb34f6c0c3e61d30fc1a40999adadda32
SHA512 74c4fa5c120184919ed6257d6fcfba210501e8d7b0907eea48415587484b61288382fef6545f20be7d82a98a0b2b871e7b2e20379f8ed374672b2c51874ce733
SSDEEP 12288:ZCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZJNyBo4kx929bL3Hnx
TLSH
T1D44523129A0C627AF76D3FB0644A8058CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 be2788371abd54fbed2d4872c2a65023ed18b83cb98f142c0e7e8464103a0618
MD5 4fc27875a2c6a0950d6d29e3df73d236
SHA1 3a2951bcc0d57501ca341dc401af4a001a4bcd30
SHA512 0dffcb7abaa29eca2fe520267af5e90974cf98eeae76a2165fb7e009e16913a921c054d065c3ecd4d32f21d76c9f9c5deee3bf109ec15690cd7dc99ae87cedfa
SSDEEP 12288:aNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:aSNyBo4kx929bL3Hnx
TLSH
T1B64523129A0C127AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e4b8c14abc7f823d13151458981158688c43489b152339b5497d9e1165506789
MD5 a647689b4418f23b54614257c65647b6
SHA1 be88abcbc5061505d338ad0a9e8b000ac26c6f88
SHA512 faec8a366a306b89e231e478c944c4832cfd8551a7c41aa781900272322c10264fe800fd9f632dde3d29025b558851fb744710bccbc4e242d2443d295f3abbe6
SSDEEP 12288:t7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tYNyBo4kx929bL3Hnx
TLSH
T10B452312990C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7dd375cf4b1f3fbccebf3f54ad6f3ae332a13214e40ea92ada3f3a452ab67df6
MD5 d00ea9a30228a7710ffb83ec3ad9d0a4
SHA1 c9d3f93aed89b7230e790af67b878cc0d476b793
SHA512 69ba57bbade654ce45b121e0ef712bce5078cf4d2ec49be855ae8c7a4a0a49496f2b07b201fda79f3ad44a59bcdff975d7672404a042842c6ba324e8e9537685
SSDEEP 12288:mVYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WNyBo4kx929bL3Hnx
TLSH
T1EC4523125B5C12FAF97A7BB0985A8054C835BC8A5B7197DFDF124C7B0EB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 84ca67c8d1132afd980978182d8d419aa139a7bad1c5faaba66ffd41cbc8c9c9
MD5 7df1cad5eb50942dc73fa72c5f55ff03
SHA1 5f5a762472f8820e11527a4bf39fa522fc688d22
SHA512 5f1cbebcb556b2664256d485ceda3a90959ba508cecb0b89e1fa159557962f80c42f2187f6db07c10ecc1cf7e330bebde4fe5f7d2246284d8290130baf3d841a
SSDEEP 12288:zALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:z/NyBo4kx929bL3Hnx
TLSH
T1F4452312990C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 056277e29ec1784afcd367607f8ec8162fbb1390df24ee6a22747b91a0b19201
MD5 44dd9537d4bcd87136a80eec83c14ba4
SHA1 bfbb1221e8f3e51a1bd18b173905f4fb9887d1cf
SHA512 bc2a1567fbbc4ac63ab0f9edb2372b37492ac22d0bb1d47c2ea97ec72e8bc3e71bbdf1910928488b16c186e8b8058ce0ed24b86192635555b1bd3ccb86777306
SSDEEP 12288:0JLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0WNyBo4kx929bL3Hnx
TLSH
T1DD4523129A0C627AF76D3FB064498098CC34BC8F1E9593D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d53fe692941b678af78d001f317b9e62d4b9adc7cfd67d00a62ed718222b399b
MD5 060b1d71cd787c086066f1fa1865443c
SHA1 393099cf6b592e22547f67632b418a90f10fae42
SHA512 fd02dcf84c4b74d91d7ed254f7da97c669021b0bf917102d744d6a4113fa0ffdd2ec65fad3ea90a93c022d4e2d4c2c9f83271f82a4b5edde9bde70022ba195f3
SSDEEP 12288:U1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UqNyBo4kx929bL3Hnx
TLSH
T18A4523129A0C237AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9363741342af7e4e5ab05165abc69b39dd167c2c6c2067412e0a40f9177f0b2b
MD5 42d8b8480fb799bebb32c5d78210e2b9
SHA1 9546b5bf0472900ade485ebeaacddaa7cba8595b
SHA512 4109c66d626a1888d1d5a07b5c014134583caccfe40956a93fa652b7fb5443c8dd3c118262960895c1f636c02e76ffd643f092bb598b90a0ecfc6d8b843467c0
SSDEEP 12288:FiZwbjzzFEoS2cPvytLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:IZMXzFVSOyNyBo4kx929bL3Hnx
TLSH
T182650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 881b12d782f5db3ec9487a743599b42c6d043565e974a8a1196b161ba3239642
MD5 44bd665de306320d9a29728f1accc284
SHA1 8c9bb0f79252e5d9a17d2c9ad2dfbccdb28081a2
SHA512 ac37a5c6b83696a27b389f7ec0fe1d99f89cd8245265278e001501876112a9b09f8a9407271e1e99933f154313f8de2fa16bb8e139bca2609485cf62dfea543e
SSDEEP 12288:TGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TFNyBo4kx929bL3Hnx
TLSH
T146452312590C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f06a0c124375b2980cc088a43a554e4906461eb0bfdb669fe6ae3e7fda5477af
MD5 6dd33ed12d9462111ca37ab40c428117
SHA1 421ddaa6069e6715ad145dbe603cca7104c69cdd
SHA512 73ec3fdca16fbf4ee35907052b7446c12dc10b7675fc5eea10bfa08076da1bb335de246f77b9851762c3e64c86ed5fa44b80e85dd1c2cb1e200a50fe9d712d39
SSDEEP 12288:86LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8RNyBo4kx929bL3Hnx
TLSH
T1254523129A0C627AF76D3EB065498498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 151537eef273ca32a60d0e07fc9c2ab1596d8e5ed19bdb0595f9e4db8a9c8b47
MD5 69fc6e6db9e9f9f4fa9eb0d6b514d700
SHA1 94ed3d93d541d031f8a3f8c7a6e3a3dd45a2e96a
SHA512 00a094cdf46d400e654761258ecd60816c584339b67fc6ba45ff8a8bdfe703bf31fff1dcc24cb04f229017fb6d3985c8e12639275e32856d1b8695a2665c06f1
SSDEEP 12288:xyPz5L8hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gzyeNyBo4kx929bL3Hnx
TLSH
T1EA55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4e8f2702d1becd8876bb0a43ce977e118edcb11d0fa2aeab1d87be82206b143f
MD5 74beecaccf9262db9cec7b3400b5c701
SHA1 0d974298ef00c7372003443b898a168e17f80f6d
SHA512 7594a076d0dfa1713bcf07c7f8bafae8b3d77f7ce38e08c7b619ed809ce916d8cf9d9ae1ae424639d042006c0c22dbe52d0ebb77db5e21fd1f062f7792cdd380
SSDEEP 12288:ZGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZFNyBo4kx929bL3Hnx
TLSH
T18D452312990C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759BCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 aa8f0df0d706c8be88f1c18613b9740e5b65db36f013e03396ef953dc3638b1b
MD5 15dcc758e0677bb5cd890519b496befa
SHA1 42fb10c74a53adcea839cf86971f6433c75e6e15
SHA512 6644fcfb610b803f6066ce5f6572f48c3e4a3ab18cdc546b3d6a1b0bd4d46694178bbc82548f22cb249552d05cfb5662a1483d3c01cc29d277a8a9bfa264517a
SSDEEP 12288:KGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KFNyBo4kx929bL3Hnx
TLSH
T1EF4523129A0C227AF76D3FB064498598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9b7de66e2d4c605f557e55b3e5b5858fee333a9c3832dc74c1f91932e702d2fa
MD5 944c0a7d104004cf848a1b6e97860755
SHA1 cebd141cd3f2d0e5e98937cd221d1719b206cab7
SHA512 9e9f5e4b862d00520bb8dcece699f1716557aeddd81a729a8b5e047c66bb52f25bc536227f7201d8da4cb091fb77d8a0744fd43150b8707984f33e795942210c
SSDEEP 12288:XyPz5L8hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:azyeNyBo4kx929bL3Hnx
TLSH
T1A255120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 81b056ae279894a03210ce57277e113f98bd381b34b5f3baaa125f97e12873c6
MD5 fd8a0faecf633ea96da7099746ae1a36
SHA1 70eaacb5df8ff13ae3661fb48d49a128a70ba175
SHA512 36a59e987eb68119b15353fd63a2edf8b7e9bfd6d431fd9f66837e4e4ac799a6f8b5e90b6585fa1d7bce1e09a1faac6abe0a8967f6e35290141d08aeb54e6d44
SSDEEP 12288:pCd98WYoaLHF3z0z04PDvhLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:0TtaLl3z0zDINyBo4kx929bL3Hnx
TLSH
T1896501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7f23860363f61b5509a6effe9f60ba10041da1acfd36d447157f1288e83dc6fa
MD5 240d31163d5b04cdc8099303042ecb44
SHA1 04153b181b1f398c1d52c46e9e1e9b7e7b29da76
SHA512 a49ad90134dc0f13bbea84e9bfe0e225d8d3f1e42c7a52c9151520a88fd7a460bf9a02bd91060a0895305dd173f31b08f4d5f4dbb161b0b6e9d0739cf3275744
SSDEEP 12288:0i4e7ARdTfgwCHKy7GLbbdIvMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:03ld9CHKy7GZ8NyBo4kx929bL3Hnx
TLSH
T1A275CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 df8b97b3715d77d718802341ab8e64aff68dd493c2be7d1fc3b07d7d1725ed66
MD5 38f15ff222c6a3038c10b8920b3e98c7
SHA1 669dba66f5670cb10a568525a12edf7c82cd8c23
SHA512 650c65e433d6bb5b93b219dab731880d3f3c36734060e8dc136b1dcb6a62409c745a8124e9712586310bb428b466f767ab28695d8ce736a308a5f0b3a008d339
SSDEEP 12288:vbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:v4NyBo4kx929bL3Hnx
TLSH
T1F5452312990C627AF76C3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3b7048d7d108fc3cf8e32df47395ffa4face5f458f4dbff5de13e69c9cd2dd89
MD5 56e7061ffafd82579e618f819741f30e
SHA1 03692ba2d3354a62e62657b8838e29ccac4ae02d
SHA512 d3d9cb722252456db1c40a1f553c909f515afa3e0e9a761cdb7abd1c75f99bca1891f7dafb1743f7c54670fde99fe3b463822701c31499e9dd89edba92985044
SSDEEP 12288:UBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:U+NyBo4kx929bL3Hnx
TLSH
T1C94523129A0C227AF66D3FB0644A8554CC34BC8F1EA597D8EF679C7759FCEA24E20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a80f0cc764a9e488eadb1c5f422a34a930b62ffbf7cc5830b54bf6c791dcb62f
MD5 72eb2e6dabcc125e8d947afe56e36593
SHA1 9878146fc545314dc6bb3795870c76458d164e29
SHA512 356d0d0aa2427bc6dc753c34602209432141e50abf2ebd2095310e5ec388d255e01028e9c291b4930e55579fb4874d8d8d99c71d24af5e2259b991a0b62118cc
SSDEEP 12288:4MLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4TNyBo4kx929bL3Hnx
TLSH
T1DB452312990C223AF76C3FB0654A8598CC34BC8F1E9597D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e80f7830ee3aa423bed1d543480828728c311e31a2303fd413080c0b5d49353e
MD5 969bb02d6c1a2ccd059bd32dda213a27
SHA1 bd1443312bf2ee6f50626a77b35d931cfe586f25
SHA512 da75ca29f1bf40b70d6bfb32495304bab532b14cd3c6dc55087017cb77991d01aa50941f0d93d052e31610ee8d7cc2f943c2f91d6fd1730cd0e718c656fd8e1a
SSDEEP 12288:NGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NFNyBo4kx929bL3Hnx
TLSH
T1E54523129A0C227AF76D3FB064498598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 20f61bc28c92311578d3d09ec3c21ac5ee54128fe777c14a060e332b99cd15ef
MD5 62a9b36bdee9a8055b27ff3aa26064a8
SHA1 4e50d7d6c41b5109901f4d7f6e573d7d7ee65e7f
SHA512 05630b1b8a05a626910bab0c515216115a9805880e6cf03f29dfa9a4befb85fb38f6b7664b37804fd3575b504a5b00ca5870744b89dadfb63ede728ab4a20ab9
SSDEEP 12288:pbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:p4NyBo4kx929bL3Hnx
TLSH
T138452312990C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b7c37547a0931b2da8f70193caed9dc4497d1ca15c259883575ffda8467f2c62
MD5 04253e2eb2cc5dd9ae39b32b5cdd1c71
SHA1 ecdf934f049071af379d68fbc482da8e1dba62a5
SHA512 53a0de1e2d5ce728e5cfc60bf278ae6bdcbab5b740351adaed6de6ecb8b295b9ac6eeac1aaf8c7426ce5ec30a66d420a07ddadc4c03cf744e96f12d051bbb6cf
SSDEEP 12288:dOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:d9NyBo4kx929bL3Hnx
TLSH
T1574523129A0C227AF76D3FB0654A8554CC34BC8F1E9697D8EF27987B59FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b4af020a35c16d6184ed7f21fdf97eb8acac80c522f8645678adac79fbc44eb0
MD5 eb4c767891a60c0c44e8fce3c163f534
SHA1 bce2f74da58e98cdc1d2b448db20f56c4a078e23
SHA512 16415a85fcbe32b1e940ed862f5006252214df50d2c23eab5c348c1711460d03f16684b848580307250d4530460d016e224340fc154d2e3b38e8a32cf295bd9b
SSDEEP 12288:AALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:A/NyBo4kx929bL3Hnx
TLSH
T17C452312990C623AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4b9dbc1fabf4d049854981da3062a5e190ae75c974b97f4154fecab682c9f6d7
MD5 804cc1022d2e62c7a4847a81efce25b5
SHA1 b3dae176fd01041a1b4abf7151e08df5a98f2730
SHA512 2eb8ccae16eef4f119a77346ca6c88a1db6e78198cc55b66bfe35acfcbcf16e75e2c473c3d02dd10e5a79d858ae19d32a017d26022aac583540e85a42d0e030d
SSDEEP 24576:nfwvqk9RX6wkyAIhNyBo4kx929bL3Hnx:rMnYI2B+kn3Hnx
TLSH
T1B785DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ddeadf4810c157a51bb77a8313986eb549c92bd443f01661e44399a37fb6777e
MD5 832ba76f7ce235225bff10dc0623d5e5
SHA1 623c00114496f1c3e44235865f64c22c98b008af
SHA512 d7c1a232a3a9fd808acedf4037d2af3c55ea637976d6480f2f7a94cc430260ec444dbf7df258698555d4bea043b6e2d7e02527fdeca35aeb4e5e59ccee696858
SSDEEP 49152:vYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PB+kn3Hnx:6ySzPB+k
TLSH
T167066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1348eec08263d9e7edf6679f66b7c35ff167a66a035cc943de0a590e0825ba76
MD5 6ca7e770ccf42fb737b48de124690020
SHA1 d6439671c83538024885ef2558028dc763d390bb
SHA512 fd541b5af7a2960fbc8362d0a1be37c9c0753153b266ed7e4e88ba837b932c8e780300bed3dbb6f8a0e7a34b875de4406d7564c70db71b70f721928d63a58872
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYCNyBo4kx929bL3Hnx:c47JUQjTirIhCnDHUPfF//B+kn3Hnx
TLSH
T16765AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b7d075a8150b45a0c17fe89a097e432acfb263a2fe70a638c4b46163f59dd92c
MD5 50c893c834f14081bba26bfb730bf330
SHA1 ada8f4fc7c47e810bb2b5ef04aa33f5eef6e4c42
SHA512 b563ccc2cacde7dec6df00683968c7600b8c643284bd757ea79b90d87c23703a1370006168f9253f2f3c07e34c785487034b9a674a1d3390e2efb2cba8116d19
SSDEEP 12288:epsfWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:v1NyBo4kx929bL3Hnx
TLSH
T1F655F01AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 55e98492d089d867fc7d2f4a8c8837061a593c5656242d1c8667dde2e98763b0
MD5 cce9b2f3f1a03a600c76f8000d2c76aa
SHA1 f7aa390863c4d0ffbf832d08a014d1132a7cc9f5
SHA512 c80c699120c9845933044876fb14ae178c4f89d62023930bc4369690ae066295e4ad2cbdf1840f1d6929ea6447ad72c84f9a3c8b6b841105696a1c2be2bc9af4
SSDEEP 12288:Wn09+iU3fQjEdWxWPHFvzVX14vbsGQ3MXJRMtdqA9w:WneBUPWWPlv5l4T3Q3sJRMyA
TLSH
T178353850766AD75FC6AD40321E32C1CCA7703D41EE05AF0773C88B3F9576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4873e60c610be455d05f2f0d0294eeee5f78d1204f9b59bbb70e9ce57d2e56be
MD5 795e1e4a04d2a36be2a7cc44c5867933
SHA1 c1782f36a6f2ce9bb297be2fe398a3703e1970e7
SHA512 e9c29c30dee2ab8c9c5435662f838ac0e049ea78efc8a261319a226cbc98f47eb78b17638f674fd1d10a4d0407bb16b195cede358ee000f87847ddd5ac1a6847
SSDEEP 6144:H+9DCqJlYPdXx1T+zQm/T1qnBD+D9RmagbakDP7V/1ps0YysZQHcSabRijaQ826j:H+xRAF+hRSbR9vmZqeBeENL
TLSH
T1D865FA81A437A39FD5FB603107265B4CA7B4EC07B7496F2673C8453AD82A725B0B83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b7f284608ecabaf1f0ccba7e873cb6f6863bb7986a3dcdfcb1026b832a16b57d
MD5 4256beb07c8d555871e0a91943061733
SHA1 a2790352501319109628ab86f4e8e642310c94b9
SHA512 cbec2b80c4f0bce4c2ebc2296ad55c19d2601284d9507a29a0163801bb28ab73316d16a4731ecf9e42c11e996174257b62bb08ea728b9af3180582780ee25983
SSDEEP 12288:By7eLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AtNyBo4kx929bL3Hnx
TLSH
T166452312975C663AFA7D3AB0645EC024C839BC4D0F50D6D7EE1698BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9e85c7144249d7c579a7cb8de6ab1f3ff99ee578079117851a5660575ad231f4
MD5 6087abb5f450b06d65d7d44637fb98d7
SHA1 2961d602cfbc9e447427149c064fd4a125d1b66d
SHA512 c587bb68071537be64a6e08d6605f8203b3fdd4a9d7b08c2c819501dab4e35fbcbd7e5aaa139d1c233bb97f7d472d381467166d75b506f3596b3dc93000c33ea
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bY7NyBo4kx929bL3Hnx:zgb4mBIBhGFBB+kn3Hnx
TLSH
T11965AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 02cdb6e14391d53487ec229d4a153737b8b1bae590f1e919be6b865ecbeca60e
MD5 80bb84477d868cf7a9da99774001d048
SHA1 78f7784dbefe66131428c4d906ae62a183adfdcc
SHA512 47cda445254a5718a324482c3456e30d8e2a783de5cf1b9edaa6cd412c34005988a0a76d1e2c49548fee4a81e123bbed38fb2591c3e73e745cbb6f1d70063655
SSDEEP 24576:aG88u8FpJqH1Jzria7/myNyBo4kx929bL3Hnx:h7ZFPqVAa7/cB+kn3Hnx
TLSH
T13685F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 75cba6779e450c9eae09e09ee9dd4fa19c710d874b5c017a632eeddde4246e34
MD5 62c8211694367d468e9b5570abfb2124
SHA1 aca6a01ca2c02f53fceccb8ce2ad4d06059c346a
SHA512 5774cb7aea2b408a5c92df5041b83c8bc71daa9b74ecff5ad0cd449b28d04808dbefb9827ef0974836c0b0c1392d96def55c0e7431abf7caad6ed4084ff7f7fa
SSDEEP 12288:3HvUrBFrEjwaQ5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3PUr+NQmNyBo4kx929bL3Hnx
TLSH
T12B65F12F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ee437138fbef4184ba12556ee353c2f304f0f9fddbcd66708140a5cd8ae60823
MD5 7de99df1c9d9a9faa1421f4a4d07a74b
SHA1 8eddfdcbcfe6071bee82a801f5bb47e0ca6180c5
SHA512 31effd8cf701747290862c1f38961bfe5b85df8417aaf8a0d07fd207bc0efcf348f4dc2e4aea1472f896c1f67e4c108d0db114c5ec8b6c3b3f8d2340832a4b89
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdB+kn3Hnx:qG05lO43b++k
TLSH
T12AD5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ac6d3e2e42173a85cc94a7719a8139e7a6a4d87b146e9497d47f04ee62198d28
MD5 9893bb8afeab515503d5edd452456c37
SHA1 f7c0c81af6623ab27af00dfdb3b10a7dab8962f5
SHA512 e9256c5afc45a1f5e22c953eb95cebe8198539b06fd94bc9718a5bdfb7d6ff5e24e7119617dd7608de364a1a62ec2a4722dceed0fd0a3549b689e87149199b59
SSDEEP 24576:ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0NyBo4kx929bL3Hnx:2a5POZ3BJt2pasx2+m1B+kn3Hnx
TLSH
T16E65AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52bdfd5242fefac67ef1eda9fbc142ef4d96fb7399dca843ca92f85fde2c1aed
MD5 8e13523ddd08054a7821d2e057b74b65
SHA1 97795f7493d5bc9db9efeb17a7c8dfc62db5b5c8
SHA512 ee63700c0a5bb79bc23998bb5c6920c225b149246ad613fa579f742523a1e28f7ed490a1daf56e030fc0ae454339f737992f69f7e3dab43b38895b2654d4b70a
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkaNyBo4kx929bL3Hnx:yNc/zEOVHF8B+kn3Hnx
TLSH
T1B9858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4af1a4f7c5e64800d989318a4af65d93490d524605f9de587fd04d08942f427c
MD5 344c8a93f77eeb7d9aeb95cd4d67ec2b
SHA1 56152e36bf34c5577dc3b667675dff38239dde8c
SHA512 df1aeca6ca91bab95b6720ac9be2ee6532fbb07d384536b7ff8e3395dd08b77c4a3ecd3f58463cd3f27ae2b2fea38bbf4d63793541f75fa54ee7e9262d7b1f74
SSDEEP 24576:5TkNvNnaFeYhJNtmZBmgNyBo4kx929bL3Hnx:5TMwBtOmTB+kn3Hnx
TLSH
T11955AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c98f38bd4565684307f5a293afef1d8d5c2e2928db7cf6a796636c9e9aea4a98
MD5 c35e7c47469d5f25f8965cb5d5fc6dce
SHA1 737b9a6f6c798d3a48e960a896ce6d01cf44e785
SHA512 9a90bf6e74f00860a1bbebe65baf652e4ed6497ba162e228fbb9c68f862152481bd11859b5ae7d381359192b83864ea665d8b875192c0b2331254c36bcc00f5b
SSDEEP 12288:qQcMxWDXN1Dp/fshBItT1IQgAiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:4D3FHshBIYQgApNyBo4kx929bL3Hnx
TLSH
T11B75E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/8-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/8-53-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/8-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/8-39-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/8-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/548-69-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/548-75-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/548-68-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/548-302-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1892-303-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1892-80-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1972-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1972-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1972-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1972-122-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1972-131-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2316-108-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2316-306-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2316-117-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2316-115-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2372-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2372-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2372-321-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2372-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2372-84-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2372-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2660-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2660-287-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2660-55-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2660-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2696-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2696-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2696-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2696-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2696-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3276-9-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3276-66-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/3276-2-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3276-0-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/4264-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4264-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4264-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4264-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4264-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4264-308-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4492-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4492-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4492-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4492-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5572-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5572-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5572-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5572-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5572-79-0x0000000140000000-0x00000001402E9000-memory.dmp

Download